-
Improvement
-
Resolution: Fixed
-
Major
-
None
JAXB was removed from Java 9+. In 2.164, JAXB was detached into the JAXB API plugin, which means that any plugin with a Jenkins baseline prior to 2.164 will get JAXB on its classpath via the detached plugin mechanism. Any plugin with a Jenkins baseline greater than or equal to 2.164 will get JAXB on its classpath if and only if it declares a plugin-to-plugin dependency on JAXB (recommended) or embeds JAXB into its own .jpi via a direct or transitive dependency.
A systematic search of the plugin corpus was conducted on May 9, 2022; this search revealed that this plugin has a baseline greater than or equal to 2.164, a direct or transitive usage of JAXB, no plugin-to-plugin dependency on JAXB, and no copy of JAXB in the .jpi. For compatibility with Java 11, this plugin must declare an explicit dependency on the JAXB API plugin as follows:
<dependency> <groupId>io.jenkins.plugins</groupId> <artifactId>jaxb</artifactId> <version>2.3.6-1</version> </dependency>
This plugin's identified usage of JAXB is as follows:
Plugin analysis-model-api:10.10.0 using javax/xml/bind/Element via org/dom4j/jaxb/JAXBModifier$JAXBElementModifier.class
Plugin analysis-model-api:10.10.0 using javax/xml/bind/Element via org/dom4j/jaxb/JAXBReader$UnmarshalElementHandler.class
Plugin analysis-model-api:10.10.0 using javax/xml/bind/Element via org/dom4j/jaxb/JAXBSupport.class
Plugin analysis-model-api:10.10.0 using javax/xml/bind/Element via org/dom4j/jaxb/JAXBWriter.class
Plugin analysis-model-api:10.10.0 using javax/xml/bind/JAXBContext via org/dom4j/jaxb/JAXBSupport.class
Plugin analysis-model-api:10.10.0 using javax/xml/bind/JAXBException via org/dom4j/jaxb/JAXBSupport.class
Plugin analysis-model-api:10.10.0 using javax/xml/bind/JAXBException via org/dom4j/jaxb/JAXBWriter.class
Plugin analysis-model-api:10.10.0 using javax/xml/bind/Marshaller via org/dom4j/jaxb/JAXBSupport.class
Plugin analysis-model-api:10.10.0 using javax/xml/bind/Unmarshaller via org/dom4j/jaxb/JAXBSupport.class
- links to
[JENKINS-68448] Prepare Analysis Model API for removal of JAXB and Java 11 requirement
Adrien Lecharpentier
added a comment - mvn dependency:tree on analysis-model-api doesn't show JAXB dependency, but running the equivalent Gradle command on dom4j (./gradlew dependencyInsight --dependency jaxb) returns
javax.xml.bind:jaxb-api:2.2.12
variant "compile" [
org.gradle.status = release (not requested)
org.gradle.usage = java-api
org.gradle.libraryelements = jar (compatible with: classes)
org.gradle.category = library
Requested attributes not found in the selected variant:
org.gradle.dependency.bundling = external
org.gradle.jvm.version = 8
]
javax.xml.bind:jaxb-api:2.2.12
\--- compileClasspath
javax.xml.bind:jaxb-api:2.2.12
variant "compile" [
org.gradle.status = release (not requested)
org.gradle.usage = java-api
org.gradle.libraryelements = jar (compatible with: classes)
org.gradle.category = library
Requested attributes not found in the selected variant:
org.gradle.dependency.bundling = external
org.gradle.jvm.version = 8
]
javax.xml.bind:jaxb-api:2.2.12
\--- compileClasspath
Declaring the JAXB dependency on analysis-model-api seems requirement indeed.
Adrien Lecharpentier
added a comment - mvn dependency:tree on analysis-model-api doesn't show JAXB dependency, but running the equivalent Gradle command on dom4j ( ./gradlew dependencyInsight --dependency jaxb ) returns
javax.xml.bind:jaxb-api:2.2.12
variant "compile" [
org.gradle.status = release (not requested)
org.gradle.usage = java-api
org.gradle.libraryelements = jar (compatible with: classes)
org.gradle.category = library
Requested attributes not found in the selected variant:
org.gradle.dependency.bundling = external
org.gradle.jvm.version = 8
]
javax.xml.bind:jaxb-api:2.2.12
\--- compileClasspath
javax.xml.bind:jaxb-api:2.2.12
variant "compile" [
org.gradle.status = release (not requested)
org.gradle.usage = java-api
org.gradle.libraryelements = jar (compatible with: classes)
org.gradle.category = library
Requested attributes not found in the selected variant:
org.gradle.dependency.bundling = external
org.gradle.jvm.version = 8
]
javax.xml.bind:jaxb-api:2.2.12
\--- compileClasspath
Declaring the JAXB dependency on analysis-model-api seems requirement indeed. Adrien Lecharpentier
added a comment - Added the declaration of the JAXB plugin in https://github.com/jenkinsci/analysis-model-api-plugin/pull/89.
Adrien Lecharpentier
added a comment - Added the declaration of the JAXB plugin in https://github.com/jenkinsci/analysis-model-api-plugin/pull/89 . I don't think that this part of SpotBugs is used in my plugin, the parser that I am using depends on SAX. But anyway, thanks for the PR alecharp.
Hello drulli, I can see that io.jenkins.plugins:analysis-model-api depends on edu.hm.hafner:analysis-model, which depends on com.github.spotbugs:spotbugs, which depends on org.dom4j:dom4j, which depends on JAXB, which is removed as of Java 11:
Is this a realistic execution path? If so, we need to add a plugin-to-plugin dependency from io.jenkins.plugins:analysis-model-api to io.jenkins.plugins:jaxb to ensure JAXB is on the classpath.
If this is not a realistic execution path and this scan was a false positive, please close this ticket as "Not a Defect."