Bump Jackson to 2.13.0

[basil]

Amends #94.

[MarkEWaite]

I confirmed that earlier versions of the plugin were bundling jakarta.activation-api 1.2.1 as a transitive dependency. The added dependency on jakarta.activation-api 1.2.2 makes it clear that it is intentionally bundled.

Supersedes #94 and #95

[jtnord]

The added dependency on jakarta.activation-api 1.2.2 makes it clear that it is intentionally bundled.

there is no added dependency - it is a dependencyManageent core (2.303.1ships 1.2.2 and as such if this is bundled without using mask-classes or plugin-first classloaded then it will not be used correctly and can even cause weird classloading issues if there are newly introduced classes.
If the dependency is needed then the classloader needs to be tweaked, otherwise it should be excluded, unless I am missing something

[jtnord]

jenkins ships with a lesser version (of jakarta.activation which itself bundles the same classes as the API 😱 ). if this is bundled in the plugin it is never used as the plugin is not using a plugin first classloader, so the fix should be to exclude the version instead.
if it is not bundled - then this means the test classpaths are more likely to more even invalid that normal.

[MarkEWaite]

The added dependency on jakarta.activation-api 1.2.2 makes it clear that it is intentionally bundled.

there is no added dependency - it is a dependencyManageent core (2.303.1ships 1.2.2 and as such if this is bundled without using mask-classes or plugin-first classloaded then it will not be used correctly and can even cause weird classloading issues if there are newly introduced classes. If the dependency is needed then the classloader needs to be tweaked, otherwise it should be excluded, unless I am missing something

I can't speak to the question whether the dependency is needed or not. I've confirmed that WEB-INF/lib/jakarta.activation-api-1.2.1.jar is included in jackson2-api plugin 2.12.4. The inclusion of WEB-INF/lib/jakarta.activation-api-1.2.2.jar as a transitive dependency in the jackson2-api plugin 2.13.0 release seems consistent with the previous release.

The build log for the jackson2-api plugin master branch (before this change) reports that the activation api is being bundled as a transitive dependency.

[jtnord]

https://projects.eclipse.org/projects/ee4j.jaf/releases/1.2.2

First release going through the JESP. No changes from the previous release (1.2.1).

[jtnord]

should also change revision to keep in step (not sure why we do not set that itself to $jackon.version but likely it does not work when it comes to release time.

[basil]

As @MarkEWaite wrote, this is a preëxisting issue on the main branch that is unrelated to this PR. Get the main branch in order before you request changes of others.

[jtnord]

Get the main branch in order before you request changes of others.

is offensive to me.

I was about to send a PR to your fork with the fixes, but how this is coming across is not helpful to a healthy community.

[timja]

What was the suggested fix? excluding the dependency, upgrading it in jenkins core? or something else?

[jtnord]

What was the suggested fix? excluding the dependency, upgrading it in jenkins core? or something else?

it would depend on what changed API wise. As per the eclipse release notes, what I am doing is excluding it (given if it currently works when bundled, it must work when not bundled as the plugin is not using plugin-first classloader or masking classes).
the version was bumped from the old activation-hudson-1.1.1 in jenkinsci/jenkins#4660 so this is also bumping the baseline to we get the 1.2.1 version so there can not be conflicts between the 1.1 and 1.2 lines).

But anyway - the version of the plugin can not be 2.12.5-SNAPSHOT when the api is at 2.13.0 there is a PR incoming anyway to fix the bundling - but that is a 1:1 like for like and not bumping jackson in anyway shape or form