[JENKINS-41631, JENKINS-40088, JENKINS-43715, JENKINS-40979] - Update Stapler and Enforce upper bound deps #2956

jglick · 2017-07-31T22:16:41Z

Follow-up to jenkinsci/plugin-pom#67. Downstream of jenkinsci/stapler#123.

Proposed changelog entries:

Cleanup of Maven dependencies in Jenkins core, allowing plugins depending on this version or later to build without “upper bound” dependency warnings.
Stapler library updated from 1.250 to 1.252:
- order of search for web method overloads is now deterministic in case of ambiguity
- deprecated HttpResponses.html and .plainText in favor of .literalHtml and .text
- related to JENKINS-40088: configurable export API behavior
- JENKINS-43715: NullPointerException fix
- related to JENKINS-40979: NullPointerException fix
- JENKINS-45903: Prevent file handle leak in LargeText.GzipAwareSession

@reviewbybees

ghost · 2017-07-31T22:25:07Z

This pull request originates from a CloudBees employee. At CloudBees, we require that all pull requests be reviewed by other CloudBees employees before we seek to have the change accepted. If you want to learn more about our process please see this explanation.

oleg-nenashev · 2017-07-31T23:22:47Z

core/pom.xml

@@ -95,6 +95,12 @@ THE SOFTWARE.
    <dependency>
      <groupId>com.google.inject</groupId>
      <artifactId>guice</artifactId>
+      <exclusions>
+        <exclusion> <!-- TODO it seems to want Guava 16; apparently it manages to run against 11 -->


What could possibly go wrong? :(

Well, we are already doing it—this just makes it apparent.

oleg-nenashev · 2017-07-31T23:23:40Z

core/pom.xml

+      <exclusions>
+        <exclusion> <!-- pick up from Stapler -->
+          <groupId>com.google.code.findbugs</groupId>
+          <artifactId>jsr305</artifactId>


Maybe it's safer to just define the newest version in this POM instead of adding exclusions

Maybe. Not used at runtime anyway, so probably does not matter.

oleg-nenashev · 2017-07-31T23:24:21Z

test/pom.xml

@@ -53,7 +53,7 @@ THE SOFTWARE.
    <dependency>
      <groupId>${project.groupId}</groupId>
      <artifactId>jenkins-test-harness</artifactId>
-      <version>2.20</version>
+      <version>2.23</version>


Unrelated to this change, I'd guess

It is, to catch jenkinsci/jenkins-test-harness#62 which indeed got released as 2.23.

oleg-nenashev · 2017-07-31T23:27:16Z

test/pom.xml

@@ -239,6 +263,23 @@ THE SOFTWARE.
          <skip>true</skip>
        </configuration>
      </plugin>
+      <plugin> <!-- TODO pending JENKINS-45271 fix, would be best to finish moving MavenModuleSet-specific tests to maven-plugin and delete the test dep here -->


Yeah, needs fix asap. OTOH, how many MavenPlugin-dependent tests do we have in the core? Maybe we should just move them elsewhere and remove the dependency.

There are a bunch. I do think it would be wise to move them to maven-plugin and delete the dep. I just did not want to take it on in this PR; would confuse the issue too much.

Could you please create a follow-up ticket for it?

JENKINS-45952

batmat

A wee bit more unsure about the part in the test module, but as this is the test module, this is OK IMO. Worse case something is wrong and we fix it in the future, but it won't reach the war/production anyway.

batmat · 2017-08-01T19:53:00Z

pom.xml

@@ -87,7 +87,7 @@ THE SOFTWARE.
    <patch.tracker.serverId>jenkins-jira</patch.tracker.serverId>

    <guavaVersion>11.0.1</guavaVersion>
-    <slf4jVersion>1.7.7</slf4jVersion> <!-- < 1.6.x version didn't specify the license (MIT) -->
+    <slf4jVersion>1.7.25</slf4jVersion>


👍 been hit by this recently and this improvement shows it's worth it to avoid JENKINS-41631 being too much of a nightmare when it starts reaching plugins (I think now it's still so recent that only very few ever tried, or reverted it seeing that new error).

Yes the intent here (together with the plugin-pom PR) was to allow a plugin using “newest everything” to build without warnings.

FYI @jtnord

batmat · 2017-08-01T19:55:08Z

test/pom.xml

@@ -53,7 +53,7 @@ THE SOFTWARE.
    <dependency>
      <groupId>${project.groupId}</groupId>
      <artifactId>jenkins-test-harness</artifactId>
-      <version>2.20</version>
+      <version>2.23</version>


It is, to catch jenkinsci/jenkins-test-harness#62 which indeed got released as 2.23.

batmat · 2017-08-01T19:58:46Z

And so 🐝 for the tooling to catch up.

oleg-nenashev

🐝 , a follow-up JIRA ticket for Maven Project tests is required. I or probably @aheritier will do it once we are around

oleg-nenashev · 2017-08-02T19:09:28Z

@reviewbybees done

ghost · 2017-08-02T19:12:08Z

This pull request has completed our internal processes and we now respectfully request the maintainers of this repository to consider our proposal contained within this pull request for merging.

jglick · 2017-08-02T19:20:34Z

Blocked pending @oleg-nenashev’s re-review of upstream PR.

jglick · 2017-08-03T21:58:28Z

core/pom.xml

@@ -39,7 +39,7 @@ THE SOFTWARE.

  <properties>
    <staplerFork>true</staplerFork>
-    <stapler.version>1.250</stapler.version>
+    <stapler.version>1.252</stapler.version>


Now I wonder why I didn't ask about this when reviewing: was this related to Enforcer Upper Bound Deps? Shouldn't it have been a dedicated PR?

Anyway, it revealed jenkinsci/stapler#128 for us, an internal plugin that does not compile anymore.

jglick · 2017-08-03T21:59:00Z

Ready for final review I think (assuming tests pass).

oleg-nenashev · 2017-08-03T22:03:41Z

The changelog entries should also refer Stapler upgrade, JENKINS-43715 and maybe JENKINS-40979

oleg-nenashev · 2017-08-03T22:05:21Z

test/pom.xml

@@ -128,7 +142,7 @@ THE SOFTWARE.
    <dependency><!-- we exclude this transient dependency from htmlunit, which we actually need in the test -->
      <groupId>xalan</groupId>
      <artifactId>xalan</artifactId>
-      <version>2.7.1</version>
+      <version>2.7.2</version>


So it's bundled into the core, right? Maybe requires a changelog entry as well

No, this is the test POM.

jglick · 2017-08-03T22:15:52Z

Sigh, forgot to release the staging repo for 1.252. Did so now, but need to wait for Central synch and then trigger a new build.

jglick · 2017-08-04T13:29:37Z

@reviewbybees done

jtnord

🐝

oleg-nenashev · 2017-08-07T22:57:53Z

Will merge towards the next weekly if there is no negative feedback by Thursday

oleg-nenashev · 2017-08-13T10:14:44Z

Added JENKINS-45903 to the changelog. We need to double-check changes in Stapler @daniel-beck

oleg-nenashev · 2017-08-13T10:16:23Z

1.252 does not seem to be complete: https://github.com/stapler/stapler/blob/master/CHANGELOG.md#1252 .

jglick · 2017-08-14T19:43:38Z

pom.xml

+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-enforcer-plugin</artifactId>
+        <version>3.0.0-M1</version> <!-- TODO 3.0.0 when released -->


[JENKINS-41631] Enforce upper bound deps on Jenkins core.

d7c17eb

jglick mentioned this pull request Jul 31, 2017

[JENKINS-41631] Make requireUpperBoundDeps work better with new cores jenkinsci/plugin-pom#73

Merged

oleg-nenashev reviewed Jul 31, 2017

View reviewed changes

batmat approved these changes Aug 1, 2017

View reviewed changes

oleg-nenashev approved these changes Aug 2, 2017

View reviewed changes

oleg-nenashev added needs-more-reviews Complex change, which would benefit from more eyes ready-for-merge The PR is ready to go, and it will be merged soon if there is no negative feedback labels Aug 2, 2017

jglick added 2 commits August 3, 2017 17:40

Merge branch 'master' into requireUpperBoundDeps-JENKINS-41631

2fd8338

stapler 1.252

45f392c

jglick commented Aug 3, 2017

View reviewed changes

oleg-nenashev approved these changes Aug 3, 2017

View reviewed changes

oleg-nenashev closed this Aug 4, 2017

oleg-nenashev reopened this Aug 4, 2017

oleg-nenashev closed this Aug 4, 2017

oleg-nenashev reopened this Aug 4, 2017

jtnord approved these changes Aug 5, 2017

View reviewed changes

oleg-nenashev removed the needs-more-reviews Complex change, which would benefit from more eyes label Aug 7, 2017

oleg-nenashev mentioned this pull request Aug 8, 2017

Update Maven Enforcer, add Animal Sniffer and Test annotations jenkinsci/pom#14

Merged

oleg-nenashev merged commit b8f6246 into jenkinsci:master Aug 11, 2017

oleg-nenashev changed the title ~~[JENKINS-41631] Enforce upper bound deps on Jenkins core~~ [JENKINS-41631, JENKINS-40088, JENKINS-43715, JENKINS-40979] - Update Stapler and Enforce upper bound deps on Jenkins core Aug 11, 2017

oleg-nenashev changed the title ~~[JENKINS-41631, JENKINS-40088, JENKINS-43715, JENKINS-40979] - Update Stapler and Enforce upper bound deps on Jenkins core~~ [JENKINS-41631, JENKINS-40088, JENKINS-43715, JENKINS-40979] - Update Stapler and Enforce upper bound deps Aug 11, 2017

jglick deleted the requireUpperBoundDeps-JENKINS-41631 branch August 14, 2017 15:19

jglick mentioned this pull request Aug 14, 2017

javadoc:javadoc could fail under some circumstances #2982

Merged

jglick commented Aug 14, 2017

View reviewed changes

[JENKINS-41631, JENKINS-40088, JENKINS-43715, JENKINS-40979] - Update Stapler and Enforce upper bound deps #2956

[JENKINS-41631, JENKINS-40088, JENKINS-43715, JENKINS-40979] - Update Stapler and Enforce upper bound deps #2956

Conversation

jglick commented Jul 31, 2017 • edited by oleg-nenashev Loading

ghost commented Jul 31, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

batmat left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

batmat commented Aug 1, 2017

oleg-nenashev left a comment

Choose a reason for hiding this comment

oleg-nenashev commented Aug 2, 2017

ghost commented Aug 2, 2017

jglick commented Aug 2, 2017

Choose a reason for hiding this comment

batmat Aug 20, 2017 • edited Loading

Choose a reason for hiding this comment

jglick commented Aug 3, 2017 • edited Loading

oleg-nenashev commented Aug 3, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jglick commented Aug 3, 2017

jglick commented Aug 4, 2017

jtnord left a comment

Choose a reason for hiding this comment

oleg-nenashev commented Aug 7, 2017

oleg-nenashev commented Aug 13, 2017

oleg-nenashev commented Aug 13, 2017

Choose a reason for hiding this comment

jglick commented Jul 31, 2017 •

edited by oleg-nenashev

Loading

batmat Aug 20, 2017 •

edited

Loading

jglick commented Aug 3, 2017 •

edited

Loading