Update javax.mail to 1.6.5

[jvz]

This has changed maven coordinates to the jakarta project, though the
code is binary compatible still.

Proposed changelog entries

• Developer: Update javax.mail to jakarta.mail 1.6.5

Proposed upgrade guidelines

N/A

Submitter checklist

• (If applicable) Jira issue is well described
• Changelog entries and upgrade guidelines are appropriate for the audience affected by the change (users or developer, depending on the change). Examples
  • Fill-in the Proposed changelog entries section only if there are breaking changes or other changes which may require extra steps from users during the upgrade
• Appropriate autotests or explanation to why this change has no tests
• For dependency updates: links to external changelogs and, if possible, full diffs

Desired reviewers

@mention

Maintainer checklist

Before the changes are marked as ready-for-merge:

• There are at least 2 approvals for the pull request and no outstanding requests for change
• Conversations in the pull request are over OR it is explicit that a reviewer does not block the change
• Changelog entries in the PR title and/or Proposed changelog entries are correct
• Proper changelog labels are set so that the changelog can be generated automatically
• If the change needs additional upgrade steps from users, upgrade-guide-needed label is set and there is a Proposed upgrade guidelines section in the PR title. (example)
• If it would make sense to backport the change to LTS, a Jira issue must exist, be a Bug or Improvement, and be labeled as lts-candidate to be considered (see query).

[timja]

why is this removed?

[jvz]

Good question. I'm not even sure what was patched originally, but it's a transitive dependency of jakarta.mail already.

[timja]

do we need to run PCT or full ATH on this?

edit: I guess if binary compat tests pass, it should be fine

[timja]

We probably need a change log entry for this? in case it causes issues

[jvz]

do we need to run PCT or full ATH on this?

I ran PCT of this using a branch from stable-2.222 with no issues. It looks like ATH is automatically run for PRs in this repo.

As for the javax.activation thing, this looks like the fork, but it has no history: https://github.com/kohsuke/javax.activation

[jeffret-b]

Seems good, if it's sufficiently tested. I haven't testing it any myself.

[timja]

Only ath smoke tests are run on PR not the full set afaik

[res0nance]

Full changelog here

[oleg-nenashev]

Be careful with Jakarta code for the activation lib, there are/were known issues with module handling there due to the groupId changes. Before we merge that, an investigation is needed. Maybe a manual testing on Java 11 also

[jvz]

Thanks, I was wondering why that was patched! If this release is wonky, we'll need to create another update for a forked version of that.

[jvz]

I tested this out locally on Java 11 using Gmail as my SMTP host (had to disable a security setting that marks Jenkins as an "insecure" client to try it out), worked fine. Only log messages I'm seeing are related to a removal of javax.annotation stuff.

[jvz]

Test failures are unrelated it looks like. Infrastructural.

[jeffret-b]

This will be ready for release after the customary waiting period of 24 hours. However, we may want to wait until after the release of 2.235 based upon the current LTS selection discussion.

[timja]

This will be ready for release after the customary waiting period of 24 hours. However, we may want to wait until after the release of 2.235 based upon the current LTS selection discussion.

I agree, unless any objection jvz can we skip this from the current weekly as I assume there's no rush on this?

[jvz]

There are some security hardening updates included in newer javamail releases which would be great to get into an LTS.

[timja]

Sure, easy enough to back out if any issues then

[jeffret-b]

Matt raises a good point so I retract my earlier comment about waiting.