Skip to content

Fix tests testing against wrong jackson - #1503

Open
KochTobi wants to merge 12 commits into
mainfrom
dependencies/fix-poms
Open

Fix tests testing against wrong jackson#1503
KochTobi wants to merge 12 commits into
mainfrom
dependencies/fix-poms

Conversation

@KochTobi

Copy link
Copy Markdown
Contributor

Cleans up the poms (solves hints with mvn dependency:analyze and fixes wrong imports in a test)

Tests in identity were testing using the wrong jackson version. fixed it.
@KochTobi
KochTobi requested a review from a team as a code owner August 12, 2026 13:36
The upstream life.qbic:openbis-api artifact is a shaded uber-jar that bundles
an old (2017) Spring Framework compiled against javax.servlet. It defines
org.springframework.web.WebApplicationInitializer with
onStartup(javax.servlet.ServletContext), which collides with the real spring-web
(Spring Framework 7 / Jakarta) version onStartup(jakarta.servlet.ServletContext).

Depending on classpath ordering javac picks the wrong definition, so
Application.java failed to compile with:
  "Application is not abstract and does not override abstract method
   onStartup(javax.servlet.ServletContext)".

The datamanager-app module only avoided this by declaring openbis-api as a
direct dependency positioned after the Spring deps - a fragile, order-dependent
workaround.

Add an openbis-api-clean module that shades the upstream jar and relocates the
bundled org.springframework.* classes into the private namespace
life.qbic.openbis.shaded.org.springframework. This keeps openbis's bundled
Spring (which real Spring 7 no longer provides, e.g. org.springframework.remoting.*)
available to the openbis client exactly as before, while removing it from the
shared namespace so the real Spring is authoritative at compile and runtime.

The relocation runs during the compile phase and is unpacked into target/classes
so same-reactor consumers see the relocated classes (a package-only shade is
invisible to other modules during a single reactor build).

project-management-infrastructure now depends on openbis-api-clean instead of the
upstream shaded jar, and the now-redundant direct openbis-api dependency is removed
from datamanager-app.

Verified with: mvn clean compile -Pproduction and mvn test-compile (offline),
both BUILD SUCCESS.
…s-api

Add a new module that repackages the upstream life.qbic:openbis-api shaded
uber-jar. The upstream jar bundles old (2017) third-party classes under the same
fully-qualified names as the real runtime dependencies, which collide depending
on classpath ordering. The module shades the upstream jar and relocates the
bundled org.springframework (javax.servlet flavour, including the
WebApplicationInitializer that breaks compilation against Spring Framework 7 /
Jakarta) into the private namespace life.qbic.openbis.shaded.org.springframework.

The relocation runs during the compile phase and is unpacked into target/classes
so same-reactor consumers see the relocated classes. Additional bundled
namespaces (org.apache, org.aspectj, org.eclipse, org.slf4j, org.aopalliance,
com.fasterxml) will be relocated in follow-up commits.
…amespace

Relocate the bundled Apache classes (commons, http, poi, etc.) the upstream
openbis-api jar ships into life.qbic.openbis.shaded.org.apache so they cannot
shadow the real Apache commons libraries on the app classpath (e.g. the bundled
old commons-io IOUtils would otherwise break code expecting the real commons-io
API).
…namespace

Relocate the old AspectJ classes bundled in the upstream openbis-api jar into
life.qbic.openbis.shaded.org.aspectj so they cannot collide with the real
aspectjweaver that is pulled in transitively via Spring AOP.
…namespace

Relocate the bundled Eclipse classes the upstream openbis-api jar ships into
life.qbic.openbis.shaded.org.eclipse so they cannot collide with the Eclipse /
JAXB classes already on the app classpath.
…mespace

Relocate the old slf4j classes bundled in the upstream openbis-api jar into
life.qbic.openbis.shaded.org.slf4j so they cannot shadow the real slf4j-api that
the application logging facade is built against.
…ate namespace

Relocate the AOP Alliance classes bundled in the upstream openbis-api jar into
life.qbic.openbis.shaded.org.aopalliance so they cannot collide with the
org.aopalliance facilities provided by Spring AOP.
…e namespace

Relocate the old Jackson classes bundled in the upstream openbis-api jar into
life.qbic.openbis.shaded.com.fasterxml so they cannot shadow the real
com.fasterxml.jackson.* libraries pulled in via Spring Boot and ro-crate.
Add the openbis-api-clean module to the root Maven modules, manage its version in
datamanager-bom, and switch project-management-infrastructure to depend on
openbis-api-clean instead of the upstream shaded life.qbic:openbis-api jar.

Remove the now-redundant direct openbis-api dependency from datamanager-app. It
was only present to push the upstream jar after the Spring deps on the classpath,
an order-dependent workaround for the colliding org.springframework classes that
openbis-api-clean now eliminates properly.

Verified: mvn clean package -Pproduction -> BUILD SUCCESS.
…abind

ro-crate-java brings jackson-databind with runtime scope only, but the module's
own code calls into ro-crate-java APIs that expose com.fasterxml.jackson.
databind.JsonNode, so jackson-databind must be on the compile classpath.

This was previously masked by the bundled Jackson inside the shaded upstream
openbis-api jar; after de-colliding openbis (see openbis-api-clean) that bundled
Jackson is no longer on the classpath, exposing the gap.
…ndencies/fix-poms

Resolved conflict in openbis-api-clean/pom.xml by keeping the local completed
version (all third-party namespaces relocated). The incoming remote commit
3fc85af was the earlier single-commit version in which only org.springframework
was relocated and which lacked the default-jar build fix; it is superseded by the
local history.
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants