Review dependency version numbers

• Key: SHALE-242
• Type: Task
• Status: Resolved
• Resolution: Fixed
• Priority: Major
• Assignee: Craig McClanahan
• Reporter: Craig McClanahan
• Component/s: Clay, Core, Remoting, Test, Tiger, Tiles
• Fix Version/s: 1.0.3

Description

Review version numbers of dependencies listed in our POMs to make sure we've got the desired versions (normally latest release).

Comments

[Craig McClanahan]

Looks like we have the opportunity to consider some dependency upgrades:

shale-core:
---------------
* MyFaces API & IMPL (1.1.1 --> 1.1.4 if/when completed)
* commons-chain (1.0 --> 1.1)
* commons-collections (3.0 --> 3.2) -- but should maybe just be transitive?
* commons-digester (1.6 --> 1.7)
* commons-logging (1.0.4 --> 1.1)

shale-spring:
-----------------
* spring-* (1.2.5 --> 1.2.8)
* (separate RFE to consider Spring 2.0 integration opportunities)

shale-tiles:
--------------
* tiles-core (is 0.2-SNAPSHOT still the latest?)

[Wendy Smoak]

tiles-core should be 2.0-SNAPSHOT. It has changed since 0.2-SNAPSHOT, so check for breakage.

[Gary VanMatre]

We should add commons validator 1.4 to that list too. I think that myfaces 1.1.3 has a 1.4 dependency. Shale core has a 1.3 dependency. It looks like there might be some API changes to that upgrade.

[Craig McClanahan]

> We should add commons validator 1.4 to that list too. I think that myfaces 1.1.3 has a 1.4 dependency. Shale > core has a 1.3 dependency. It looks like there might be some API changes to that upgrade.

Does Commons Validator 1.4 exist yet? I only see 1.3 linked from the validator website.

Be that as it may, the Shale declaration that it wants validator 1.3 is not being respected by Maven2, apparently due to the "nearness" rule that it follows to resolve conflicts. The only solution I know of that's guaranteed to work is to declare this dependency explicitly on each webapp, but that seems pretty silly. (Same problem currently exists on Logging ... I tried to declare a dependency on 1.1 but it's still picking up 1.0.4.)

[Craig McClanahan]

I am trying to update the Tiles dependency from 0.2-SNAPSHOT to 2.0-SNAPSHOT, and as Wendy warns there is breakage here. I get the following compile errors:

==========
/home/craigmcc/Apache/shale/current/framework/shale-tiles/src/main/java/org/apache/shale/tiles/TilesViewHandler.java:[266,30] getDefinition(java.lang.String,org.apache.tiles.TilesContext) in org.apache.tiles.TilesUtil cannot be applied to (java.lang.String,javax.servlet.ServletRequest,javax.servlet.ServletContext)

/home/craigmcc/Apache/shale/current/framework/shale-tiles/src/main/java/org/apache/shale/tiles/TilesViewHandler.java:[309,53] getContext(org.apache.tiles.TilesContext) in org.apache.tiles.ComponentContext cannot be applied to (javax.servlet.ServletRequest)

/home/craigmcc/Apache/shale/current/framework/shale-tiles/src/main/java/org/apache/shale/tiles/TilesViewHandler.java:[312,25] setContext(org.apache.tiles.ComponentContext,org.apache.tiles.TilesContext) in org.apache.tiles.ComponentContext cannot be applied to (org.apache.tiles.ComponentContext,javax.servlet.ServletRequest)
==========

Greg, could you help us resolve this changes? To test it out, change your shale-tiles/pom.xml with the following diff:

Index: pom.xml
===================================================================
--- pom.xml (revision 429894)
+++ pom.xml (working copy)
@@ -40,7 +40,7 @@
         <dependency>
             <groupId>org.apache.struts.tiles</groupId>
             <artifactId>tiles-core</artifactId>
- <version>0.2-SNAPSHOT</version>
+ <version>2.0-SNAPSHOT</version>
         </dependency>
     </dependencies>

==========

(And, feel free to check this change in when the shale-tiles module compiles successfully).

[Greg Reddin]

SHALE-232 will resolve the Tiles part of this ticket.

[Greg Reddin]

The Tiles dependency has been upgraded to 2.0-SNAPSHOT.

[Craig McClanahan]

In the shale-master POM, the following Commons Library dependencies have been declared in the <dependencyManagerment> section:

    Beanutils 1.7.0
    Chain 1.1
    Digester 1.7
    Logging 1.1
    Validator 1.3.0

In addition, the dependency management settings for all of these libraries are also declared in the shale-apps-parent POM, in an attempt to get around issues with the way that Maven2 resolves conflicting version numbers for the same dependency. This attempt was partially successful ... however, due to issue MNG-1577 on the Maven2 JIRA, the application builds still pick up logging 1.0.4 and validator 1.1.

At the moment, the only way to guarantee that the applications themselves pick upt he correct versions is to explicitly declare these two dependencies in the applications themeslves ... so that remains to be done on all of our sample apps.

[Craig McClanahan]

In the POM for shale-spring, update Spring Framework dependencies from 1.2.5 to 1.2.8 (the current production version).

[Craig McClanahan]

All planned changes for 1.0.3 have been completed.

[Wendy Smoak]

There are no poms in ibiblio for Spring 1.2.8. Are we missing any of its transitive dependencies because of that?

[Craig McClanahan]

> There are no poms in ibiblio for Spring 1.2.8. Are we missing
> any of its transitive dependencies because of that?

AFAICT, we're not missing anything critical ... but we have only minimal coverage (in the tests for shale-usecases) for the Spring integration stuff. I would think any problems with missing dependencies would affect any Spring user who explicitly declares a dependency on 1.2.8, not just Shale users relying on it transitively.

Do you think we should switch back to a Spring version that does have POMs?

[Wendy Smoak]

Probably not. Eventually someone will provide poms for Spring 1.2.8.