[OAK-7182] Make it possible to update Guava

• Type: Task
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.58.0
• Labels: technical-debt
• Assignee: Julian Reschke
• Reporter: Julian Reschke
• Created: 22/Jan/18 10:30
• Updated: 16/Jan/24 11:58
• Resolved: 07/Sep/23 09:16

Description

We currently rely on Guava 15, and this affects all users of Oak because they essentially need to use the same version.

This is an overall issue to investigate what would need to be done in Oak in order to make updates possible.

Issue Links

• blocks: OAK-9491 Address vulnerabilities found by dependency checker plugin
• is blocked by: OAK-10371 oak-segment-azure/oak-blob-cloud-azure require provided Guava, embed it instead
• is blocked by: OAK-10369 oak-segment-azure/oak-blob-cloud-azure leak Guava dependency
• is related to: OAK-10001 Bump up minimal Java version to 11
• is related to: OAK-8874 deprecate use of Guava Predicate class in oak-core API
• is related to: SLING-10972 Testing Sling Mock Oak: Shade (embed and relocate) Guava
• is related to: SOLR-11763 Upgrade Guava to 25.1-jre
• is related to: OAK-8612 Make the Azure Data Store compatible with Guava 15 and 26
• relates to: SOLR-10308 Solr fails to work with Guava 21.0
• relates to: OAK-9261 Upgrade Apache Solr to 8.6.3 and remove Embedded Solr Server
• relates to: OAK-10367 update org.apache.sling.testing.osgi-mock dependency
• relates to: JCR-4250 remove guava dependency
• relates to: OAK-10047 oak-core: bump up logging for deprecated Guava based APIs to WARN
• relates to: OAK-10105 Guava deprecations: set minimal logging level to 'info'
• links to: CVE-2018-10237
• links to: CVE-2020-8908
• links to: CVE-2023-2976
• links to: Neil Bartlett - Static Linking in OSGi (wayback machine)

Sub-Tasks

• LengthCachingDataStoreTest: Remove unused import of Guava InputSupplier: Closed
• Upgrade jclouds dependency to 2.0.3: Closed
• avoid use of guava Iterators.emptyIterator(): Closed
• guava: ListenableFuture.transform() changes to transformAsync in version 20: Closed
• make Guava version configurable at build time: Closed
• check public Oak APIs for references to Guava: Closed
• Replace AtomicCounter Supplier: Closed
• add build profile "guava-latest" to build with latest supported Guava version: Closed
• relax guava version range in Import-Package declarations: Closed
• SegmentCompactionIT's use of com.google.common.util.concurrent.Futures.dereference: Closed
• oak-blob-*'s use of Guava File.fileTreeTraverser: Closed
• solr support of embedded server conflicts with Guava upgrade: Resolved
• add maven profile to build with Guava beta checks: Closed
• commons: avoid use of Guava beta APIs in StringSort: Closed
• commons: avoid use of Guava beta APIs in FileIOUtils: Closed
• guava-latest profile defunct: Closed
• DeclaredMembershipPredicate does not compile with Guava 20: Closed
• deprecate public LazyInputStream(ByteSource byteSource): Closed
• deprecate FileIOUtils.BurnOnCloseFileIterator: Closed
• deprecate FileIOUtils.FileLineDifferenceIterator: Closed
• deprecate FileIOUtils.writeStrings with Guava Function parameter: Closed
• oak-commons: deprecate uses of Guava in exported API: Resolved
• SimpleCredentialsSupport uses Guava API in exported API: Closed
• oak-core-spi: remove uses of Guava from exported API: Closed
• deprecate Guava based APIs in WhiteboardUtils: Closed
• deprecate Guava based APIs in ManagementOperation: Closed
• deprecate Guava based APIs in o.a.j.o.cache: Closed
• Mark exported APIs that we don't want to expose with an @Internal annotation: Closed
• Remove deprecated Guava-based APIs: Closed
• oak-core-spi: bump up logging for deprecated Guava based APIs to INFO: Closed
• oak-core-spi: CacheLIRS deprecation: add 'org.apache.jackrabbit.oak.plugins.segment' to allowed caller list: Closed
• oak-commons: bump up logging for deprecated Guava based APIs to INFO: Closed
• wrap shaded Guava for internal use: Closed
• oak-core-spi: bump up logging for deprecated Guava based APIs to WARN: Closed
• oak-commons: bump up logging for deprecated Guava based APIs to WARN: Closed
• Remove (Guava) com.google.common.base.Objects.ToStringHelper: Closed
• introduce oak-shaded-guava project: Closed
• avoid leaking out transitive dependencies to Guava: Closed
• oak-blob-cloud-azure: unneeded Guava import declaration: Closed
• oak-search-mt: unneeded Guava import declaration: Closed
• remove use of com.google.common.collect.Iterators.emptyIterator: Closed
• update Guava related deprecations with 'since' and 'forRemoval' properties: Closed
• oak-commons: bump up logging for deprecated Guava based APIs to ERROR: Closed
• oak-core-spi: bump up logging for deprecated Guava based APIs to ERROR: Closed
• deprecate FileIOUtils.TransformingComparator with Guava Function parameter: Closed
• oak-commons: prepare for switch to shaded guava: Closed
• Reduce currently supported Guava range to 15 - 19: Closed
• oak-shaded-guava: switch to latest Guava version: Closed
• adjust OSGi ITs and size limits for shaded guava inclusion: Closed
• switch oak-commons to shaded guava: Closed
• switch oak-core-spi to shaded guava: Closed
• oak-blob-cloud-azure - relax Guava import range: Closed
• switch oak-store-spi to shaded guava: Closed
• switch oak-query-spi to shaded guava: Closed
• switch oak-security-spi to shaded guava: Closed
• switch oak-store-composite to shaded guava: Closed
• switch oak-store-document to shaded guava: Closed
• switch oak-blob-plugins to shaded guava: Closed
• switch oak-core to shaded guava: Closed
• switch oak-blob to shaded guava: Closed
• switch oak-http to shaded guava: Closed
• switch oak-run-commons to shaded guava: Closed
• switch oak-run to shaded guava: Closed
• switch oak-jcr to shaded guava: Closed
• oak-it-osgi: avoid Guava dependency: Closed
• switch oak-pojosr to shaded guava: Closed
• switch oak-auth-external to shaded guava: Closed
• switch oak-auth-ldap to shaded guava: Closed
• switch oak-authorization-cug to shaded guava: Closed
• switch oak-authorization-principalbased to shaded guava: Closed
• switch oak-exercise to shaded guava: Closed
• Update oak-segment-tar with shaded guava: Closed
• Update oak-segment-remote modules with shaded guava: Closed
• Update oak-blob* modules with shaded guava: Closed
• switch oak-search to shaded guava: Closed
• Update oak-lucene with shaded guava: Closed
• switch oak-solr to shaded guava: Closed
• switch oak-search-elastic to shaded guava: Closed
• oak-solr-osgi: remove Guava import decl: Closed
• oak-commons: remove Guava from public API: Closed
• oak-core-spi: remove Guava from public API: Closed
• switch oak-upgrade to shaded guava: Closed
• switch oak-run-elastic to shaded guava: Closed
• switch oak-it to shaded guava: Closed
• switch oak-examples to shaded guava: Closed
• switch oak-benchmarks to shaded guava: Closed
• switch oak-benchmarks-lucene to shaded guava: Closed
• switch oak-benchmarks-elastic to shaded guava: Closed
• switch oak-benchmarks-solr to shaded guava: Closed
• oak-shaded-guava leaks original guava as transitive dependency: Closed
• Remove residual use of original Guava in oak-store-document: Closed
• oak-core: remove Guava from public API: Closed
• remove all remaining references of native Guava: Closed
• oak-it-osgi: temporarily introduce Guava dependency again: Closed
• convert groovy sources to shaded guava: Closed