[SHIRO-761] Bad OSGi import for javax.annotation in shiro-guice

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Resolved
• Affects Version/s: 1.5.2
• Fix Version/s: 2.0.0-alpha
• Component/s: Integration: Guice
• Flags: Patch
• Assignee: Francois Papon
• Reporter: Stuart McCulloch
• Created: 27/Apr/20 22:25
• Updated: 04/Jul/20 13:42
• Resolved: 04/Jul/20 13:42

Description

shiro-guice 1.5.2 declares the following OSGi import for javax.annotation:

javax.annotation;version="[3.0,4)"

This is incorrect, the latest spec version for javax.annotation is 1.3

This appears to be caused by the javax.annotation dependency appearing below the guice dependency in support/guice/pom.xml. The guice dependency pulls in com.google.code.findbugs:jsr305:jar:3.0.2 and the maven-bundle-plugin takes that as the version to use for the javax.annotation import, rather than the javax.annotation-api dependency (version 1.3.2)

The following minor patch fixes the import range by changing the order of the dependencies:

diff --git a/support/guice/pom.xml b/support/guice/pom.xml
index 9d9e8b3..8217cfa 100644
--- a/support/guice/pom.xml
+++ b/support/guice/pom.xml
@@ -46,6 +46,10 @@
             <optional>true</optional>
         </dependency>
         <dependency>
+            <groupId>javax.annotation</groupId>
+            <artifactId>javax.annotation-api</artifactId>
+        </dependency>
+        <dependency>
             <groupId>com.google.inject</groupId>
             <artifactId>guice</artifactId>
         </dependency>
@@ -54,10 +58,6 @@
             <artifactId>guice-multibindings</artifactId>
         </dependency>
         <dependency>
-            <groupId>javax.annotation</groupId>
-            <artifactId>javax.annotation-api</artifactId>
-        </dependency>
-        <dependency>
             <groupId>com.google.inject.extensions</groupId>
             <artifactId>guice-servlet</artifactId>
             <optional>true</optional>

If you build the shiro-guice module before and after this fix then you should see the difference in support/guice/target/classes/META-INF/MANIFEST.MF

Issue Links

• links to: GitHub Pull Request #243