javax.mail 1.4.3-SNAPSHOT

[aw]

I upgraded to 1.1-M7 and was surprised to see that javax.mail-1.4.3-
SNAPSHOT is now appearing as a dependency. Generally speaking, we
don't want SNAPSHOT dependencies because they aren't re-creatable, but
somehow, it sneaked into the Java.Net Maven 2 Repository:
http://download.java.net/maven/2/javax/mail/mail/

It is being pulled in because the lift pom here:
http://scala-tools.org/repo-releases/net/liftweb/lift/1.1-M7/lift-1.1-M7.pom
declares the dependency:

<dependency>
<groupId>javax.mail</groupId>
<artifactId>mail</artifactId>
<version>[1.4,1.5)</version>
</dependency>

Normally, the above should be fine. Alas, I think the underlying
problem is really Java.Net's Maven 2 Repository -- the SNAPSHOT build
should not have made it to the repository...

BTW... I noticed that the javax.activation dependency is explicitly
declared:

<dependency>
<groupId>javax.activation</groupId>
<artifactId>activation</artifactId>
<version>[1.1,1.2)</version>
</dependency>

but it should be a transitive dependency of javax,mail (so this could
be removed).

I'm not sure what I am going to do to resolve this -- probably add an
explicit dependency in my project to override it. Thought I'd
share...

[David Pollak]

Yikes.

Please file a ticket for this.  We'll fix it.  I think there's going to be a M7-SUPL release in the SNAPSHOT repo that addresses a bug that Jon reported.

Thanks,

David

--
Lift, the simply functional web framework http://liftweb.net
Beginning Scala http://www.apress.com/book/view/1430219890
Follow me: http://twitter.com/dpp
Surf the harmonics

[Indrajit Raychaudhuri]

On 06/11/09 2:24 AM, aw wrote:
>
> I upgraded to 1.1-M7 and was surprised to see that javax.mail-1.4.3-
> SNAPSHOT is now appearing as a dependency. Generally speaking, we
> don't want SNAPSHOT dependencies because they aren't re-creatable, but
> somehow, it sneaked into the Java.Net Maven 2 Repository:
> http://download.java.net/maven/2/javax/mail/mail/
>
> It is being pulled in because the lift pom here:
> http://scala-tools.org/repo-releases/net/liftweb/lift/1.1-M7/lift-1.1-M7.pom
> declares the dependency:
>
> <dependency>
> <groupId>javax.mail</groupId>
> <artifactId>mail</artifactId>
> <version>[1.4,1.5)</version>
> </dependency>
>
> Normally, the above should be fine. Alas, I think the underlying
> problem is really Java.Net's Maven 2 Repository -- the SNAPSHOT build
> should not have made it to the repository...

As you can see, the intention is to allow all 1.4.x series stable releases.

Lift POM doesn't have any reference to Java.Net Maven 2 Repository.
Therefore, within Lift, javax.mail.mail is always picked up from Maven
central repository (repo1.maven.org/maven2) which isn't polluted with
SNAPSHOT builds.

I guess, your project has reference to Java.Net repository which wins
over Maven central repository. This in turn results in 1.4.3-SNAPSHOT
being pulled. See if it helps to have the release and snapshot policies
set for the Java.Net repository node in your POM [0].

Let us know how it goes, and we'll take it from there.

[0]: http://maven.apache.org/pom.html#Repositories

>
> BTW... I noticed that the javax.activation dependency is explicitly
> declared:
>
> <dependency>
> <groupId>javax.activation</groupId>
> <artifactId>activation</artifactId>
> <version>[1.1,1.2)</version>
> </dependency>
>
> but it should be a transitive dependency of javax,mail (so this could
> be removed).

Indeed. This was an oversight, thanks for sharing. As David mentioned,
raise a ticket and I'll fix it.

[David Bernard]

About "removing" transitive dependency. The maven "rules" is if you
use a library A2 directly in your code list it explicitly/directly as
dependency including it it's already a transitive dependency of
library A1 (alreyd listed).
You have no assurance that other version of A1 use A2 (including in
the version you need).
mvn dependency:analyze should help you to identify "useless" or
"missing" dependency in your pom.xml
see http://www.sonatype.com/people/2009/10/maven-tips-and-tricks-optimizing-with-the-maven-dependency-plugin/

/davidB

[Indrajit Raychaudhuri]

In general, yes, I recognize the recommendation.

But javax.activation is almost certain to stay as a dependency for
javax.mail in near short to mid term (with javamail 1.4 series for sure).

In fact with javax.* libraries, the dependency chain hardly changes
ever. And thus I find the leeway acceptable.

Cheers, Indrajit

[O'Rorke Paul]

Hi, I am getting the following build error now and wonder if it has
something to do with this discussion or the Hudson discussion...
Do I need to change my pom or something? (I don't see any direct
reference to mail in there.)
For now, I may just install this and other similar dependencies
locally so that I can build when I do not have net access.
---Paul O

> Downloading: http://repo1.maven.org/maven2/javax/mail/mail/1.4.3-rc1/mail-1.4.3-rc1.jar
> [INFO]
> ------------------------------------------------------------------------
> [ERROR] BUILD ERROR
> [INFO]
> ------------------------------------------------------------------------
> [INFO] Failed to resolve artifact.
>
> Missing:
> ----------
> 1) javax.mail:mail:jar:1.4.3-rc1

[O'Rorke Paul]

Just to clarify: I did have net access when I did the build below.
Also, FWIW, the version of javamail below seems to be very recent and
it seems to be in java.net's maven repository but not in the more
standard maven repository.
---Paul O

[aw]

Looking at this: http://download.java.net/maven/2/javax/mail/mail/
it would seem that Sun is close to releasing JavaMail 1.4.3.

Technically, I don't think there is anything wrong with Lift's
dependency declaration for javax.mail. Truly, the root issue is that
Sun should not have published a "SNAPSHOT" to their public Maven 2
repository.

I did log an issue, however, for the mentioning of javax.activation:
http://github.com/dpp/liftweb/issues/#issue/168

[Indrajit Raychaudhuri]

Fixed, and in master.

http://github.com/dpp/liftweb/commit/0cac04cb0d05c07a222d07f980ecf9946ec49588

Cheers, Indrajit