As we are upgrading jackson modules to version 2.10.2, we are using jackson_core, jackson_databind and jackson_annotations (all versions 2.10.2),Each of these jars have a module_info.class that seems to be different in each jar. Hence we cannot use these 3 jars in our systems.
Should we be using the same 2.10.2 version for jackson_core and jackson_annotations too ? Along with the jackson_databind 2.10.2 ?Or is there another resolution to dealing with the module_info.class in each of these jars ?Appreciate your help.
Basically Dependencies rejected for these 3 jars with the module_info.class (as it is different in all 3 jars).Is there a version 2.10.2 available with support for multi-release-jars ?
On Tuesday, January 28, 2020 at 11:03:53 AM UTC-8, Ron Karim (Oracle Corp.) wrote:As we are upgrading jackson modules to version 2.10.2, we are using jackson_core, jackson_databind and jackson_annotations (all versions 2.10.2),Each of these jars have a module_info.class that seems to be different in each jar. Hence we cannot use these 3 jars in our systems.Should we be using the same 2.10.2 version for jackson_core and ja kson_annotations too ? Along with the jackson_databind 2.10.2 ?Or is there another resolution to dealiing with the module_info.class in each of these jars ?Appreciate your help.
--
You received this message because you are subscribed to the Google Groups "jackson-user" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jackson-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/c73577d8-f4e0-4983-9314-81631827eeb9%40googlegroups.com.
On Tue, Jan 28, 2020 at 11:36 AM Ron Karim (Oracle Corp.) <ron....@gmail.com> wrote:
Basically Dependencies rejected for these 3 jars with the module_info.class (as it is different in all 3 jars).Is there a version 2.10.2 available with support for multi-release-jars ?No. Module-info classes should only be used by JDK 9 and above; Java 8 and below should just ignore these classes.What specifically is your issue? On which platform / tools?-+ Tatu +-
--
On Tuesday, January 28, 2020 at 11:03:53 AM UTC-8, Ron Karim (Oracle Corp.) wrote:As we are upgrading jackson modules to version 2.10.2, we are using jackson_core, jackson_databind and jackson_annotations (all versions 2.10.2),Each of these jars have a module_info.class that seems to be different in each jar. Hence we cannot use these 3 jars in our systems.Should we be using the same 2.10.2 version for jackson_core and ja kson_annotations too ? Along with the jackson_databind 2.10.2 ?Or is there another resolution to dealiing with the module_info.class in each of these jars ?Appreciate your help.
You received this message because you are subscribed to the Google Groups "jackson-user" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jackso...@googlegroups.com.
In our corporate builds in Oracle that use jackson, we need to support JDK 7 and JDK 8 as the current user-base/customers are still on JDK 7 and JDK 8 based systems.Is there a way of ignoring the JDK 9 module_info.class from these jars ? We are not allowed to modify the jars, but the 3 jars need to be in the same repository as a single jackson patch.
--
On Tuesday, January 28, 2020 at 2:14:07 PM UTC-8, Tatu Saloranta wrote:On Tue, Jan 28, 2020 at 11:36 AM Ron Karim (Oracle Corp.) <ron....@gmail.com> wrote:Basically Dependencies rejected for these 3 jars with the module_info.class (as it is different in all 3 jars).Is there a version 2.10.2 available with support for multi-release-jars ?No. Module-info classes should only be used by JDK 9 and above; Java 8 and below should just ignore these classes.What specifically is your issue? On which platform / tools?-+ Tatu +---
On Tuesday, January 28, 2020 at 11:03:53 AM UTC-8, Ron Karim (Oracle Corp.) wrote:As we are upgrading jackson modules to version 2.10.2, we are using jackson_core, jackson_databind and jackson_annotations (all versions 2.10.2),Each of these jars have a module_info.class that seems to be different in each jar. Hence we cannot use these 3 jars in our systems.Should we be using the same 2.10.2 version for jackson_core and ja kson_annotations too ? Along with the jackson_databind 2.10.2 ?Or is there another resolution to dealiing with the module_info.class in each of these jars ?Appreciate your help.
You received this message because you are subscribed to the Google Groups "jackson-user" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jackso...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/c73577d8-f4e0-4983-9314-81631827eeb9%40googlegroups.com.
You received this message because you are subscribed to the Google Groups "jackson-user" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jackson-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/01eacd95-7ca3-4125-8205-0f9bbe4d16e8%40googlegroups.com.
To unsubscribe from this group and stop receiving emails from it, send an email to jackson-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/01eacd95-7ca3-4125-8205-0f9bbe4d16e8%40googlegroups.com.
As per this JDK 8 bug (unresolved), jars with the module_info.class (JDK9 ) will not build with JDK 8:
--
On Tuesday, January 28, 2020 at 2:24:17 PM UTC-8, Ron Karim (Oracle Corp.) wrote:In our corporate builds in Oracle that use jackson, we need to support JDK 7 and JDK 8 as the current user-base/customers are still on JDK 7 and JDK 8 based systems.Is there a way of ignoring the JDK 9 module_info.class from these jars ? We are not allowed to modify the jars, but the 3 jars need to be in the same repository as a single jackson patch.
On Tuesday, January 28, 2020 at 2:14:07 PM UTC-8, Tatu Saloranta wrote:On Tue, Jan 28, 2020 at 11:36 AM Ron Karim (Oracle Corp.) <ron....@gmail.com> wrote:Basically Dependencies rejected for these 3 jars with the module_info.class (as it is different in all 3 jars).Is there a version 2.10.2 available with support for multi-release-jars ?No. Module-info classes should only be used by JDK 9 and above; Java 8 and below should just ignore these classes.What specifically is your issue? On which platform / tools?-+ Tatu +---
On Tuesday, January 28, 2020 at 11:03:53 AM UTC-8, Ron Karim (Oracle Corp.) wrote:As we are upgrading jackson modules to version 2.10.2, we are using jackson_core, jackson_databind and jackson_annotations (all versions 2.10.2),Each of these jars have a module_info.class that seems to be different in each jar. Hence we cannot use these 3 jars in our systems.Should we be using the same 2.10.2 version for jackson_core and ja kson_annotations too ? Along with the jackson_databind 2.10.2 ?Or is there another resolution to dealiing with the module_info.class in each of these jars ?Appreciate your help.
You received this message because you are subscribed to the Google Groups "jackson-user" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jackso...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/c73577d8-f4e0-4983-9314-81631827eeb9%40googlegroups.com.
You received this message because you are subscribed to the Google Groups "jackson-user" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jackson-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/9395c3da-3bd8-429c-9207-8494957ead32%40googlegroups.com.
Thanks for the quick response, the module_info.class is stored in a common location when we create a patch for cutomers with all 3 jars in the same "jackson-updated-security patch", here is an example error from our system:ERROR: Different size module-info.class duplicated in archives: fnd/java/3rdparty/stdalone/jackson_annotations.zip (120.0.12020000.7), fnd/java/3rdparty/stdalone/jackson_databind.zip (120.0.12020000.7), fnd/java/3rdparty/stdalone/jackson_core.zip (120.0.12020000.7) java/3rdparty/stdalone/jackson_core.zipOne option that we re thinking is maybe create 3 separate patches, but that will cause an error when the patches are applied in the same customer location.
On Tuesday, January 28, 2020 at 11:03:53 AM UTC-8, Ron Karim (Oracle Corp.) wrote:As we are upgrading jackson modules to version 2.10.2, we are using jackson_core, jackson_databind and jackson_annotations (all versions 2.10.2),Each of these jars have a module_info.class that seems to be different in each jar. Hence we cannot use these 3 jars in our systems.Should we be using the same 2.10.2 version for jackson_core and ja kson_annotations too ? Along with the jackson_databind 2.10.2 ?Or is there another resolution to dealiing with the module_info.class in each of these jars ?Appreciate your help.
--
You received this message because you are subscribed to the Google Groups "jackson-user" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jackson-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/80a3fbd0-41aa-470d-922b-e8d019c0efff%40googlegroups.com.
To unsubscribe from this group and stop receiving emails from it, send an email to jackso...@googlegroups.com.
Thanks for the quick response. For a large enterprise organization like ours, modifying central builds and making changes to them require all sorts of complexities, which we may have to bite the bullet and do. But the fact that we are getting security issues every few months is getting a lot of attention from our release areas as well.Since we need this particular set of jars (jackson_databin, jackson_core, jackson_annotations) for a JDK 7 Runtime environment (all components in this massive behemoth are still using JDK 7 and will be for quite sometime), couple of questions as we prepare a case for uptake of jackson 2.10.2 :- What version of the JDK are used to build these jars, (if a JDK 9 compiler is used, then we won't be able to use them in a JDK 7 runtime environment, correct ?)
- If these libraries were tested for a Java 7 runtime, how did you build those particular libraries that were tested for the JDK 7 runtime ?
Thanks for all the advice and guidance.
--
On Tuesday, January 28, 2020 at 8:18:01 PM UTC-8, Tatu Saloranta wrote:On Tue, Jan 28, 2020 at 2:39 PM Ron Karim (Oracle Corp.) <ron....@gmail.com> wrote:Thanks for the quick response, the module_info.class is stored in a common location when we create a patch for cutomers with all 3 jars in the same "jackson-updated-security patch", here is an example error from our system:ERROR: Different size module-info.class duplicated in archives: fnd/java/3rdparty/stdalone/jackson_annotations.zip (120.0.12020000.7), fnd/java/3rdparty/stdalone/jackson_databind.zip (120.0.12020000.7), fnd/java/3rdparty/stdalone/jackson_core.zip (120.0.12020000.7) java/3rdparty/stdalone/jackson_core.zipOne option that we re thinking is maybe create 3 separate patches, but that will cause an error when the patches are applied in the same customer location.That sounds like something where filtering out of these class descriptors would probably make sense. There are other artifacts that I have heard can cause issues with packaging -- META-INF/LICENSE, for example, is exists in all jars.I am guessing that tools in question predate Java 9, but there hopefully is some setting to specify file(s) to ignore?Otherwise, pre-processing jars to drop module-info.class would serve the same purpose.This class obviously has no value on Java 7/8 platform.-+ Tatu +---
On Tuesday, January 28, 2020 at 11:03:53 AM UTC-8, Ron Karim (Oracle Corp.) wrote:As we are upgrading jackson modules to version 2.10.2, we are using jackson_core, jackson_databind and jackson_annotations (all versions 2.10.2),Each of these jars have a module_info.class that seems to be different in each jar. Hence we cannot use these 3 jars in our systems.Should we be using the same 2.10.2 version for jackson_core and ja kson_annotations too ? Along with the jackson_databind 2.10.2 ?Or is there another resolution to dealiing with the module_info.class in each of these jars ?Appreciate your help.
You received this message because you are subscribed to the Google Groups "jackson-user" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jackso...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/80a3fbd0-41aa-470d-922b-e8d019c0efff%40googlegroups.com.
You received this message because you are subscribed to the Google Groups "jackson-user" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jackson-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/90f98719-2e41-4efd-bdd3-ed7d727620cc%40googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/CAGrxA27pzuJKfJz6zvxLP3G8RyuxavkyT7h4L1YvS%2B0HHdhhKQ%40mail.gmail.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/90f98719-2e41-4efd-bdd3-ed7d727620cc%40googlegroups.com.