Maven conflict between gwt-dev's and jetty-annotations's asm-commons

[Colin Alworth]

It looks like a recent change is causing what is technically a version conflict in GWT when used from maven. A project I work on uses the maven-enforcer-plugin to avoid conflicts, and in a rebuild this morning we ran into this error.

[INFO] --- maven-enforcer-plugin:1.4.1:enforce (enforce) @ gwt-project ---
[WARNING]
Dependency convergence error for org.ow2.asm:asm-commons:5.0.3 paths to dependency are:
+-colins.super.duper:gwt-project:0.0.1-SNAPSHOT
  +-com.google.gwt:gwt-dev:2.8.0-SNAPSHOT
    +-org.ow2.asm:asm-commons:5.0.3
and
+-colins.super.duper:gwt-project:0.0.1-SNAPSHOT
  +-com.google.gwt:gwt-dev:2.8.0-SNAPSHOT
    +-org.eclipse.jetty:jetty-annotations:9.2.14.v20151106
      +-org.ow2.asm:asm-commons:5.0.1

This appears to have been introduced in https://gwt-review.googlesource.com/#/c/14461/, though it could have been earlier. I'm not familiar with how exactly we settled on 5.0.1, and if we must use that (and override jetty...), or if we can upgrade to 5.0.3 and not risk affecting jetty.

Locally, I'm overriding this by excluding asm-commons from my gwt-dev dependencies, and requiring 5.0.3, which seems to be working (minus a jsinterop issue, which I am now hunting...). Thoughts on which version we should require? I can make the patch once I have feedback.

[Thomas Broyer]

Why use 5.0.1 when there's 5.0.3 and ASM guarantees backwards compatibility?
FWIW, Maven should use 5.0.3 by default.

[Colin Alworth]

Should, and does if you have no enforcer. We needed the enforcer due to arguing between far downstream dependencies from assorted other projects that kept resulting in fun conflicts (in cases where there was no guaranteed backward compat).

I'll make up a patch, thanks, I didn't know how hard and fast we could rely on ASM's backward compat being. Probably should also put this in tools so that we are consistent, and update the ant files so that we don't get slightly different classes in maven vs zip archive...

On Thu, Apr 28, 2016 at 3:59 PM Thomas Broyer <t.br...@gmail.com> wrote:

Why use 5.0.1 when there's 5.0.3 and ASM guarantees backwards compatibility?
FWIW, Maven should use 5.0.3 by default.

--
You received this message because you are subscribed to the Google Groups "GWT Contributors" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit-co...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-web-toolkit-contributors/900dbd13-941a-44f2-8497-e1d96fd74a65%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Filipe Sousa]

I'm using the enforcer plugins with no complains.

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-enforcer-plugin</artifactId>
    <version>1.4.1</version>
    <executions>
        <execution>
            <id>enforcer</id>
            <goals>
                <goal>enforce</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <rules>
            <requireMavenVersion>
                <version>3.3.1</version>
            </requireMavenVersion>
            <requireJavaVersion>
                <version>1.8</version>
            </requireJavaVersion>
            <dependencyConvergence/>
        </rules>
    </configuration>
</plugin>

[INFO] ------------------------------------------------------------------------

[INFO] Building gwt-java8 0.1.0-SNAPSHOT

[INFO] ------------------------------------------------------------------------

[INFO] 

[INFO] --- maven-enforcer-plugin:1.4.1:enforce (default-cli) @ gwt-java8 ---

[INFO] ------------------------------------------------------------------------

[INFO] BUILD SUCCESS

[INFO] ------------------------------------------------------------------------

[INFO] --- maven-enforcer-plugin:1.4.1:display-info (default-cli) @ gwt-java8 ---

[INFO] Maven Version: 3.3.9

[INFO] JDK Version: 1.8.0_92 normalized as: 1.8.0-92

[INFO] OS Info: Arch: x86_64 Family: mac Name: mac os x Version: 10.11.5

On Thursday, April 28, 2016 at 10:47:48 PM UTC+1, Colin Alworth wrote:

Should, and does if you have no enforcer. We needed the enforcer due to arguing between far downstream dependencies from assorted other projects that kept resulting in fun conflicts (in cases where there was no guaranteed backward compat).

I'll make up a patch, thanks, I didn't know how hard and fast we could rely on ASM's backward compat being. Probably should also put this in tools so that we are consistent, and update the ant files so that we don't get slightly different classes in maven vs zip archive...

On Thu, Apr 28, 2016 at 3:59 PM Thomas Broyer <t.br...@gmail.com> wrote:

Why use 5.0.1 when there's 5.0.3 and ASM guarantees backwards compatibility?
FWIW, Maven should use 5.0.3 by default.

--
You received this message because you are subscribed to the Google Groups "GWT Contributors" group.

To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit-contributors+unsubscribe@googlegroups.com.

[Thomas Broyer]

On Thursday, April 28, 2016 at 11:47:48 PM UTC+2, Colin Alworth wrote:

I didn't know how hard and fast we could rely on ASM's backward compat being.

This is true since ASM 4.0 (released in 2011): http://download.forge.objectweb.org/asm/asm4-guide.pdf

Fortunately, they changed the groupId for ASM 4.0, so you can safely "converge" to the latest version for org.ow2.asm dependencies, and you should ban asm:asm dependencies (ASM 3 and earlier, having no backwards compatibility contract, should have been repackaged –as was done in earlier versions of GWT– rather than simply referenced –as many unfortunately did in earlier versions, such as Hibernate, Jetty, etc.–)

 

Probably should also put this in tools so that we are consistent, and update the ant files so that we don't get slightly different classes in maven vs zip archive...

We have 5.0.3 in tools, and Maven will "converge" to 5.0.3, so we're consistent. Or am I missing something? (or didn't understand what you're saying)

[Colin Alworth]

Got it - so GWT is consistent, but the jetty vers we use talks about a different one, and our ant process should ignore what jetty asks for in favor of our copy.

Filipe, here's the case, in a super-minimal pom, which will fail outright without any sources, just a dependency on gwt-dev and the enforcer to prevent any conflicts in dependencies:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>


  <groupId>sample</groupId>
  <artifactId>sample</artifactId>
  <version>0.0.1-SNAPSHOT</version>
  <dependencies>
    <dependency>
      <groupId>com.google.gwt</groupId>
      <artifactId>gwt-dev</artifactId>
      <version>2.8.0-SNAPSHOT</version>
    </dependency>
  </dependencies>


  <repositories>
    <repository>
      <id>google-snapshots</id>
      <url>https://oss.sonatype.org/content/repositories/google-snapshots/</url>
      <snapshots>
        <enabled>true</enabled>
      </snapshots>
    </repository>
  </repositories>


  <build>
    <plugins>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <version>1.4.1</version>
        <executions>
          <execution>

            <id>enforce</id>
            <configuration>
              <rules>
                <dependencyConvergence/>
              </rules>
            </configuration>

            <goals>
              <goal>enforce</goal>
            </goals>
          </execution>
        </executions>

      </plugin>
    </plugins>
  </build>
</project>

Build log including grabbing latest gwt:

https://gist.github.com/niloc132/5cf8162ccc3503215f12d151f4c03168

Patch is done, will have it up soon after a bit more poking.

[Filipe Sousa]

I figured out why it's working in my case. I'm using the gwt bom.

<dependencyManagement>

    <dependencies>
        <dependency>
            <groupId>com.google.gwt</groupId>

            <artifactId>gwt</artifactId>
            <version>2.8.0-SNAPSHOT</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>