Skip to content

Commit e87a047

Browse files
tdipisatdipisa
authored
Aligning Jackson version to 2.22.3 and other dependency fixes (#13046)
1 parent 3161a5b commit e87a047

11 files changed

Lines changed: 463 additions & 244 deletions

File tree

‎.github/workflows/CI.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,9 @@ jobs:
121121
##############
122122
- name: java
123123
run: mvn --batch-mode --update-snapshots verify -Pprintingbundle
124+
# The printing bundle is unpacked over the WAR, so the two are checked together.
125+
- name: "checking duplicated libraries"
126+
run: python3 utility/build/check_duplicate_jars.py product/target/mapstore.war java/printing/target/mapstore-printing.zip
124127
build:
125128
runs-on: ubuntu-latest
126129
strategy:

‎binary/bin-war/pom.xml‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -36,17 +36,6 @@
3636
<artifactId>maven-war-plugin</artifactId>
3737
<version>${maven-war-plugin.version}</version>
3838
<configuration>
39-
<packagingExcludes>
40-
WEB-INF/lib/*spring*5.3.18*.jar,
41-
WEB-INF/lib/json-lib-2.4-jdk15.jar,
42-
WEB-INF/lib/msg-simple-1.1.jar,
43-
WEB-INF/lib/btf-1.2.jar,
44-
WEB-INF/lib/commons-io-2.1.jar,
45-
WEB-INF/lib/commons-beanutils-1.8.0.jar,
46-
WEB-INF/lib/commons-logging-1.1.1.jar,
47-
WEB-INF/lib/jackson-coreutils-1.6.jar,
48-
WEB-INF/lib/stax-ex-1.8.jar
49-
</packagingExcludes>
5039
<overlays>
5140
<overlay>
5241
<groupId>it.geosolutions.mapstore</groupId>

‎docs/developer-guide/mapstore-migration-guide.md‎

Lines changed: 173 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ The following changes must be applied to your project (see the updated [project
124124
- <tomcat.version>9.0.116</tomcat.version>
125125
- <jackson.version>2.16.1</jackson.version>
126126
+ <tomcat.version>10.1.55</tomcat.version>
127-
+ <jackson.version>2.19.4</jackson.version>
127+
+ <jackson.version>2.22.3</jackson.version>
128128
<!-- Spring Framework & Security (aligned) -->
129129
- <spring.version>5.3.39</spring.version>
130130
- <spring.security.version>5.7.13</spring.security.version>
@@ -236,6 +236,178 @@ Copy the `logging.properties` file from the MapStore repository (`product/cargo/
236236

237237
**CI/CD**: update your build infrastructure to use JDK 17 as the build JDK.
238238

239+
### Duplicated libraries in the WAR
240+
241+
The GeoStore and http-proxy WARs are added to your project as *overlays*: their `WEB-INF/lib` folder is copied as it is into your WAR. Some of those libraries (Jackson, Log4j, SLF4J, Micrometer, commons-io, ...) are also brought by MapStore, often in a different version, so the final WAR contains two versions of the same library, and which one is loaded depends on the servlet container.
242+
243+
The steps below remove the duplicates. They change only two files of your project: `pom.xml` and `web/pom.xml`. The [project templates](https://github.com/geosolutions-it/MapStore2/tree/master/project/standard/templates) contain the final result, if you want to compare.
244+
245+
#### 1. `pom.xml` (in the root folder of your project)
246+
247+
**1.1** In the `<properties>` section, add these two lines right after the `jackson.version` line (updated to `2.22.3` in the previous section):
248+
249+
```diff
250+
<jackson.version>2.22.3</jackson.version>
251+
+ <guava.version>32.0.0-jre</guava.version>
252+
+ <jsr305.version>3.0.2</jsr305.version>
253+
```
254+
255+
**1.2** In the `<dependencyManagement>` section, find the `jackson-bom` dependency and add the two dependencies below right after it (after its closing `</dependency>` tag):
256+
257+
```diff
258+
<dependency>
259+
<groupId>com.fasterxml.jackson</groupId>
260+
<artifactId>jackson-bom</artifactId>
261+
<version>${jackson.version}</version>
262+
<type>pom</type>
263+
<scope>import</scope>
264+
</dependency>
265+
+ <dependency>
266+
+ <groupId>com.google.guava</groupId>
267+
+ <artifactId>guava</artifactId>
268+
+ <version>${guava.version}</version>
269+
+ </dependency>
270+
+ <dependency>
271+
+ <groupId>com.google.code.findbugs</groupId>
272+
+ <artifactId>jsr305</artifactId>
273+
+ <version>${jsr305.version}</version>
274+
+ </dependency>
275+
```
276+
277+
#### 2. `web/pom.xml`
278+
279+
**2.1** The servlet API is provided by Tomcat and must not be packaged in the WAR. In the main `<dependencies>` section (at the top of the file), find the `jakarta.servlet-api` dependency and add the `<scope>` line:
280+
281+
```diff
282+
<dependency>
283+
<groupId>jakarta.servlet</groupId>
284+
<artifactId>jakarta.servlet-api</artifactId>
285+
<version>${jakarta.servlet-api.version}</version>
286+
+ <scope>provided</scope>
287+
</dependency>
288+
```
289+
290+
**2.2** Find the `maven-war-plugin` plugin. Inside its `<configuration>`, delete the whole `<packagingExcludes>` block: it lists versions that are not used anymore.
291+
292+
```diff
293+
<configuration>
294+
- <packagingExcludes>
295+
- WEB-INF/lib/*spring*5.3.18*.jar,
296+
- WEB-INF/lib/json-lib-2.4-jdk15.jar,
297+
- WEB-INF/lib/msg-simple-1.1.jar,
298+
- WEB-INF/lib/btf-1.2.jar,
299+
- WEB-INF/lib/commons-io-2.1.jar,
300+
- WEB-INF/lib/commons-beanutils-1.8.0.jar,
301+
- WEB-INF/lib/commons-logging-1.1.1.jar,
302+
- WEB-INF/lib/jackson-coreutils-1.6.jar,
303+
- WEB-INF/lib/stax-ex-1.8.jar
304+
- </packagingExcludes>
305+
<overlays>
306+
```
307+
308+
**2.3** In the same `<configuration>`, inside `<overlays>`, add an `<excludes>` block to each of the two overlays, right after their `<artifactId>` line. If an overlay already has an `<excludes>` block, keep the `<exclude>` lines it has and add the new ones to it.
309+
310+
```diff
311+
<overlays>
312+
<overlay>
313+
<groupId>it.geosolutions.geostore</groupId>
314+
<artifactId>geostore-webapp</artifactId>
315+
+ <excludes>
316+
+ <exclude>WEB-INF/lib/commons-io-*.jar</exclude>
317+
+ <exclude>WEB-INF/lib/jackson-annotations-*.jar</exclude>
318+
+ <exclude>WEB-INF/lib/jackson-core-*.jar</exclude>
319+
+ <exclude>WEB-INF/lib/jackson-databind-*.jar</exclude>
320+
+ <exclude>WEB-INF/lib/log4j-api-*.jar</exclude>
321+
+ <exclude>WEB-INF/lib/log4j-core-*.jar</exclude>
322+
+ <exclude>WEB-INF/lib/log4j-slf4j-impl-*.jar</exclude>
323+
+ <exclude>WEB-INF/lib/slf4j-api-*.jar</exclude>
324+
+ <exclude>WEB-INF/lib/micrometer-commons-*.jar</exclude>
325+
+ <exclude>WEB-INF/lib/micrometer-observation-*.jar</exclude>
326+
+ <exclude>WEB-INF/lib/asm-2.*.jar</exclude>
327+
+ </excludes>
328+
</overlay>
329+
<overlay>
330+
<groupId>proxy</groupId>
331+
<artifactId>http_proxy</artifactId>
332+
+ <excludes>
333+
+ <exclude>WEB-INF/lib/commons-io-*.jar</exclude>
334+
+ <exclude>WEB-INF/lib/log4j-api-*.jar</exclude>
335+
+ <exclude>WEB-INF/lib/log4j-core-*.jar</exclude>
336+
+ <exclude>WEB-INF/lib/log4j-slf4j2-impl-*.jar</exclude>
337+
+ <exclude>WEB-INF/lib/slf4j-api-*.jar</exclude>
338+
+ <exclude>WEB-INF/lib/commons-codec-*.jar</exclude>
339+
+ <exclude>WEB-INF/lib/jetty-*.jar</exclude>
340+
+ </excludes>
341+
</overlay>
342+
</overlays>
343+
```
344+
345+
**2.4** Find the `<profile>` with `<id>printing</id>` (near the end of the file). Inside it there is a `<dependencyManagement>` section with another `jakarta.servlet-api` dependency: add the same `<scope>` line as in step 2.1.
346+
347+
```diff
348+
<dependency>
349+
<groupId>jakarta.servlet</groupId>
350+
<artifactId>jakarta.servlet-api</artifactId>
351+
<version>${jakarta.servlet-api.version}</version>
352+
+ <scope>provided</scope>
353+
</dependency>
354+
```
355+
356+
**2.5** In the same `printing` profile, find the `print-lib` dependency. In its `<exclusions>`:
357+
358+
- delete the `commons-codec` exclusion:
359+
360+
```diff
361+
- <exclusion>
362+
- <groupId>commons-codec</groupId>
363+
- <artifactId>commons-codec</artifactId>
364+
- </exclusion>
365+
```
366+
367+
- add these five exclusions before the closing `</exclusions>` tag (JAXB is already shipped by GeoStore, HTTP Client 5 by http-proxy):
368+
369+
```diff
370+
+ <exclusion>
371+
+ <groupId>org.glassfish.jaxb</groupId>
372+
+ <artifactId>jaxb-runtime</artifactId>
373+
+ </exclusion>
374+
+ <exclusion>
375+
+ <groupId>jakarta.xml.bind</groupId>
376+
+ <artifactId>jakarta.xml.bind-api</artifactId>
377+
+ </exclusion>
378+
+ <exclusion>
379+
+ <groupId>org.apache.httpcomponents.client5</groupId>
380+
+ <artifactId>httpclient5</artifactId>
381+
+ </exclusion>
382+
+ <exclusion>
383+
+ <groupId>org.apache.httpcomponents.core5</groupId>
384+
+ <artifactId>httpcore5</artifactId>
385+
+ </exclusion>
386+
+ <exclusion>
387+
+ <groupId>org.apache.httpcomponents.core5</groupId>
388+
+ <artifactId>httpcore5-h2</artifactId>
389+
+ </exclusion>
390+
</exclusions>
391+
```
392+
393+
#### 3. Check the result
394+
395+
From the root folder of your project, build the WAR and run the check script shipped with MapStore (Python 3 is required):
396+
397+
```bash
398+
mvn clean install
399+
python3 MapStore2/utility/build/check_duplicate_jars.py web/target/*.war
400+
```
401+
402+
If you use the printing module, repeat the check with the `printing` profile:
403+
404+
```bash
405+
mvn clean install -Pprinting
406+
python3 MapStore2/utility/build/check_duplicate_jars.py web/target/*.war
407+
```
408+
409+
The script must print `No duplicated libraries`. Otherwise it lists the libraries found in more than one version: if they come from a dependency you added to your project, exclude the older version.
410+
239411
### New `viewFramingFilter` in `web.xml`
240412

241413
Add the following filter to your project's `web/src/main/webapp/WEB-INF/web.xml`, mapped on `/index.html` (see the updated [project template](https://github.com/geosolutions-it/MapStore2/blob/master/project/standard/templates/web/src/main/webapp/WEB-INF/web.xml) for reference). It relies on `org.apache.catalina.filters.HttpHeaderSecurityFilter`, already available with the Tomcat 10.1 dependency required by the upgrade above:

‎java/printing/assembly/mapstore-printing.xml‎

Lines changed: 32 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -13,67 +13,39 @@
1313
<directory>${project.build.directory}/mapstore-printing/WEB-INF</directory>
1414
<includes>
1515
<include>**/*.xml</include>
16-
<include>**/print-lib*.jar</include>
17-
<include>**/aircompressor-*.jar</include>
18-
<include>**/apiguardian-api-*.jar</include>
19-
<include>**/avalon-*.jar</include>
20-
<include>**/batik-*.jar</include>
21-
<include>**/bcmail-*.jar</include>
22-
<include>**/bcprov-*.jar</include>
23-
<include>**/bigint-*.jar</include>
24-
<include>**/commons-lang*.jar</include>
25-
<include>**/commons-httpclient-*.jar</include>
26-
<include>**/commons-io-*.jar</include>
27-
<include>**/commons-text-*.jar</include>
28-
<include>**/disruptor-*.jar</include>
29-
<include>**/ejml-*.jar</include>
30-
<include>**/fontbox-*.jar</include>
31-
<include>**/fop-*.jar</include>
32-
<include>**/GeographicLib-*.jar</include>
33-
<include>**/gt-*.jar</include>
34-
<include>**/guava-*.jar</include>
35-
<include>**/httpclient-*.jar</include>
36-
<include>**/httpcore-*.jar</include>
37-
<include>**/imageio-*.jar</include>
38-
<include>**/indriya-*.jar</include>
39-
<include>**/hsqldb-*.jar</include>
40-
<include>**/itext-*.jar</include>
41-
<include>**/itextpdf-*.jar</include>
42-
<include>**/jai*.jar</include>
43-
<include>**/jaxb-*.jar</include>
44-
<include>**/jaxb-api-*.jar</include>
45-
<include>**/jdom2-*.jar</include>
46-
<include>**/jempbox-*.jar</include>
47-
<include>**/jgridshift-*.jar</include>
48-
<include>**/json-20*.jar</include>
49-
<include>**/jackson-dataformat-yaml-*.jar</include>
50-
<include>**/javax.inject-*.jar</include>
51-
<include>**/jts-core-*.jar</include>
52-
<include>**/jt-*.jar</include>
53-
<include>**/jyaml-*.jar</include>
54-
<include>**/metrics-*.jar</include>
55-
<include>**/net.opengis.ows-*.jar</include>
56-
<include>**/org.eclipse.emf.common-*.jar</include>
57-
<include>**/org.eclipse.emf.ecore-*.jar</include>
58-
<include>**/org.eclipse.emf.ecore.xmi-*.jar</include>
59-
<include>**/org.w3.xlink-*.jar</include>
60-
<include>**/openpdf-*.jar</include>
61-
<include>**/pdfbox-*.jar</include>
62-
<include>**/profiler-*.jar</include>
63-
<include>**/re2j-*.jar</include>
64-
<include>**/si-*.jar</include>
65-
<include>**/slf4j-api-*.jar</include>
66-
<include>**/snakeyaml-*.jar</include>
67-
<include>**/systems-common-*.jar</include>
68-
<include>**/txw2-*.jar</include>
69-
<include>**/unit-*.jar</include>
70-
<include>**/uom-*.jar</include>
71-
<include>xalan-*.jar</include>
72-
<include>**/xml-apis-*.jar</include>
73-
<include>**/xml-commons-resolver*.jar</include>
74-
<include>**/xmlgraphics-commons-*.jar</include>
75-
<include>**/xercesImpl-*.jar</include>
7616
</includes>
7717
</fileSet>
7818
</fileSets>
19+
<!--
20+
print-lib and its runtime dependencies, except the libraries the MapStore WAR already ships:
21+
the bundle is unpacked over an existing MapStore and must not add a second version of them
22+
-->
23+
<dependencySets>
24+
<dependencySet>
25+
<outputDirectory>/WEB-INF/lib</outputDirectory>
26+
<!-- same file names as in the WAR (-SNAPSHOT instead of the timestamped version) -->
27+
<outputFileNameMapping>${artifact.artifactId}-${artifact.baseVersion}${dashClassifier?}.${artifact.extension}</outputFileNameMapping>
28+
<useProjectArtifact>false</useProjectArtifact>
29+
<scope>runtime</scope>
30+
<excludes>
31+
<exclude>com.fasterxml.jackson.core:*</exclude>
32+
<exclude>com.google.code.findbugs:*</exclude>
33+
<exclude>com.google.errorprone:*</exclude>
34+
<exclude>com.google.guava:*</exclude>
35+
<exclude>com.google.j2objc:*</exclude>
36+
<exclude>commons-io:*</exclude>
37+
<exclude>commons-logging:*</exclude>
38+
<exclude>io.micrometer:*</exclude>
39+
<exclude>jakarta.activation:*</exclude>
40+
<exclude>jakarta.annotation:*</exclude>
41+
<exclude>jakarta.inject:*</exclude>
42+
<exclude>org.apache.commons:commons-lang3</exclude>
43+
<exclude>org.apache.commons:commons-text</exclude>
44+
<exclude>org.apache.logging.log4j:*</exclude>
45+
<exclude>org.jspecify:*</exclude>
46+
<exclude>org.slf4j:*</exclude>
47+
<exclude>org.springframework:*</exclude>
48+
</excludes>
49+
</dependencySet>
50+
</dependencySets>
7951
</assembly>

‎java/printing/pom.xml‎

Lines changed: 1 addition & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -14,41 +14,16 @@
1414
<url>http://www.geosolutionsgroup.com</url>
1515

1616
<dependencies>
17-
<!-- mapfish-print -->
17+
<!-- mapfish-print (exclusions in the root dependencyManagement) -->
1818
<dependency>
1919
<groupId>org.mapfish.print</groupId>
2020
<artifactId>print-lib</artifactId>
21-
<exclusions>
22-
<!-- drop the HTTP Client and Core jar -->
23-
<exclusion>
24-
<groupId>org.apache.httpcomponents</groupId>
25-
<artifactId>httpclient</artifactId>
26-
</exclusion>
27-
<exclusion>
28-
<groupId>org.apache.httpcomponents</groupId>
29-
<artifactId>httpcore</artifactId>
30-
</exclusion>
31-
</exclusions>
3221
</dependency>
3322
</dependencies>
3423

3524
<build>
3625
<finalName>mapstore-printing</finalName>
3726
<plugins>
38-
<plugin>
39-
<artifactId>maven-dependency-plugin</artifactId>
40-
<executions>
41-
<execution>
42-
<phase>process-classes</phase>
43-
<goals>
44-
<goal>copy-dependencies</goal>
45-
</goals>
46-
<configuration>
47-
<outputDirectory>${project.build.directory}/mapstore-printing/WEB-INF/lib</outputDirectory>
48-
</configuration>
49-
</execution>
50-
</executions>
51-
</plugin>
5227
<plugin>
5328
<artifactId>maven-resources-plugin</artifactId>
5429
<version>${maven-resources-plugin.version}</version>

0 commit comments

Comments
 (0)