checkerFrameworkAnnotatedJDK references JDK8 when JDK 21 is used

[jpschewe]

I'm using a plugin to check when I have dependencies that need updating. It's the ben-manes.versions plugin show in the below gradle file. This plugin keeps complaining that the annotatedJDK8 exceeds the milestone version.

Here is a simple build script that references the checker framework and uses the versions plugin.

buildscript {
    repositories {
        mavenCentral()
        gradlePluginPortal()
    }
    configurations.classpath {
      exclude(group: "com.google.guava", module: "guava")
    }
}    

plugins {
    id "java"
    // Checker Framework pluggable type-checking
    id "org.checkerframework" version "0.6.37"
    id "com.github.ben-manes.versions" version "0.51.0" // adds dependencyUpdates task
}

repositories {
    mavenCentral()
}

dependencies {
  implementation(group: "org.checkerframework", name: "checker-qual", version: "3.42.0")
  implementation(group: "org.checkerframework", name: "checker-util", version: "3.42.0")
  checkerFramework(group: "org.checkerframework", name: "checker", version: "3.42.0")
}

Running dependencyUpdates I get

The following dependencies exceed the version found at the milestone revision level:
 - org.checkerframework:jdk8 [3.42.0 <- 3.3.0]
     https://checkerframework.org

Executing a dependencies check I see checkerFrameworkAnnotatedJDK referencing a jdk8 version that doesn't exist. From doing some searching on checker it appears that the annotated JDK is included in checker from versions 3.5.0 and forward.

./gradlew dependencies

> Task :dependencies

------------------------------------------------------------
Root project 'bug-checkerframework'
------------------------------------------------------------

annotationProcessor - Annotation processors and their dependencies for source set 'main'.
No dependencies

checkerFramework - A copy of JDK classes with Checker Framework type qualifiers inserted.
\--- org.checkerframework:checker:3.42.0
     +--- org.checkerframework:checker-qual:3.42.0
     \--- org.checkerframework:checker-util:3.42.0
          \--- org.checkerframework:checker-qual:3.42.0

checkerFrameworkAnnotatedJDK - A copy of JDK classes with Checker Framework type qualifiers inserted.
\--- org.checkerframework:jdk8:3.42.0 FAILED

...

Is there something I have wrong in my build.gradle that makes the gradle checkerframework plugin believe that it needs to include the annotated JDK?
Or is the versions plugin finding dependencies that it should not?

I'd like to understand the right way to "fix" this.
It's not actually breaking my build, it's just concerning to see that I have a dependency that exceeds the milestone level.

[ben-manes]

fyi, you hide this issue by customizing the report to remove this dependency by doing something like

import com.github.benmanes.gradle.versions.reporter.PlainTextReporter

tasks.named("dependencyUpdates").configure {
  outputFormatter { result ->
    def reporter = new PlainTextReporter(project, revision, gradleReleaseChannel)
    result.exceeded.dependencies.removeAll {
      (it.group == 'org.checkerframework') && (it.name == 'jdk8')
    }
    reporter.write(System.out, result)
  }
}

[jpschewe]

Thanks @ben-manes that's useful to know. Based on how the checker framework is setup and needing to support old versions is it your understanding that this is likely the best solution to the dependency problem?

[ben-manes]

Well, no. It was merely my first thought for how the report could mask it but the dependency is clearly wrong and that is a bug in this plugin. In retrospect, an even simpler approach to this dependency problem that I usually use (e.g. when upgrades are jdk incompatible with the project) is to force it in my resolution strategy either for the report, on that configuration, or globally depending on the use-case.

configurations.all {
  resolutionStrategy {
    force("org.checkerframework:jdk8:3.3.0")
  }
}

That version is unlikely to ever be incremented as it is four years old. At this point ideally the feature would be removed, that version hardcoded, or perhaps the author would have preferred to originally have used a default dependency if it was user managed.