[Regression] commons-configuration2 is pulled in as a required dependency

[papegaaij]

Search before asking

• I had searched in the issues and found no similar issues.

Environment

This is a dependency of shiro-core, so it's for every environment.

Shiro version

2.0.0

Regression from:

1.13.0

What was the actual outcome?

Observe commons-configuration2 in the output below:

[INFO] Scanning for projects...
[INFO] 
[INFO] --------------------< org.apache.shiro:shiro-core >---------------------
[INFO] Building Apache Shiro :: Core 2.0.0
[INFO]   from shiro-core-2.0.0.pom
[INFO] -------------------------------[ bundle ]-------------------------------
[INFO] 
[INFO] --- dependency:3.6.1:tree (default-cli) @ shiro-core ---
[INFO] org.apache.shiro:shiro-core:bundle:2.0.0
[INFO] +- org.apache.shiro:shiro-lang:jar:2.0.0:compile
[INFO] |  \- org.slf4j:slf4j-api:jar:2.0.12:compile
[INFO] +- org.apache.shiro:shiro-cache:jar:2.0.0:compile
[INFO] +- org.apache.shiro:shiro-crypto-hash:jar:2.0.0:compile
[INFO] |  +- org.apache.shiro:shiro-crypto-core:jar:2.0.0:compile
[INFO] |  \- org.bouncycastle:bcprov-jdk18on:jar:1.77:compile
[INFO] +- org.apache.shiro:shiro-crypto-cipher:jar:2.0.0:compile
[INFO] +- org.apache.shiro:shiro-config-core:jar:2.0.0:compile
[INFO] +- org.apache.shiro:shiro-config-ogdl:jar:2.0.0:compile
[INFO] |  \- commons-beanutils:commons-beanutils:jar:1.9.4:compile
[INFO] |     \- commons-collections:commons-collections:jar:3.2.2:compile
[INFO] +- org.apache.shiro:shiro-event:jar:2.0.0:compile
[INFO] +- jakarta.annotation:jakarta.annotation-api:jar:1.3.5:provided
[INFO] \- org.apache.commons:commons-configuration2:jar:2.9.0:compile
[INFO]    +- org.apache.commons:commons-lang3:jar:3.12.0:compile
[INFO]    \- org.apache.commons:commons-text:jar:1.10.0:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.969 s
[INFO] Finished at: 2024-03-11T21:48:45+01:00
[INFO] ------------------------------------------------------------------------

What was the expected outcome?

Commons-configuration2 should be made optional. The code here already supports it being optional:

shiro/config/ogdl/src/main/java/org/apache/shiro/config/ogdl/ReflectionBuilder.java

Lines 782 to 789 in 36cad48

	private Interpolator createInterpolator() {
	if (ClassUtils.isAvailable("org.apache.commons.configuration2.interpol.ConfigurationInterpolator")) {
	return new CommonsInterpolator();
	}
	return new DefaultInterpolator();
	}

How to reproduce

see above

Debug logs

No response

[lprimak]

I am not certain this is a bug. I believe the code started as optional, but later became required, but the optionality was not removed from the code.
IMHO it would be too much of a risk to make it optional at this time, because it would mysteriously break functionality existing applications currently rely on and require inclusions of explicit additional dependency for existing applications.

Perhaps the "action item" is to remove the above reflection / if statement from the code itself?

[lprimak]

Maybe someone else can chime in?

[fpapon]

I think this is a bug, I will go deeper.

It's well optional on config-ogdl:

shiro/config/ogdl/pom.xml

Line 97 in 9507f24

<optional>true</optional>

But not in core:

shiro/core/pom.xml

Line 147 in 9507f24

<groupId>org.apache.commons</groupId>

[lprimak]

Maybe not a bug but a code smell? Perhaps the required dependency should be moved into ogdl and removed from core but net effect wouldn't change

[fpapon]

@lprimak the problem was introduced in this commit:
5755721

Can you explain why adding a provided dependency because of compiler warning?

[lprimak]

I remember... it's an OSGi warning from the bnd plugin

[lprimak]

I will try a PR to fix it then... thanks for your research @fpapon

[fpapon]

May be just adding the dependency in optional scope will be enough

[fpapon]

The warning from the bnd plugin comes from these lines:

shiro/core/pom.xml

Line 82 in 9507f24

org.apache.commons.configuration2*;resolution:=optional,

I will make some test in Karaf to see why we need them. I think we don't need to add these import package because we are not using them.

[lprimak]

No need. Making it optional in core worked and there is no warning

[lprimak]

@papegaaij Thank you for the report! This snuck in during build / code cleanup

[papegaaij]

No problem. I just happen to notice it because commons-configuration2 triggered a failure due to its dependency on a javax API. Thanks for fixing this!