jakarta.activation version conflict in 2.13

[mkpaz]

I've tried to upgrade to 2.13 branch just recently to get rid of old jaxb namespaces (#116). However after I've tried to build my app with jlink I've got this:

Error: Two versions of module jakarta.activation found in ..\target\modules (jakarta.activation-api-1.2.1.jar and jakarta.activation-2.0.1.jar)

I'm using new Jakarta XML Bind module, here is dependency tree fragment:

[INFO] |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.13.0:compile
[INFO] |  |  +- com.fasterxml.jackson.core:jackson-annotations:jar:2.13.0:compile
[INFO] |  |  \- com.fasterxml.jackson.core:jackson-core:jar:2.13.0:compile
[INFO] |  +- com.fasterxml.jackson.dataformat:jackson-dataformat-properties:jar:2.13.0:compile
[INFO] |  +- com.fasterxml.jackson.dataformat:jackson-dataformat-xml:jar:2.13.0:compile
[INFO] |  |  +- org.codehaus.woodstox:stax2-api:jar:4.2.1:compile
[INFO] |  |  \- com.fasterxml.woodstox:woodstox-core:jar:6.2.6:compile
[INFO] |  +- com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:jar:2.13.0:compile
[INFO] |  |  +- jakarta.xml.bind:jakarta.xml.bind-api:jar:3.0.1:compile
[INFO] |  |  |  \- com.sun.activation:jakarta.activation:jar:2.0.1:compile
[INFO] |  |  \- jakarta.activation:jakarta.activation-api:jar:1.2.1:compile
[INFO] |  +- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.13.0:compile
[INFO] |  |  \- org.yaml:snakeyaml:jar:1.28:compile

So, jakarta.activation-api:jar:1.2.1 (Jackson dependency) conflicts with jakarta.activation:jar:2.0.1 (Jakarta XML Bind transitive dependency), because they're both using same module name.

To fix this you probably should either exclude jakarta.activation-api from module dependencies or switch to the 4.x branch that doesn't depend on old activation API. Links to compare:

3.x
4.x

A simple workaround is to include Bind API 4.x branch as a direct dependency, it's on RC stage.

[cowtowncoder]

Sigh. I wish there was someone to test this with 2.13.0-rc1 or rc2 (not mean as complaint to you @mkpaz -- thank you for reporting this :) ).

I think I need some help here: one nice thing would be a test reproduction (maybe for jackson-integration-tests).
And second of course specific change & verification.

My usual go to dev is @GedMarc -- WDYT? :)

[cowtowncoder]

Hi @GedMarc -- any concerns, comments, on possibly doing this for 2.13.1 / 2.14.0?

[cowtowncoder]

Hi @GedMarc: this seems like something to do, but would appreciate an opinion

@mkpaz So, would #166 be what you are thinking? If you could verify that this would resolve your issue, I think I could merge it for inclusion in 2.13.2.

[cowtowncoder]

Hi @mkpaz! Sorry to pester you but I was hoping to merge this, but wanted to first verify that #166 would resolve the issue -- if you have an easy way to verify. From simple "mvn dependency:tree" it would seem to be the way to go, but I don't have build for actual module usage.

[GedMarc]

ok we have a few updates on the jakarta suite on Monday -
activation should bump up, i'm busy testing the change site in production (yes sigh), we'll know if anything goes awry by the end of the day,
JAXB for jakarta also got updated this week, so I'm gonna run through those in our UAT

[GedMarc]

@mkpaz do you have a means of managing dependency versions? in poms you could manage the jakarta activation version from your pom file (which is how i'm testing) and ensure it uses the right one

[mkpaz]

Sorry for the late response and thanks for the fix. This would work since you basically just switching to older activation-api version and it's the same version jaxb-api uses as its dependency. But I'm not sure how should I test this as it's not yet merged and not released. Do I need to build Jackson locally with this fix? For my project I just bumped jaxb-api version and have no complaints.

[GedMarc]

In your pom file there is a section called <dependencyManagement> which you can use to fix versions across all dependencies,
Check the documentation https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#:~:text=Dependency%20Management%20The%20dependency%20management%20section%20is%20a,references%20to%20the%20artifacts%20in%20the%20child%20POMs.

[mkpaz]

If you mean this, yes, it works:

<dependencyManagement>
    ...
    <dependency>
        <groupId>com.fasterxml.jackson.module</groupId>
        <artifactId>jackson-module-jakarta-xmlbind-annotations</artifactId>
        <version>2.13.1</version>
        <exclusions>
            <exclusion>
                <groupId>jakarta.activation</groupId>
                <artifactId>jakarta.activation-api</artifactId>
            </exclusion>
        </exclusions>
    </dependency>
    <dependency>
        <groupId>com.sun.activation</groupId>
        <artifactId>jakarta.activation</artifactId>
        <version>2.0.1</version>
    </dependency>
    ...
</dependencyManagement>

[cowtowncoder]

Ok, I'll go ahead and get this merged then. Thank you @mkpaz @GedMarc !

[cowtowncoder]

@mkpaz You would be using 2.13.2-SNAPSHOT versions to check the fix, after building. I'll push a snapshot now since change is merged.