fix(ojp-jdbc-driver): relocate all bundled third-party packages to prevent classpath pollution - #566
Merged
Conversation
…event classpath pollution - Remove kr.motd.maven:os-maven-plugin compile-scope dependency from ojp-grpc-commons; it is a Maven build extension only and was incorrectly leaking Maven internals (org.apache.maven, org.codehaus.plexus, org.eclipse.sisu, javax.enterprise, etc.) onto every consumer's runtime classpath. - Add explicit commons-lang3 dependency to ojp-jdbc-driver (previously obtained accidentally as a transitive dep via kr.motd.maven). - Add explicit plexus-utils test dependency to ojp-jdbc-driver (same root cause). - Change jakarta.transaction-api to provided scope; the JTA API is supplied by the container or consumer application and must not be bundled. - Add <artifactSet><excludes> to drop annotation-only artifacts (jsr305, android-annotations, error_prone_annotations, j2objc-annotations, animal-sniffer-annotations, jspecify, listenablefuture) that have no runtime value and whose javax.annotation / android.annotation packages must not be included in the shaded jar. - Add <filters> to exclude JAR signature files (META-INF/*.SF/DSA/RSA) from the shaded artifact to prevent SecurityException at runtime. - Add <relocations> for all remaining runtime packages (io.grpc, io.netty, io.perfmark, com.google.*, org.apache.commons) under the org.openjproxy.shaded.* namespace, so they no longer conflict with any version of those same libraries the consumer already has on their classpath. Fixes #565
Copilot
AI
changed the title
[WIP] Analyze implications of publishing thin driver artifact for ojp-jdbc-driver
fix(ojp-jdbc-driver): relocate all bundled third-party packages to prevent classpath pollution
Jul 29, 2026
The ojp-server module uses org.apache.commons.lang3 in multiple source files but the dependency was not declared in its pom.xml, causing a compilation failure. The version is already managed in the parent POM (3.18.0, overriding the transitive version to fix CVE-2025-48924).
…rver The previous PR (3bbb92f) intentionally omitted commons-lang3 from the ojp-server dependencies so it would not be bundled into the shaded JAR. The previous fix attempt incorrectly re-added the dependency. Instead, replace all StringUtils usages across 11 server source files with JDK equivalents available since Java 11 (server targets Java 25): - StringUtils.EMPTY -> "" - StringUtils.isBlank(x) -> x.isBlank() - StringUtils.isNotBlank(x) -> !x.isBlank() - StringUtils.isEmpty(x) -> x.isEmpty() - StringUtils.isNotEmpty(x) -> !x.isEmpty() - StringUtils.isNoneBlank(x) -> !x.isBlank() For Map.get() and JDBC metadata results that may return null, the null-safe form (x != null && !x.isEmpty()) is used. Proto-generated getters never return null so direct .isEmpty()/.isBlank() is safe for all gRPC field accessors.
…actions-check Resolving issues with GitHub Actions CI build and test
Contributor
|
@copilot Update relevant documentation including the e-book. Specially if now any dependency is expected to be provided and in which scenarios, application servers have more dependencies provided than web servers like tomcat, different frameworks might not have them. We test with Spring Boot, Quarkus, Micronaut and JakartaEE on Glassfish. |
… frameworks Document the provided-scope deps (slf4j-api, jakarta.transaction-api) and shading behaviour introduced in the ojp-jdbc-driver shading PR: - ebook chapter 7: new §7.1.1 covering provided deps, per-environment availability matrix, Tomcat/bare-servlet-container instructions, and classpath isolation explanation - java-frameworks/README.md: top-level summary table with per-env notes - spring-boot/README.md: Runtime Dependencies section (no action needed) - quarkus/README.md: Runtime Dependencies section (no action needed) - micronaut/README.md: Runtime Dependencies section with per-config table - jakarta-ee/README.md: Runtime Dependencies section covering GlassFish, WildFly, Open Liberty, TomEE and plain Tomcat with explicit snippets
Contributor
Author
Documentation updated in commit What was added: E-book chapter 7 — new §7.1.1 "Runtime Dependencies and Classpath Isolation"
Per-framework README updates:
|
|
rrobetti
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ojp-jdbc-driverwas published as a shaded uber jar with no<relocations>configured. Every bundled class (io.grpc,io.netty,com.google.protobuf,com.google.common, Maven internals, etc.) landed at its original package coordinate, silently overriding whatever version the consumer already had on their classpath.Changes
ojp-grpc-commons/pom.xmlkr.motd.maven:os-maven-pluginfrom compile-scope<dependencies>— it is a build extension only and should never appear there. Its presence dragged the entire Maven plugin stack (org.apache.maven.*,org.codehaus.plexus.*,org.eclipse.sisu.*,javax.enterprise.*, etc.) into the driver's shaded jar.ojp-jdbc-driver/pom.xmljakarta.transaction-api→providedscope; JTA is supplied by the container.commons-lang3added as an explicit compile dependency (was accidentally transitively available viakr.motd.maven).plexus-utilsadded as an explicit test dependency (same root cause).<artifactSet><excludes>drops annotation-only artifacts (jsr305,android-annotations,error_prone_annotations,j2objc-annotations,animal-sniffer-annotations,jspecify,listenablefuture) — no runtime value; theirjavax.annotation/android.annotationpackages must not be embedded.<filters>stripsMETA-INF/*.SF/DSA/RSAsignature files to preventSecurityExceptionat runtime.<relocations>moves all remaining runtime packages underorg.openjproxy.shaded.*:After this change the published jar contains no third-party classes at their original coordinates. Consumers using gRPC, Netty, Protobuf, or Guava independently will no longer see version conflicts from the driver.