micronaut-core still has transitive dependency on findbugs:jsr305 (com.google.code.findbugs:jsr305:3.0.2)

[msgilligan]

As of Micronaut 2.1, there is still a transitive dependency on findbugs:jsr305

+--- io.micronaut:micronaut-inject:2.1.1
     +--- org.slf4j:slf4j-api:1.7.26 -> 1.7.30
     +--- javax.annotation:javax.annotation-api:1.3.2
     +--- javax.inject:javax.inject:1
     +--- io.micronaut:micronaut-core:2.1.1
     |    +--- org.slf4j:slf4j-api:1.7.26 -> 1.7.30
     |    +--- org.reactivestreams:reactive-streams:1.0.3
     |    \--- com.github.spotbugs:spotbugs-annotations:4.0.3
     |         \--- com.google.code.findbugs:jsr305:3.0.2
     \--- org.yaml:snakeyaml:1.26

The transitive dependency results in Java Module System split-package issues:

error: the unnamed module reads package javax.annotation from both java.annotation and jsr305
error: module io.micronaut.core reads package javax.annotation from both jsr305 and java.annotation
error: module javafx.controlsEmpty reads package javax.annotation from both jsr305 and java.annotation
error: module javafx.graphicsEmpty reads package javax.annotation from both jsr305 and java.annotation
error: module javafx.baseEmpty reads package javax.annotation from both jsr305 and java.annotation
error: module java.annotation reads package javax.annotation from both jsr305 and java.annotation
error: module org.yaml.snakeyaml reads package javax.annotation from both jsr305 and java.annotation
error: module org.reactivestreams reads package javax.annotation from both jsr305 and java.annotation
error: module com.github.spotbugs.annotations reads package javax.annotation from both jsr305 and java.annotation
error: module jsr305 reads package javax.annotation from both jsr305 and java.annotation
error: module io.micronaut.inject reads package javax.annotation from both jsr305 and java.annotation
error: module org.slf4j reads package javax.annotation from both jsr305 and java.annotation
error: module javax.inject reads package javax.annotation from both jsr305 and java.annotation

I work around this with the Java Modularity Gradle Modules Plugin as follows:

patchModules.config = [
        "java.annotation=jsr305-3.0.2.jar"
]

Note that the documentation is incorrect and says

The JSR-305 annotations library (com.google.code.findbugs:jsr305) is no longer a dependency (replaced by spotbugs-annotations). If you need this library you will need to add it manually.

[graemerocher]

It is not longer a direct dependency no but it seems spotbugs still depends on the jsr305 meta annotations and until that is solved I am not sure we can do anything about this. This is the same as Spring, Checker etc. and every other library that uses these meta annotations

[aalmiray]

FWIW just hit this issue with Micronaut 2.3.1 when attempting to run a trivial CLI application in the modulepath using Layrry

$ layrry --layers-config layers.toml 
Exception in thread "main" java.lang.module.ResolutionException: Modules java.annotation and jsr305 export package javax.annotation to module io.micronaut.aop
    at java.base/java.lang.module.Resolver.resolveFail(Resolver.java:885)
    at java.base/java.lang.module.Resolver.failTwoSuppliers(Resolver.java:797)
    at java.base/java.lang.module.Resolver.checkExportSuppliers(Resolver.java:718)
    at java.base/java.lang.module.Resolver.finish(Resolver.java:362)
    at java.base/java.lang.module.Configuration.<init>(Configuration.java:141)
    at java.base/java.lang.module.Configuration.resolve(Configuration.java:424)
    at org.moditect.layrry.internal.LayersImpl.createModuleLayer(LayersImpl.java:206)
    at org.moditect.layrry.internal.LayersImpl.handleLayerComponent(LayersImpl.java:150)
    at org.moditect.layrry.internal.LayersImpl.run(LayersImpl.java:119)
    at org.moditect.layrry.Layrry.launch(Layrry.java:81)
    at org.moditect.layrry.Layrry.run(Layrry.java:56)
    at org.moditect.layrry.launcher.LayrryLauncher.launch(LayrryLauncher.java:117)
    at org.moditect.layrry.launcher.LayrryLauncher.main(LayrryLauncher.java:46)

[graemerocher]

@aalmiray Micronaut 2.4 will let you exclude spot bugs using dependency exclusions to solve this issue

[aalmiray]

Is there the need of a replacement besides exclusion? Just tried launching an updated application (Micronaut 2.4.0) by excluding the JSR-305 JAR and I'm afraid it didn't work 😞

[graemerocher]

following works for me:

mn create-app without-spotbugs --build maven
cd without-spotbugs

Modify micronaut-inject:

    <dependency>
      <groupId>io.micronaut</groupId>
      <artifactId>micronaut-inject</artifactId>
      <scope>compile</scope>
      <exclusions>
          <exclusion>
              <groupId>com.github.spotbugs</groupId>
              <artifactId>spotbugs-annotations</artifactId>
          </exclusion>
      </exclusions>
    </dependency>

Or if you are using Gradle:

configurations.all {
    exclude group: 'com.github.spotbugs'
}

[graemerocher]

for Micronaut 3.0 we will remove this dependency completely but it seems from the above it is completely possible to remove it now?

[aalmiray]

I can see where the problem is, I had a typo on the TOML file used to configure Layrry. Skipping both spotbugs-annotations and jsr305 (the real offender as it splits the javax.annotation package) make the application work.

[msgilligan]

Thanks for the 2.4.0 release, @graemerocher! I think you can remove the "awaiting third-party" tag from this issue now. 😁

[graemerocher]

Can it be closed?

[msgilligan]

Well technically, the transitive dependency isn't removed until Micronaut 3, right?

[msgilligan]

I'm also seeing 2 beans that are correctly loaded when I use javax.inject.Singleton but not when I use jakarta.inject.SIngleton (simply changing javax to jakarta in the import statement causes the bean not to load). Other beans are working with jakarta, so I'm not sure what is happening. I'll investigate further when I have time and post details.

NOTE: I am using Micronaut Application Gradle Plugin v1.4.2

[msgilligan]

@graemerocher I created an issue in ConsenusJ that shows the failure: https://github.com/ConsensusJ/consensusj/issues/70

Here's the commit that breaks the build: https://github.com/ConsensusJ/consensusj/commit/707248e3f343817fcc16253f7a6c0c362306ef82

And here's the build scan: https://scans.gradle.com/s/4doezawpjeiwq/tests

[graemerocher]

@msgilligan could you report a separate issue for that. Thanks.

[msgilligan]

@graemerocher Here's the new issue: https://github.com/micronaut-projects/micronaut-core/issues/5103