Upgrading Apache Ant, Commons Compress, Commons IO and Maven, FlexMark and Guava

[lahodaj]

Upgrading a handful of libraries to new versions:

• Apache Ant to 1.10.14
• Apache Commons Compress 1.24.0
• Apache Commons IO to 2.13.0
• Apache Maven to 3.9.4
• FlexMark (including dependencies) to 0.64.6
• Guava 32.1.2

Notes:

• for Ant, I believe we were uploading the ant-misc.zip to the NB dependency server, but I don't quite see the need to do that anymore. We can just download the full binary distribution, from Apache servers, no?
• Commons IO was probably the hardest to fix, as it used to be an OSGi bundle, and the name of the bundle changed to org.apache.commons.commons-io - note the -. The NetBeans module system dislikes dashes in the module names. Every OSGi bundle with a dash in the name I was able to find inside NB is actually using a module wrapper, and has the dash replaced with an underscore. Which I think is a convention understood by the NB-OSGi bridge. So, I've changes the platform/o.apache.commons.io to platform/o.apache.commons.commons_io, and made that a NetBeans module wrapper. I believe the NB-OSGi bridge works in both directions, so this might work, hopefully.
• Guava also requires failureaccess (which is a separate jar, but conceptually part of Guava, AFAIK), so adding that as well.

Please let me know what you think.

Thanks!

---

^Add meaningful description above

By opening a pull request you confirm that, unless explicitly stated otherwise, the changes -

• are all your own work, and you have the right to contribute them.
• are contributed solely under the terms and conditions of the Apache License 2.0 (see section 5 of the license for more information).

Please make sure (eg. git log) that all commits have a valid name and email address for you in the Author field.

If you're a first time contributor, see the Contributing guidelines for more information.

If you're a committer, please label the PR before pressing "Create pull request" so that the right test jobs can run.

[mbien]

great job! Are you using scripts/tooling for this or was this manual work?

• It would be good if you could keep the maven dist upgrade in a separate commit since it is often something which is temporarily reverted to check for regressions (happened last release, and the release before too). Ideally, it would have been nice to have a commit for each library - but... no need to fight git now for this. (one PR is ok in my book if its split in commits)
• heads up for Checkbox support on Markdown preview #6401 which will cause a small merge conflict in flexmark since it adds a jar but should be easy to resolve if merged first I think

[neilcsmith-net]

It would be good if you could keep the maven dist upgrade in a separate commit

Agreed. And we should also keep an eye open for 3.9.5, which seems to have been delayed but still might be available before freeze.

[matthiasblaesing]

The approach to update commons-io looks sane to me. It seems cleaner than the alternative suggestion in #3794, where I overlooked, that supporting "-" in the module name would need further work.

A test build seems to work ok (build maven project, modified maven dependencies, used update version hint in pom). I see sometimes flaky behavior in this area, but that is not tied to this change. The change was tested together with the JDOM update in #6478.

The change to the binaries-list:

netbeans/extide/o.apache.tools.ant.module/external/binaries-list

Line 17 in c4da5b2

A5D56956DC0A19395F6E01CF5D3056EC2EDE86A8 https://archive.apache.org/dist/ant/binaries/apache-ant-1.10.14-bin.zip apache-ant-1.10.14-bin.zip

seems ok. But has drawbacks. For maven central the CDN backing it is pretty good in my experience. We need to see how stable the netbeans archive server is.

[neilcsmith-net]

For maven central the CDN backing it is pretty good in my experience. We need to see how stable the netbeans archive server is.

Might be worth double checking this with infra@ before making this change. I wish there were proper permalink support for releases that didn't bypass the release CDN. Mind you, searching "archive.apache.org" across ASF repos shows a bunch of use.

[lahodaj]

The change to the binaries-list:

netbeans/extide/o.apache.tools.ant.module/external/binaries-list

Line 17 in c4da5b2

A5D56956DC0A19395F6E01CF5D3056EC2EDE86A8 https://archive.apache.org/dist/ant/binaries/apache-ant-1.10.14-bin.zip apache-ant-1.10.14-bin.zip

seems ok. But has drawbacks. For maven central the CDN backing it is pretty good in my experience. We need to see how stable the netbeans archive server is.

The thing to note is that this is not really replacing references to maven central with an URL to the Apache archives. If it would be that case, I would not do it. The actual real change and motivation is to change the URL to our "legacy" server:

netbeans/extide/o.apache.tools.ant.module/external/binaries-list

Line 17 in 3c33616

A4CDC20F1F620A6208B42F81C224CDB6B9C1968D ant-misc-1.10.8.zip

to the Apache archives. Note the ant-misc-1.10.8.zip is downloaded from:
https://netbeans.osuosl.org/binaries/A4CDC20F1F620A6208B42F81C224CDB6B9C1968D-ant-misc-1.10.8.zip
not from Maven central. My understanding is that this is because some of the files in the Ant distribution are not on Maven central. I.e. when upgrading Ant, unless the Ant project uploads the whole distribution to Maven central, the choice is between using Apache archives, or zip the extra files manually, upload them to osuosl and download them from there. Given we would like (I think) to migrate out of using osuosl, eventually, I think it makes sense to use Apache archives over osuosl. Also, we are an ASF project, and ASF has control over the Apache archives, but not quite over the osuosl server.

[neilcsmith-net]

Given we would like (I think) to migrate out of using osuosl, eventually, I think it makes sense to use Apache archives over osuosl. Also, we are an ASF project, and ASF has control over the Apache archives, but not quite over the osuosl server.

100% agree with this - I noticed that file was off of osuosl, and I do think we need to migrate. It's a shame that the full zip distribution isn't on Maven Central. btw - I'm not saying don't do this, just be aware of the restrictions on use of archive.a.o - with caching should hopefully not be an issue.

[matthiasblaesing]

The actual real change and motivation is to change the URL to our "legacy" server:

@lahodaj sorry for the noise, I overlooked the non maven central reference. With that in mind, it is indeed undoubfully an improvement.

[mbien]

Might be worth double checking this with infra@ before making this change. I wish there were proper permalink support for releases that didn't bypass the release CDN. Mind you, searching "archive.apache.org" across ASF repos shows a bunch of use.

just as sidenote: the dependencies are all in the cache and CI is set up to build only in one primary job, the secondary jobs do hopefully not a lot of building (there are exceptions). So I hope the load on the apache server from our side should be minimal.

Although we do have #4206 which we should probably merge.

[mbien]

changes look good to me

manually tested maven:

• local/remote index scan/download
• output window behavior with mvn and mvnd
• SMO and some queries
• checked log

@lkishalmi since you wrote the markup preview feature, could you check flexmark? PR has a devbuild.

[mbien]

@matthiasblaesing can we merge this? Maven 3.9.5 is released and I have an update prepared locally.

[mbien]

actually. going to merge now. Lets get some PRs in. Thanks for updating the libs @lahodaj!