[
https://issues.apache.org/jira/browse/HADOOP-19970?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jose Luis López updated HADOOP-19970:
-------------------------------------
Release Note:
Hadoop now resolves a single servlet API,
org.eclipse.jetty.toolchain:jetty-servlet-api 4.0.9
(the javax.servlet 4.0 classes). It replaces
jakarta.servlet:jakarta.servlet-api 4.0.4, and
javax.servlet:javax.servlet-api 3.1.0, which arrived through jetty-server. The
packages are
unchanged (javax.servlet.*), so no code change is needed. This is the artifact
that Jetty 12's ee8
environment uses.
Downstream projects that depend on non-shaded Hadoop artifacts (hadoop-common,
hadoop-yarn-*,
hadoop-mapreduce-*, ...) now receive jetty-servlet-api. If they also declare
javax.servlet:javax.servlet-api or jakarta.servlet:jakarta.servlet-api 4.x,
Maven cannot mediate
between the different coordinates, so both jars end up on the classpath and jar
order decides which
copy of javax.servlet is used. Exclude one of them: either exclude
org.eclipse.jetty.toolchain:jetty-servlet-api from the Hadoop dependencies, or
drop or exclude the
other servlet API. Exclusions written for jakarta.servlet:jakarta.servlet-api
on Hadoop artifacts
need the new coordinate.
Projects that use the shaded clients are not affected: hadoop-client-api
carries no servlet
classes, and hadoop-client-runtime still relocates a single servlet API, now
taken from
jetty-servlet-api.
was:The servlet API dependency is now
org.eclipse.jetty.toolchain:jetty-servlet-api:4.0.9, replacing
jakarta.servlet:jakarta.servlet-api:4.0.4 and
javax.servlet:javax.servlet-api:3.1.0. It provides the same javax.servlet 4.0
packages. Downstream builds that exclude jakarta.servlet-api or
javax.servlet-api from Hadoop artifacts must exclude
org.eclipse.jetty.toolchain:jetty-servlet-api instead. The shaded
hadoop-client-api and hadoop-client-runtime public API is unchanged.
> Move the servlet API to jetty-servlet-api 4.0.9
> -----------------------------------------------
>
> Key: HADOOP-19970
> URL: https://issues.apache.org/jira/browse/HADOOP-19970
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: build, hadoop-common
> Reporter: Jose Luis López
> Assignee: Jose Luis López
> Priority: Minor
> Labels: pull-request-available
>
> *Scope*:
> * hadoop-project/pom.xml: add the jetty-servlet-api.version property (4.0.9),
> and replace the managed jakarta.servlet:jakarta.servlet-api 4.0.4 with
> org.eclipse.jetty.toolchain:jetty-servlet-api, with a comment on why and on
> what downstream projects need to do.
> * hadoop-common/pom.xml: declare
> org.eclipse.jetty.toolchain:jetty-servlet-api at compile scope. HttpServer2
> and its filters compile against javax.servlet, which today arrives only as
> javax.servlet-api 3.1.0 through jetty-server.
> * hadoop-project/pom.xml and hadoop-tools/hadoop-sls/pom.xml: the exclusion
> on jetty-server names org.eclipse.jetty:javax.servlet-api, a coordinate that
> matches nothing. Replace it with javax.servlet:javax.servlet-api.
> * hadoop-project/pom.xml: on javax-websocket-server-impl, also exclude
> javax.servlet:javax.servlet-api (through websocket-servlet).
> * Switch the coordinate in the 17 module poms that declare the servlet API,
> and in the 3 exclusions of it on Hadoop artifacts in
> hadoop-client-minicluster.
> * jersey-test-framework-core declares jakarta.servlet-api at compile scope.
> Exclude it on the managed entry only: managed exclusions also cover the
> Jersey test provider and hadoop-client-minicluster's own declaration of core.
> * LICENSE-binary: replace jakarta.servlet:jakarta.servlet-api:4.0.4 with
> org.eclipse.jetty.toolchain:jetty-servlet-api:4.0.9. LICENSE-binary and
> NOTICE-binary: drop javax.servlet:javax.servlet-api 3.1.0.
> * Tests: AbstractJettyClasspathTest in the hadoop-common test jar, with an
> empty TestJettyClasspath subclass in hadoop-common,
> hadoop-mapreduce-client-shuffle, hadoop-yarn-common, the
> ApplicationHistoryServer, the NodeManager and the Router. They check that one
> jar, jetty-servlet-api, provides javax.servlet, and that all Jetty jars come
> from one release. Jars are recognised by their contents and manifests, not by
> repository path.
> *Why*: javax.servlet-api 3.1.0 and jakarta.servlet-api 4.0.4 both publish the
> javax.servlet packages, and which one a module compiles and runs against
> depends on jar order. jetty-servlet-api 4.0.9 is the artifact and version
> Jetty 12's ee8 environment manages. Switching now leaves one servlet API jar
> and takes the coordinate change out of the Jetty 12 upgrade.
> *Impact on Jetty 9*: none. 4.0 is a superset of 3.1, and Jetty 9.4 runs on
> Servlet 4.0. jetty-servlet-api and jakarta.servlet-api 4.0.4 ship the same
> javax.servlet 4.0 classes, and jetty-servlet-api also carries the web.xml
> schemas. The project's web.xml files declare versions 2.4, 2.5 and 3.0, which
> Servlet 4.0 accepts.
> *Downstream*:
> * hadoop-client-runtime: still relocates one servlet API under
> org.apache.hadoop.shaded.javax.servlet, now taken from jetty-servlet-api
> 4.0.9 instead of jakarta.servlet-api 4.0.4. No public API change.
> * hadoop-client-api: carries no servlet classes. hadoop-client-minicluster:
> unchanged, it already excludes the servlet API.
> * Non-shaded artifacts: the coordinate changes from
> jakarta.servlet:jakarta.servlet-api to
> org.eclipse.jetty.toolchain:jetty-servlet-api, so downstream exclusions of
> jakarta.servlet-api need the new coordinate. Direct consumers of
> hadoop-common get jetty-servlet-api 4.0.9 instead of javax.servlet-api 3.1.0.
> * A project that also declares javax.servlet-api or jakarta.servlet-api 4.x
> gets two jars with the same javax.servlet classes (Maven cannot mediate
> between different coordinates) and should exclude one of them. See the
> release note.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
