I then suggest to stop the distribution of the commons-lang-api plugin. It is not used by any plugin so far and we should avoid that anyone starts using it. ________________________________ From: [email protected] <[email protected]> on behalf of Basil Crow <[email protected]> Sent: Wednesday, July 30, 2025 7:39 PM To: [email protected] <[email protected]> Subject: Re: Modernize core dependency json-lib library
On Wed, Jul 30, 2025 at 10:30 AM 'Winter, Markus' via Jenkins Developers <[email protected]> wrote: > > And given the almost 300 plugins that use commons-lang I think once json-lib > is fixed we can remove it from core and have the commons-lang-api plugin as > an implied dependency. An implied dependency could work, but those tend to stick around a lot longer and are more difficult to reason about and debug. For example, I can foresee complaints (like ones we've had before) that a hypothetical detached Commons Lang 2 plugin keeps getting installed even after users remove it simply because they happened to install a new plugin with an older baseline. Cleaner and simpler to remove the dependency after migrating plugins, particularly given that its presence on the classpath trips up security scanners. When looking at plugins, I see two major categories: plugins that use Commons Lang extensively (which can be migrated to version 3) and plugins that use it only in a handful of places for extremely basic functionality (e.g., checking if some string is null or empty, which can easily be migrated to standard Java Platform functionality). Doing a sweep of the ecosystem might be more work in the short term, but in the long term it leaves the code in a better state and gets us more quickly to a state where security scanners stop complaining about our classpath. -- You received this message because you are subscribed to the Google Groups "Jenkins Developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.google.com%2Fd%2Fmsgid%2Fjenkinsci-dev%2FCAFwNDjpHFRW_sgeP9T%253DUba1g-gOuvB%253D7%253Db_0BDtysWjRS1Ya0A%2540mail.gmail.com&data=05%7C02%7Cm.winter%40sap.com%7C1ee0f7b0136b476db9dd08ddcf902162%7C42f7676cf455423c82f6dc2d99791af7%7C0%7C0%7C638894940148578435%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=%2F2eusjzUcinDrJlCd9d7zKO4R1KsPuAqZ%2F5dV7wGrZ0%3D&reserved=0<https://groups.google.com/d/msgid/jenkinsci-dev/CAFwNDjpHFRW_sgeP9T%3DUba1g-gOuvB%3D7%3Db_0BDtysWjRS1Ya0A%40mail.gmail.com>. -- You received this message because you are subscribed to the Google Groups "Jenkins Developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/jenkinsci-dev/AS1PR02MB78470FCC7CF9DCD10016D5158724A%40AS1PR02MB7847.eurprd02.prod.outlook.com.
