Thanks for the link about Xerces. We've had run-ins with it in the past. For now I'm going with your recommendation to exclude xml-apis from the build. The com.megginson.sax:xml-writer is used in one place, and that is working fine (though I'll make a note in the pom about it).
On Sat, Apr 15, 2023 at 1:51 PM Greg Chabala <greg.chab...@gmail.com> wrote: > It's no surprise that Xerces is involved here. Some colorful background: > > https://stackoverflow.com/questions/11677572/dealing-with-xerces-hell-in-java-maven > > The crux is clearly that xml-apis is a transitive dependency in two places, > and depending on which is elected vs evicted, it will be compile or > provided scope, and therefore in the WAR or not. > > This case might be of interest to the reproducible builds folks, since I > would have thought it was deterministic, but it seems like your pom as > written currently is letting it waffle. > > In any case, you should be able to force the behavior to be stable by > declaring a direct dependency on xml-apis. Whether it should be compile or > provided scope, or if you prefer to exclude it entirely instead, will take > some more work. > > Looking at GWT, it seems like gwt-dev is provided because it's intended for > compile only, and runtime requirements are in the gwt-servlet artifact, > which I presume is also declared in your pom. I suspect Xerces and xml-api, > as well as htmlunit, are never needed by GWT at runtime, or are provided by > other artifacts or the application server. > > Looking at com.megginson.sax:xml-writer, it appears to really depend on > xml-api, although it is an older version. If your application still works > without xml-api present, exclusion might be the best option. > -- "Hell hath no limits, nor is circumscrib'd In one self-place; but where we are is hell, And where hell is, there must we ever be" --Christopher Marlowe, *Doctor Faustus* (v. 111-13)
