[JIRA] (OSJ-344) Exclude JAXB from xmlsec dependencies

[Brent Putman (Jira)]

Brent Putman ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e ) *commented* on OSJ-344 ( https://shibboleth.atlassian.net/browse/OSJ-344?atlOrigin=eyJpIjoiNWE1ODMyNzQ0MDY3NDdjMDg4MjAzNDYwNzg2MzgxNWQiLCJwIjoiaiJ9 )

Re: Exclude JAXB from xmlsec dependencies ( https://shibboleth.atlassian.net/browse/OSJ-344?atlOrigin=eyJpIjoiNWE1ODMyNzQ0MDY3NDdjMDg4MjAzNDYwNzg2MzgxNWQiLCJwIjoiaiJ9 )

I have updated the parent POM to exclude the nominal JAXB dependency and it seems to be working as expected vis-a-vis Santuario’s dependencies. The OpenSAML and IdP tests all run fine with the exclusion.

Note however that as of at least 2.1.7 and including 2.3.0, the dependencies coordinates are actually now the Jakarta version, which is what I have actually excluded here:

<exclusions>
 <exclusion>
   <groupId> jakarta.xml.bind </groupId>
   <artifactId> jakarta.xml.bind-api </artifactId>
 </exclusion>
</exclusions>

More importantly, though, this isn’t actually resulting in this being effectively excluded from our projects. hibernate-core still has a dependency on this, transitively via its dependency on org.glassfish.jaxb:jaxb-runtime :

[INFO] +- org.hibernate:hibernate-core:jar:5.4.30.Final:runtime
[INFO] |  +- org.jboss.logging:jboss-logging:jar:3.4.1.Final:runtime
[INFO] |  +- javax.persistence:javax.persistence-api:jar:2.2:runtime
[INFO] |  +- org.javassist:javassist:jar:3.27.0-GA:runtime
[INFO] |  +- net.bytebuddy:byte-buddy:jar:1.10.21:runtime
[INFO] |  +- antlr:antlr:jar:2.7.7:runtime
[INFO] |  +- org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:jar:1.1.1.Final:runtime
[INFO] |  +- org.jboss:jandex:jar:2.2.3.Final:runtime
[INFO] |  +- com.fasterxml:classmate:jar:1.5.1:runtime
[INFO] |  +- org.dom4j:dom4j:jar:2.1.3:runtime
[INFO] |  +- org.hibernate.common:hibernate-commons-annotations:jar:5.1.2.Final:runtime
[INFO] |  \- org.glassfish.jaxb:jaxb-runtime:jar:2.3.6:runtime
[INFO] |     +- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.3:runtime
[INFO] |     +- org.glassfish.jaxb:txw2:jar:2.3.6:runtime
[INFO] |     \- com.sun.istack:istack-commons-runtime:jar:3.0.12:runtime

Is this known/expected, etc? I do see that in the parent POM for hibernate-core , there is an exclusion for javax.xml.bind:jaxb-api , but this obviously isn't covering the org.glassfish.jaxb and jakarta.xml.bind stuff.

( https://shibboleth.atlassian.net/browse/OSJ-344#add-comment?atlOrigin=eyJpIjoiNWE1ODMyNzQ0MDY3NDdjMDg4MjAzNDYwNzg2MzgxNWQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/OSJ-344#add-comment?atlOrigin=eyJpIjoiNWE1ODMyNzQ0MDY3NDdjMDg4MjAzNDYwNzg2MzgxNWQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:46df9a5 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220326/f73de10e/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-d25b0a74-ee84-499e-99fd-724a954895db
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220326/f73de10e/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-1d75bfb8-c967-4cbf-9e0f-e0258570a93b
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220326/f73de10e/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-bc60bf56-47f4-4d15-bb70-cb0dfed1e8a4
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220326/f73de10e/attachment-0005.png>