Le lun. 29 sept. 2025 à 15:07, Elliotte Rusty Harold <[email protected]> a écrit :
> On Mon, Sep 29, 2025 at 12:09 PM Romain Manni-Bucau > <[email protected]> wrote: > > > > Hi Elliotte, > > > > Can we target it for next round? > > I'm not yet sure of the best way to solve it but it looks like it needs > > more love since all EE specs + microprofile + SPI based loading with a > > hardocoded default have this issue and I doubt we want to list all spec x > > impl x vendor + others deps there (would lead to a list >= 100 at minimum > > for the well known OSS ones). > > I am completely OK with a list of 100+ known exclusions. This is not a > challenge in 2025. > I'm mixed cause this stays a challenge cause you do not handle most of the gav still. > > If you have a more general way, please do submit a PR but let's not > let the perfect be the enemy of the good. Right now projects have > false positives about this specific json dependency. Removing those > false positives is an improvement, and it doesn't get in the way of > further work in the future, so let's merge it. > I'm also mixed about it cause it also creates bugs. Take you jsonp example, add johnzon as impl....and your exclusion should trigger the current bug cause the impl used is no more glassfish one (hardcoded one) but johnzon thanks the SPI overriding. This is why I think it can be worth a bit more thinking and that exclusions will not solve the issue but create the same bug but reversed. > > -- > Elliotte Rusty Harold > [email protected] > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
