allthingssecurity opened a new pull request, #27925: URL: https://github.com/apache/camel/pull/27925
# Description [CAMEL-25686](https://issues.apache.org/jira/browse/CAMEL-25686) Follow-up of the review of #27793 (camel-wasm): `parent/pom.xml` managed only `org.ow2.asm:asm` at `asm-version`. `asm-commons`, `asm-tree`, `asm-util` and `asm-analysis` were not managed, so they kept the version of the library that brings them while `asm` was moved to `asm-version`. This is not only a future risk. `mvn dependency:tree -Dincludes=org.ow2.asm` over the build on main (every module except `tests/test-bundles`, which did not resolve offline; `tests/camel-itest` and `tests/camel-streamcaching-test` were checked separately and only have `asm` itself) gives `asm` 9.10.1 everywhere, and the other four at: | module | brought by | version | |---|---|---| | camel-web3j | web3j core > jnr-unixsocket > jnr-ffi 2.1.9 | 5.0.3 | | camel-test-infra-cassandra, camel-test-infra-all | cassandra-driver-core 3.10.0 > jnr-ffi 2.1.7 | 5.0.3 (in camel-test-infra-all asm-commons is already 9.10.1) | | camel-cassandraql | java-driver-core 4.19.3 > jnr-posix > jnr-ffi 2.2.11 | 9.2 | | camel-drill | drill-java-exec 1.22.0 | 9.5 | | camel-wasm, camel-opa | Endive compiler | 9.10.1 (from Endive's own asm-bom import) | With `-Dasm-version=9.9.1`, camel-wasm and camel-opa get `asm` 9.9.1 and the other four at 9.10.1, which is the case raised in the review. The managed `asm` entry is replaced by an import of `org.ow2.asm:asm-bom` at `asm-version`, in the same form as the existing junit, netty and jackson bom imports. With the change the same full-build tree shows every ASM artifact at 9.10.1 in every module, and with `-Dasm-version=9.9.1` all five follow the property. The only resolved versions that change are the four artifacts in the modules of the table. The bom import sits where the `asm` entry was; I can move it next to the other bom imports if preferred. Tests with the change (no failures): camel-wasm 133 (including the `compile=true` tests that run the Endive compiler on ASM), camel-opa 112, camel-web3j 132 (67 skipped), camel-cassandraql 8, camel-drill 7 (1 skipped). Not run: the container integration tests of camel-cassandraql and camel-drill; these unit suites do not run jnr-ffi's generated code, so the newer ASM under jnr-ffi is checked by resolution only. No upgrade guide entry: no Camel API or option changes; applications that use camel-web3j, camel-cassandraql or camel-drill with the Camel parent get the same ASM version for all ASM jars. # Target - [x] I checked that the commit is targeting the correct branch (Camel 4 uses the `main` branch) # Tracking - [ ] If this is a large change, bug fix, or code improvement, I checked there is a [JIRA issue](https://issues.apache.org/jira/browse/CAMEL) filed for the change (usually before you start working on it). (The ticket is drafted and not filed yet; CAMEL-25686 is a placeholder until it is.) # Apache Camel coding standards and style - [x] I checked that each commit in the pull request has a meaningful subject line and body. - [ ] I have run `mvn clean install -DskipTests` locally from root folder and I have committed all auto-generated changes. (I ran `dependency:tree` over the whole build and the tests of the five modules above. I did not run the full root build.) # AI-assisted contributions - [x] If this PR includes AI-generated code, commits have proper co-authorship attribution (e.g., `Co-authored-by` trailers) and the PR description identifies the AI tool used. This PR was prepared with Claude Code (Claude Opus 5.5). The commit carries a `Co-Authored-By` trailer. _Claude Code on behalf of allthingssecurity_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
