Hi Robert OpenSAML has Metrics 4.1.18 as a dependency [1]. Sling uses metrics-core 3.2.6 which was released in 2017. Since then, only v4 has active development according to the releases in Central [3].
So I think Sling should probably update to the newer version if possible. Until then the SAML bundle could either embed metrics-core v4.1.18+ or it could require parallel versions. Which is better in your opinion? Cris [1] https://git.shibboleth.net/view/?p=java-parent-project.git;a=blob;f=pom.xml;h=d87758e21f1cf63222959a9ca7631585128f8573;hb=HEAD [2] https://github.com/apache/sling-org-apache-sling-starter/blob/96b8df17cd09f7b72ba6794f25d75a524f7e1215/src/main/features/base.json [3] https://mvnrepository.com/artifact/io.dropwizard.metrics/metrics-core > On Jul 1, 2021, at 9:05 AM, Robert Munteanu <[email protected]> wrote: > > On Tue, 2021-06-29 at 18:48 -0400, Cris Rockwell wrote: >> Hi Robert >> >>> Why are there version ranges used in the pom? >> I was using Maven bracket notation for version ranges that I had >> actually tested. But I see it’s not needed, and removed the bracket >> range on the versions. Now it builds without downloading any SNAPSHOTS. >> >> >>> checker-qual-2.11.1.jar >>> error_prone_annotations-2.3.4.jar >>> failureaccess-1.0.1.jar >> >> These are dependencies of Google Guava, which is also an embedded >> dependency. If I didn't embed Guava, the deps above wouldn’t be needed. >> Sling comes with Guava v15. But OpenSAML libraries currently require >> 30.1.1-jre. Having a recent version of Guava installed as a bundle >> could help a lot. But having both versions as bundles doesn’t seem to >> work. I am getting the error below... > > As Julian mentioned, embedding Guava is the only safe solution right > now. And thank you for looking into the additional dependencies and > making sure they can be used as OSGi bundles, this will make > deployments simpler. > >> >> Import-Package: com.codahale.metrics; version="[4.1, 5)", >> com.google.common.base; version="[30.1, 31)", >> com.google.common.collect; version="[30.1, 31)", >> com.google.common.escape; version="[30.1, 31)", com.google.common.io >> <http://com.google.common.io/>; >> version="[30.1, 31)", com.google.common.net <http://com.google.common.net/>; >> version="[30.1, 31)", >> >>> metrics-core-4.1.9.jar >> >> Upgrading metrics-core past v3 causes a lot of problems with many >> Sling bundles. I counted ~40 bundles that went from Active to >> Installed state. But when installed with parallel versions (v3 and >> v4) everything seems fine. > >> > Is the metrics bundle something you're consuming or required by a > dependency? Ideally we would be working with whatever is supported by > the current Sling Starter / commons.metrics bundle. > > Thanks, > Robert
