dashorst commented on issue #1862: URL: https://github.com/apache/wicket/issues/1862#issuecomment-6719931998
## Audit results (master, 12.0.0-SNAPSHOT) Method: `dependency:analyze` over the reactor (bytecode usage), `dependency:list` for what reaches an application's runtime classpath, then every finding checked against the sources, since the analyzer misses annotation, reflection and recipe-YAML use. Release dates are the Last-Modified of the pom on Maven Central. Every application that uses Wicket gets these from wicket-core: commons-io, commons-collections4, commons-fileupload2-core and -jakarta-servlet5, openjson, jdk-serializable-functional, slf4j-api (and bcprov, optional). ### Unnecessary or misplaced | Module | Dependency | Finding | Proposal | |---|---|---|---| | wicket-ioc | `org.ow2.asm:asm` (compile) | Not used. A leftover from the cglib era (WICKET-6825); byte-buddy shades its own ASM under `net.bytebuddy.jar.asm`. Also reaches wicket-spring and wicket-guice users. | Remove. | | wicket-tester, wicket-extensions-tester | `assertj-core` (compile) | No code uses it; only a `requires org.assertj.core` in module-info. Drags assertj and byte-buddy onto every test classpath that uses WicketTester. | Remove from pom and module-info. | | wicket-tester, wicket-extensions-tester | `junit-jupiter-params` (compile) | Not used in main code. | Remove. | | wicket-tester, wicket-extensions-tester, wicket-native-websocket-tester | `junit-jupiter-engine` (compile) | The main code compiles against `junit-jupiter-api` only, which arrives transitively through the engine. A test library forcing an engine version on users is unnecessary. | Declare `junit-jupiter-api` instead. | | wicket-util | `commons-collections4`, `commons-fileupload2-jakarta-servlet5` (compile) | wicket-util uses neither; they are declared here and used by wicket-request and wicket-core. module-info also `requires org.apache.commons.collections4` without using it. | Move the declarations to the modules that use them. No change for applications. | | wicket-core, wicket-request, wicket-tester | `commons-collections4` | Three uses in total: `LinkedMap` in `MarkupContainer` (for one `previousKey` call), `CollectionUtils.isEqualCollection` in `PageParameters.equals`, `CollectionUtils.isEmpty` in `WicketTester`. | Replace with JDK code and drop the dependency. Changes the serialized form of `MarkupContainer` children, fine for a major release. Applications that used collections4 without declaring it lose it. | | wicket-cdi | `jakarta.enterprise:jakarta.enterprise.cdi-api` 5.0.0 | Is only a relocation pom to `jakarta.cdi:jakarta.cdi-api`. | Use the new coordinates. | | wicket-bean-validation | `jakarta.el-api` (provided), `org.glassfish:jakarta.el` 4.0.2 (test) | Main code doesn't use EL; it's needed by Hibernate Validator in the tests. The implementation is EL 4.0 from 2021 against EL API 6.0. | Move el-api to test scope; replace `org.glassfish:jakarta.el` with `org.glassfish.expressly:expressly`. | | wicket-ioc | `jakarta.inject-api` (compile) | Not used by wicket-ioc; used by wicket-spring and wicket-guice, which get it through wicket-ioc. | Declare it in wicket-spring (Guice brings its own) and drop it from wicket-ioc. Low priority. | | root pom | `org.slf4j:slf4j-ext` (managed) | Referenced by no module, pins nothing transitively. | Remove. | | root pom | `slf4j-api` and `jakarta.servlet-api` declared for every module | Several modules (ioc, spring, guice, auth-roles, bean-validation, migration, objectsizeof-agent) use neither directly. Harmless, since wicket-core brings slf4j anyway. | Optional cleanup. | | `testing/wicket-threadtest`, `testing/wicket-arquillian` | whole module | Not in the reactor; their parent is still `10.0.0-M1-SNAPSHOT`, so they haven't been built since Wicket 10 development. They are the only users of `junit-vintage-engine`. | Delete or revive. | Checked and needed despite the analyzer's report: `jakarta.annotation-api` in wicket-cdi (`@PostConstruct`/`@PreDestroy` in `NonContextual`), `rewrite-migrate-java` in wicket-migration (referenced from the recipe YAML), and the root-pom management of `jsr305`, `junit:junit`, `xercesImpl`, `asm-commons` and `asm-util`, which pin transitive versions for dependency convergence. ### Old or abandoned dependencies | Dependency | Where | Status | |---|---|---| | `org.danekja:jdk-serializable-functional` 1.9.0 | wicket-core, compile, public API | Last release 2019-05-31. Wicket uses six interfaces (`SerializableFunction`, `-Supplier`, `-Consumer`, `-BiConsumer`, `-BiFunction`, `-Predicate`) and they appear in public signatures (`IModel`, `LambdaModel`, `Behavior`, Ajax behaviors). Inlining them into wicket-util removes an unmaintained dependency but is an API change that needs an OpenRewrite recipe (package rename). | | `org.apache.commons:commons-fileupload2-*` 2.0.0-M5 | wicket-core, compile, public API | Still a milestone; there is no 2.0.0 final. Its types appear in Wicket's upload API. | | `com.github.openjson:openjson` 1.0.13 | wicket-core, compile | Last release 2023-06-26, used in 12 files for Ajax and upload JSON. Not yet a problem; worth watching. | | `com.google.guava:guava` 31.0.1-jre, `checker-qual` 3.12.0, `j2objc-annotations` 1.3 | wicket-guice, transitive via Guice 7.0.0 | Guava from 2021 lands on wicket-guice users' classpath. Guice 7.0.0 (2023) is the latest release. Managing a current Guava would help those users. | | `org.httpunit:httpunit` 1.7.3 (+ `xercesImpl` 2.12.2, `junit` 4.13.2) | wicket-examples tests, test | HttpUnit's last release is from 2018; the project is dead. Five example tests use it. | | `jakarta.inject:jakarta.inject-api` 2.0.1.MR | ioc/spring/guice/cdi | 2021, but the spec is finished; no action. | <details><summary>Release dates of every managed dependency and everything that reaches an application's runtime classpath (Maven Central, 2026-11-08)</summary> | Dependency | Version | Scope | Released | Age | Latest stable | Released | |---|---|---|---|---|---|---| | `aopalliance:aopalliance` | 1.0 | compile (transitive) | 2007-02-26 | 19.7 y | same | | | `com.google.j2objc:j2objc-annotations` | 1.3 | compile (transitive) | 2017-01-18 | 9.8 y | 3.1 | 2025-08-14 | | `com.google.code.findbugs:jsr305` | 3.0.2 | provided | 2017-03-31 | 9.6 y | same | | | `org.httpunit:httpunit` | 1.7.3 | test | 2018-09-28 | 8.1 y | same | | | `com.google.guava:failureaccess` | 1.0.1 | compile (transitive) | 2018-11-19 | 8.0 y | 1.0.3 | 2025-03-19 | | `org.danekja:jdk-serializable-functional` | 1.9.0 | compile | 2019-05-31 | 7.4 y | same | | | `junit:junit` | 4.13.2 | compile | 2021-02-13 | 5.7 y | same | | | `org.checkerframework:checker-qual` | 3.12.0 | compile (transitive) | 2021-04-01 | 5.6 y | 4.4.0 | 2026-11-02 | | `org.apiguardian:apiguardian-api` | 1.1.2 | compile (transitive) | 2021-06-27 | 5.4 y | same | | | `org.glassfish:jakarta.el` | 4.0.2 | test | 2021-08-17 | 5.2 y | same | | | `com.google.guava:guava` | 31.0.1-jre | compile (transitive) | 2021-09-27 | 5.1 y | 33.8.0-jre | 2026-11-02 | | `jakarta.inject:jakarta.inject-api` | 2.0.1.MR | compile | 2021-10-16 | 5.1 y | same | | | `xerces:xercesImpl` | 2.12.2 | compile | 2022-01-27 | 4.8 y | same | | | `org.openjdk.jol:jol-core` | 0.17 | compile | 2023-02-27 | 3.7 y | same | | | `com.google.inject:guice` | 7.0.0 | compile | 2023-05-12 | 3.5 y | same | | | `com.github.openjson:openjson` | 1.0.13 | compile | 2023-06-26 | 3.4 y | same | | | `org.opentest4j:opentest4j` | 1.3.0 | compile (transitive) | 2023-07-06 | 3.3 y | same | | | `org.openjdk.jmh:jmh-core` | 1.37 | compile | 2023-08-03 | 3.3 y | same | | | `org.openjdk.jmh:jmh-generator-annprocess` | 1.37 | provided | 2023-08-03 | 3.3 y | same | | | `jakarta.annotation:jakarta.annotation-api` | 3.0.0 | provided | 2024-02-15 | 2.7 y | same | | | `jakarta.el:jakarta.el-api` | 6.0.0 | provided | 2024-02-29 | 2.7 y | 6.0.1 | 2024-07-15 | | `jakarta.websocket:jakarta.websocket-api` | 2.2.0 | provided | 2024-03-28 | 2.6 y | same | | | `jakarta.websocket:jakarta.websocket-client-api` | 2.2.0 | provided | 2024-03-28 | 2.6 y | same | | | `jakarta.servlet.jsp:jakarta.servlet.jsp-api` | 4.0.0 | provided | 2024-05-09 | 2.5 y | same | | | `jakarta.servlet:jakarta.servlet-api` | 6.1.0 | provided | 2024-05-24 | 2.5 y | same | | | `org.hamcrest:hamcrest` | 3.0 | provided | 2024-08-01 | 2.3 y | same | | | `io.github.cdi-unit:cdi-unit` | 5.0.0-EA7 | test | 2024-09-29 | 2.1 y | same | | | `org.apache.velocity:velocity-engine-core` | 2.4.1 | compile | 2024-10-14 | 2.1 y | same | | | `jakarta.validation:jakarta.validation-api` | 3.1.1 | provided | 2025-02-01 | 1.8 y | same | | | `org.assertj:assertj-core` | 3.27.7 | test | 2026-01-24 | 0.8 y | same | | | `org.apache.commons:commons-fileupload2-core` | 2.0.0-M5 | compile (transitive) | 2026-02-08 | 0.7 y | same | | | `org.apache.commons:commons-fileupload2-jakarta-servlet5` | 2.0.0-M5 | compile | 2026-02-08 | 0.7 y | same | | | `commons-io:commons-io` | 2.22.0 | compile | 2026-04-19 | 0.6 y | same | | | `com.fasterxml.jackson.core:jackson-annotations` | 2.22 | compile (transitive) | 2026-05-31 | 0.4 y | 2.23 | 2026-11-07 | | `org.jspecify:jspecify` | 1.0.1 | compile | 2026-07-29 | 0.3 y | same | | | `org.objenesis:objenesis` | 3.6 | compile | 2026-08-02 | 0.3 y | same | | | `org.apache.commons:commons-collections4` | 4.6.0 | compile | 2026-08-06 | 0.3 y | same | | | `org.junit.jupiter:junit-jupiter-api` | 6.1.3 | compile (transitive) | 2026-08-07 | 0.3 y | same | | | `org.junit.jupiter:junit-jupiter-engine` | 6.1.3 | test | 2026-08-07 | 0.3 y | same | | | `org.junit.jupiter:junit-jupiter-params` | 6.1.3 | test | 2026-08-07 | 0.3 y | same | | | `org.junit.platform:junit-platform-commons` | 6.1.3 | compile (transitive) | 2026-08-07 | 0.3 y | same | | | `org.junit.platform:junit-platform-engine` | 6.1.3 | compile (transitive) | 2026-08-07 | 0.3 y | same | | | `org.junit.vintage:junit-vintage-engine` | 6.1.3 | test | 2026-08-07 | 0.3 y | same | | | `org.openrewrite.recipe:rewrite-migrate-java` | 3.42.1 | compile (transitive) | 2026-08-19 | 0.2 y | same | | | `io.dropwizard.metrics:metrics-core` | 4.2.40 | compile | 2026-08-28 | 0.2 y | same | | | `io.dropwizard.metrics:metrics-jmx` | 4.2.40 | compile | 2026-08-28 | 0.2 y | same | | | `org.bouncycastle:bcprov-jdk18on` | 1.86 | compile | 2026-09-11 | 0.2 y | same | | | `jakarta.enterprise:jakarta.enterprise.cdi-api` | 5.0.0 | provided | 2026-09-16 | 0.1 y | same | | | `org.slf4j:jcl-over-slf4j` | 2.0.20 | compile | 2026-09-22 | 0.1 y | same | | | `org.slf4j:slf4j-api` | 2.0.20 | compile | 2026-09-22 | 0.1 y | same | | | `org.slf4j:slf4j-ext` | 2.0.20 | compile | 2026-09-22 | 0.1 y | same | | | `org.slf4j:slf4j-simple` | 2.0.20 | compile | 2026-09-22 | 0.1 y | same | | | `org.mockito:mockito-core` | 5.24.0 | test | 2026-09-23 | 0.1 y | same | | | `org.apache.commons:commons-lang3` | 3.21.0 | compile | 2026-09-25 | 0.1 y | same | | | `org.jboss.weld.module:weld-web` | 7.0.0.Final | compile | 2026-09-25 | 0.1 y | same | | | `org.jboss.weld.se:weld-se-core` | 7.0.0.Final | compile | 2026-09-25 | 0.1 y | same | | | `org.jboss.weld.servlet:weld-servlet-core` | 7.0.0.Final | compile | 2026-09-25 | 0.1 y | same | | | `org.eclipse.jetty:jetty-jmx` | 12.1.14 | test | 2026-10-05 | 0.1 y | same | | | `org.eclipse.jetty:jetty-server` | 12.1.14 | test | 2026-10-05 | 0.1 y | same | | | `org.eclipse.jetty.ee11:jetty-ee11-webapp` | 12.1.14 | test | 2026-10-05 | 0.1 y | same | | | `org.eclipse.jetty.ee11.websocket:jetty-ee11-websocket-jakarta-server` | 12.1.14 | test | 2026-10-05 | 0.1 y | same | | | `org.ow2.asm:asm` | 9.11.1 | compile | 2026-10-17 | 0.1 y | same | | | `org.ow2.asm:asm-commons` | 9.11.1 | compile | 2026-10-17 | 0.1 y | same | | | `org.ow2.asm:asm-util` | 9.11.1 | compile | 2026-10-17 | 0.1 y | same | | | `tools.jackson.core:jackson-core` | 3.2.4 | compile (transitive) | 2026-10-18 | 0.1 y | 3.3.0 | 2026-11-08 | | `tools.jackson.core:jackson-databind` | 3.2.4 | compile | 2026-10-18 | 0.1 y | 3.3.0 | 2026-11-08 | | `io.micrometer:micrometer-commons` | 1.16.8 | compile (transitive) | 2026-10-22 | 0.0 y | 1.17.2 | 2026-10-22 | | `io.micrometer:micrometer-observation` | 1.16.8 | compile (transitive) | 2026-10-22 | 0.0 y | 1.17.2 | 2026-10-22 | | `org.springframework:spring-aop` | 7.0.10 | compile (transitive) | 2026-10-22 | 0.0 y | same | | | `org.springframework:spring-beans` | 7.0.10 | compile (transitive) | 2026-10-22 | 0.0 y | same | | | `org.springframework:spring-context` | 7.0.10 | compile | 2026-10-22 | 0.0 y | same | | | `org.springframework:spring-core` | 7.0.10 | compile | 2026-10-22 | 0.0 y | same | | | `org.springframework:spring-expression` | 7.0.10 | compile (transitive) | 2026-10-22 | 0.0 y | same | | | `org.springframework:spring-test` | 7.0.10 | test | 2026-10-22 | 0.0 y | same | | | `org.springframework:spring-web` | 7.0.10 | compile | 2026-10-22 | 0.0 y | same | | | `org.seleniumhq.selenium:selenium-java` | 4.52.0 | test | 2026-10-29 | 0.0 y | same | | | `net.bytebuddy:byte-buddy` | 1.18.17 | compile | 2026-11-01 | 0.0 y | same | | | `org.hibernate.validator:hibernate-validator` | 9.1.6.Final | test | 2026-11-01 | 0.0 y | same | | | `com.google.errorprone:error_prone_annotations` | 2.52.0 | compile (transitive) | 2026-11-02 | 0.0 y | same | | | `org.aspectj:aspectjrt` | 1.9.27 | compile | 2026-11-04 | 0.0 y | same | | </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
