slachiewicz opened a new issue, #13207: URL: https://github.com/apache/maven/issues/13207
Tracking issue for retiring BeanShell across the Maven estate: deprecate it now, migrate what we own, remove it in the next majors. ## Why - The `bsh` artifact we ship is dead on Central: `org.apache-extras.beanshell:bsh` last published 2.0b6 on 2016-02-05 (the CVE-2016-2510 fix). The GitHub project released 2.1.1 in 2022 but never to Central; nothing since. - Every use we have is a test-script or expression language for which Groovy is already the second engine in the same component, and the newer ITs are written in Groovy. - `maven-plugin-tools` already dropped BeanShell mojos for 4.0.0 (MPLUGIN-525). - Both interpreters redirect the JVM-global `System.out`/`System.err` and serialize all script runs behind a static lock (apache/maven-script-interpreter#205); fixing that for one engine is cheaper than for two. ## Where BeanShell is used | Component | Use | Notes | |---|---|---| | [maven-script-interpreter](https://github.com/apache/maven-script-interpreter) | `BeanShellScriptInterpreter`, registered as `bsh` next to `groovy` | Also the fallback for any unrecognised script extension (`ScriptRunner`) | | [maven-invoker-plugin](https://github.com/apache/maven-invoker-plugin) | `setup`/`prebuild`/`postbuild`/`selector` scripts | Through maven-script-interpreter | | [maven-archetype-plugin](https://github.com/apache/maven-archetype) | `archetype:integration-test` verify scripts | Through maven-script-interpreter | | [maven-enforcer](https://github.com/apache/maven-enforcer) | `evaluateBeanshell` rule, direct `bsh` dependency | The only place where BeanShell is user-facing syntax; 212 `pom.xml` on GitHub use the rule | | [maven-plugin-tools](https://github.com/apache/maven-plugin-tools) 3.x | `maven-script-beanshell`, `maven-plugin-tools-beanshell` | Gone on master (MPLUGIN-525); ends with the 3.x line | | Our own ITs | 549 `.bsh` scripts in the 3.x plugin lines (444 `verify.bsh`, 70 `setup.bsh`) against 1 009 `.groovy` | Largest holders: assembly 107, invoker 79, install 47, dependency 44, shade 36, javadoc 28, war 24, deploy 22, site 21, clean 16 | Outside the estate, GitHub code search finds 1 628 `src/it/**/verify.bsh` against 3 240 `verify.groovy`. ## Plan - [ ] **Deprecate now** in maven-invoker-plugin and maven-archetype-plugin: docs and parameter javadoc say BeanShell scripts are deprecated, port to Groovy. - [ ] maven-script-interpreter 1.10: `@Deprecated` on `BeanShellScriptInterpreter`; a warning when `bsh` is selected explicitly or through the unknown-extension fallback; note on the site. - [ ] maven-enforcer: deprecate `evaluateBeanshell`. Decide whether a Groovy-backed replacement rule is wanted before removal; otherwise this rule keeps `bsh` the longest. - [ ] Migrate our ITs: `.bsh` → `.groovy`, one PR per repo, `git mv` first so the diff reads as a rename. Start with the ten repos above. - [ ] Remove: maven-script-interpreter 2.0 drops `bsh`, the fallback becomes an error; maven-invoker-plugin and maven-archetype-plugin follow on their next minor after that. PRs and per-repo issues link back here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
