On Wed, Feb 1, 2023 at 2:27 AM Rony G. Flatscher (Apache) <r...@apache.org> wrote:
> On 01.02.2023 09:49, sebb wrote: > > On Wed, 1 Feb 2023 at 00:22, Alex O'Ree <alexo...@apache.org> wrote: > >> No problem. There was some activity on github. > > Please note: That does not mean the component is being developed. > > Dependabot runs on most components, and that generates traffic. > > Also there may need to be changes to asf.yaml which affect all > > components on github. > > Etc. This is no indication that the component is being actively > > maintained, as such changes need very little (if any) knowledge of the > > component. > > Well, I have been interesting in keeping BSF up and going. > > >> I ran the owasp dependency > >> check thing against it and found a few issues, attempted to update some > of > >> the dependencies (jython) and hit a bit of a snag. I'm not entirely sure > >> where to go from here. I'm not sure if anyone else has attempted this or > >> not. > > Note that the component has a separate 3.x version, which is based on > > JSR-223 - see https://commons.apache.org/proper/commons-bsf/ > > > > I’m not entirely sure that either are still needed. > > BSF 3.0, the open-source implementation JSR-223 (package javax.script) may > not be needed anymore > with OpenJDK containing it. > > My 2 cents as someone who spent the last decade at my day job on a JSR-223 implementation for running JavaScript in a Java Class ... The OpenJDK implementation, Rhino, has performance that is awful. That may be fine for smaller scripts. The performance however is a show stopper for us as the scripts are enormous. A couple years ago after using J2V8 - they only support Android now - we moved to the Javet project that is Apache licensed. On a scale of 1/10 I give it a 10. They do an impressive release about once a month lately and most importantly they ship with the latest V8 which is important for us. If you need something else besides JS though I have no idea.
