I feel that I'm cornered with this problem; so I threw a bottle in the sea: https://stackoverflow.com/questions/65302371/playframework-cannot-override-sbt-dependency but my forecast is that I will stay at Jena 3.16 until Play Framework updates its Jackson dependencies .
Or someday I will quit Play Framework in favor of Akka, which is anyway the underlying server of Play Framework. I use very little of Play Framework; my XHTML templates are in plain Scala XML. Jean-Marc Vanel <http://semantic-forms.cc:9112/display?displayuri=http://jmvanel.free.fr/jmv.rdf%23me> +33 (0)6 89 16 29 52 Le lun. 14 déc. 2020 à 19:23, Jean-Marc Vanel <[email protected]> a écrit : > The exclude declarations looked in fact OK, > because the jar for jackson-databind is (like jackson-core) in folder > com.fasterxml.jackson.core , which is being excluded, e.g. in : > > val jenaTextDependency = "org.apache.jena" % "jena-text" % jenaVersion > excludeAll( > ExclusionRule(organization = "*com.fasterxml.jackson.core*" ) , > ExclusionRule(organization = "com.fasterxml.jackson.datatype" ) , > ExclusionRule(organization = "com.fasterxml.jackson.module" ) > > After that I tried a more radical SBT exclusion rule, excluding jackson > transitively through all application modules: > > *excludeDependencies* ++= Seq( > ExclusionRule("com.fasterxml.jackson.core" ), > ExclusionRule(organization = "com.fasterxml.jackson.datatype" ) , > ExclusionRule(organization = "com.fasterxml.jackson.module" ) > ) > > which excludes everything under "com.fasterxml.jackson.*" for all > dependencies : > > https://github.com/jmvanel/semantic_forms/blob/master/scala/project/Common.scala#L20 > > NOTE: the exception is thrown by Akka : akka % akka-serialization-jackson > > [error] com.fasterxml.jackson.databind.JsonMappingException: Scala > module 2.10.4 requires Jackson Databind version >= 2.10.0 and < 2.11.0 > [error] at > com.fasterxml.jackson.module.scala.JacksonModule.setupModule(JacksonModule.scala:61) > [error] at > com.fasterxml.jackson.module.scala.JacksonModule.setupModule$(JacksonModule.scala:46) > [error] at > com.fasterxml.jackson.module.scala.DefaultScalaModule.setupModule(DefaultScalaModule.scala:17) > [error] at > com.fasterxml.jackson.databind.ObjectMapper.registerModule(ObjectMapper.java:819) > [error] at > akka.serialization.jackson.JacksonObjectMapperProvider$.$anonfun$configureObjectMapperModules$4(JacksonObjectMapperProvider.scala:223) > [error] at > akka.serialization.jackson.JacksonObjectMapperProvider$.$anonfun$configureObjectMapperModules$4$adapted(JacksonObjectMapperProvider.scala:222) > [error] at > scala.collection.immutable.List.foreach(List.scala:431) > [error] at akka. > *serialization.jackson.JacksonObjectMapperProvider* > $.configureObjectMapperModules(JacksonObjectMapperProvider.scala:222) > ... > [error] at akka.actor.ActorSystem$.apply(ActorSystem.scala:290) > [error] at play.core.server.*DevServerStart* > $.$anonfun$mainDev$1(DevServerStart.scala:248) > [error] at > play.utils.Threads$.withContextClassLoader(Threads.scala:22) > [error] at > play.core.server.DevServerStart$.mainDev(DevServerStart.scala:76) > > > I guess I will ask to Play community ... > > Jean-Marc Vanel > <http://semantic-forms.cc:9112/display?displayuri=http://jmvanel.free.fr/jmv.rdf%23me> > +33 > (0)6 89 16 29 52 > > > Le lun. 14 déc. 2020 à 15:36, Andy Seaborne <[email protected]> a écrit : > >> >> >> On 14/12/2020 13:12, Jean-Marc Vanel wrote: >> > A found a cleaner way with SBT build engine to exclude all Jackson stuff >> > coming from Jena : >> > >> https://github.com/jmvanel/semantic_forms/blob/2b5bfb31a47376f86cfbb7f2820be1dbeada1a8b/scala/project/Common.scala#L21 >> > >> > But this does not fix the problem "JsonMappingException: Scala module >> > 2.10.4 requires Jackson Databind version >= 2.10.0 and < 2.11.0 " . >> >> databind != datatype >> >> Jena includes: >> com.fasterxml.jackson.core:jackson-core:jar:2.12.0:compile >> com.fasterxml.jackson.core:jackson-databind:jar:2.12.0:compile >> >> > >> > I failed to find other dependencies that would bring Jackson 2.11.3 . >> > So either the SBT exclusion attempt does not work, or there is some >> other >> > dependency bringing Jackson 2.11.3 ( Akka ? ) . >> > >> > Jean-Marc Vanel >> > < >> http://semantic-forms.cc:9112/display?displayuri=http://jmvanel.free.fr/jmv.rdf%23me >> > >> > +33 >> > (0)6 89 16 29 52 >> > >> > >> > Le sam. 12 déc. 2020 à 15:16, Andy Seaborne <[email protected]> a écrit : >> > >> >> >> >> >> >> On 11/12/2020 16:26, Jean-Marc Vanel wrote: >> >>> I use latest Play Framework 2.8.5 with Scala (my project is >> >>> https://github.com/jmvanel/semantic_forms). I try to upgrade my Jena >> >>> dependency from 3.16.0 to 3.17.0 . >> >>> I get this message when running: >> >>> [error] com.fasterxml.jackson.databind.JsonMappingException: *Scala >> >> module >> >>> 2.10.4 requires Jackson Databind version >= 2.10.0 and < 2.11.0.* >> >>> Indeed Jena requires jackson-databind 2.11.3 , while Play is at >> 2.10.4 . >> >> I >> >>> tried to add exclude("com.fasterxml.jackson.core", >> "jackson-databind" ) >> >> in >> >>> build.sbt to all Jena dependencies, but no result :( . >> >> >> >> Try excluding all com.fasterxml.jackson from the Jena dependency >> >> declaration recursively. >> >> >> >> Jena would also get jackson from jsonld-java but excludes it. >> >> >> >> jsonld-java/0.13.2 currently at Jackson 2.11.x >> >> >> >> Jackson had a number of CVEs so taking control of the dependency in >> Jena >> >> meant Jena could release specifying fixed versions. >> >> >> >> Jena should work with 2.10.* For the jsonld-java usage, there wasn't a >> >> breaking change. >> >> >> >> 2.11.* has an architecture change than makes the 2.10.* CVE issues go >> >> away by design. >> >> >> >> 2.12.x isn't a breaking change either for the usage made of it >> >> (according to the test suite). >> >> >> >> Of course, jackson is used by many libraries so it could be picked up >> by >> >> several paths. >> >> >> >> Andy >> >> >> >>> I added on Jena all the exclusions for each jackson dependency , even >> >>> transitive , but problem is still here : >> >>> >> >>> exclude("com.fasterxml.jackson.core", "jackson-core" ) >> >>> exclude("com.fasterxml.jackson.core", "jackson-databind" ) >> >>> exclude("com.fasterxml.jackson.core", "jackson-annotations") >> >>> exclude("com.fasterxml.jackson.datatype", "jackson-datatype" ) >> >>> exclude("com.fasterxml.jackson.datatype", "jackson-datatypejsr310") >> >>> exclude("com.fasterxml.jackson.datatype", "jackson-datatype-jdk8") >> >>> exclude("com.fasterxml.jackson.module", >> "jackson-module-parameter-names") >> >>> exclude("com.fasterxml.jackson.module", "jackson-module-scala") >> >>> exclude("com.fasterxml.jackson.module", "jackson-module-paranamer") >> >>> >> >>> I have verified which artifacts are resolved by the build tool, by >> >>> dependencyTree . >> >>> The Jena requirements of the latest jenaVersion = "3.17.0" is >> >>> :jackson-databind:2.11.3, which brings jackson-annotations and >> >> jackson-core >> >>> . >> >>> >> >>> Running show playDependencyClasspath , I get : >> >>> [info] * Attributed(/home/jmv/.cache/coursier/v1/https/ >> >>> >> >> >> repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.11.3/jackson-core-2.11.3.jar >> >>> ) >> >>> [info] * Attributed(/home/jmv/.cache/coursier/v1/https/ >> >>> >> >> >> repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.11.3/jackson-annotations-2.11.3.jar >> >>> ) >> >>> [info] * Attributed(/home/jmv/.cache/coursier/v1/https/ >> >>> >> >> >> repo1.maven.org/maven2/com/fasterxml/jackson/datatype/jackson-datatype-jdk8/2.10.4/jackson-datatype-jdk8-2.10.4.jar >> >>> ) >> >>> [info] * Attributed(/home/jmv/.cache/coursier/v1/https/ >> >>> >> >> >> repo1.maven.org/maven2/com/fasterxml/jackson/datatype/jackson-datatype-jsr310/2.10.4/jackson-datatype-jsr310-2.10.4.jar >> >>> ) >> >>> [info] * Attributed(/home/jmv/.cache/coursier/v1/https/ >> >>> >> >> >> repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.11.3/jackson-databind-2.11.3.jar >> >>> ) >> >>> >> >>> I hoped to drop the Jackson Jena dependencies, and depend only on >> >>> Jackson 2.10.4 like Play, but that 's not the case... >> >>> >> >>> Jean-Marc Vanel >> >>> < >> >> >> http://semantic-forms.cc:1952/display?displayuri=http://jmvanel.free.fr/jmv.rdf%23me >> >>> >> >>> +33 (0)6 89 16 29 52 >> >>> Twitter: @jmvanel , @jmvanel_fr ; chat: irc:// >> irc.freenode.net#eulergui >> >>> Chroniques jardin >> >>> < >> >> >> http://semantic-forms.cc:1952/history?uri=http%3A%2F%2Fdbpedia.org%2Fresource%2FChronicle >> >>> >> >>> >> >> >> > >> >
