Payara 6: Move all dependencies to stable jakartified versions

[poikilotherm]

• SWORD2 lib needs a release and no snapshot
• XOAI lib needs a release and no snapshot
• Rewrite? (Is Alpha1. See also EE10 Compatible Release ocpsoft/rewrite#345 and Error Handling: 404 page thrown as a result of trying to load missing/incorrect Dataverse results in large stack trace but otherwise functions. #9770
• Titanium JSON-LD
• Primefaces
• Check mvn dependency:tree for any leftovers of Java EE in transitional dependencies to avoid surprises
• Check if Duracloud reportdata XML binds are problematic
• Check if Google Cloud Storage annotations usage is problematic
• Check upgrading to SLF4J 2.0. There was an issue with Payara 6 before. @ErykKul saw problems, too, he mentioned payara#5989 (which was autoclosed) in Payara 6 testing #9426

[poikilotherm]

Looking at the dependency tree, there are two potentially broken javax dependencies:

1. Duracloud reportdata uses XML binding (javax.xml.bind)
2. Google Cloud Storage uses javax.annotations

@qqmyers are these code paths used by us? Can we test for those?

[qqmyers]

Those are both in archivers. Duracloud is used by Texas and could probably be tested with them. The Google archiver is used by QDR and could be tested with them or by anyone with a Google account. FWIW, QDR already uses different google dependencies than the main branch - it might be a good quick test to upgrade to those and see if the javax issues are still in what's pulled in.

[cmbz]

Action:

• Split this issue into several issues and size each
• Team uses issues as learning opportunity, consulting with @qqmyers and @poikilotherm as needed to make progress and ensure that other stakeholders are not unduly affected by changes
• Contact @poikilotherm to confirm sizing for each issue

[pdurbin]

Specifically we talked about taking these two items...

• SWORD2 lib needs a release and no snapshot
• XOAI lib needs a release and no snapshot

... and creating an issue to document in the dev guide how to release these to Maven Central. It would be a learning opportunity for someone (or someones) on the team. We'll need the password, of course.

[pdurbin]

I created a number of sub issues:

• non-SNAPSHOT release of Sword library 2.0.0 #9801
• release XOAI library 5.1.0 #9802
• encourage Rewrite library to release a non-snapshot of 6.0.0 #9804
• move from local_lib handle-8.1.1.jar to Maven Central version 9.x #9805
• move from local_lib titanium-json-ld-1.3.0-SNAPSHOT to Maven Central #9807
• move from local_lib fits-2012-10-25-generated.jar to Maven Central #9808
• move from local_lib UNF jars to Maven Central or GitHub Packages #9810

Closing.

[poikilotherm]

FWIW: I looked into the potential SFL4J thing. It doesn't seem to be an issue anymore! So I never created an issue for it.