[MNG-6829] Remove commons-lang3 dependency

[jira-importer]

Karl Heinz Marbaise opened MNG-6829 and commented

Currently we use commons-lang3 for the following classes

• StringUtils can be replaced by usage of either plexus-utils or maven-shared-utils or as I tested with self implementation

• SystemUtils is only used in some tests which can simply replaced by using JUnit Jupiter with all the support it has.

• Validate is a precondition class which checks for parameters etc. can be implemented very easily (done already to see how it works). Later this could be made part of maven-shared-utils.

• Currently the StringUtils.substringAfterLast( resourceName, "/" ) is used in ConsoleMavenTransferListener

---

Affects: 3.6.3

Attachments:

• dtPKn.xlsx (37.32 kB)

This issue is a sub-task of MNG-6825

Issue Links:

• MNG-5649 Use Commons Lang's Validate to intercept invalid input

• MNG-6840 Upgrade commons-lang3 to 3.12.0

Remote Links:

• GitHub Pull Request #146
  
• GitHub Pull Request #34
  
• GitHub Pull Request #4
  
• GitHub Pull Request #28
  
• GitHub Pull Request #121
  
• GitHub Pull Request #189
  
• GitHub Pull Request #40
  
• GitHub Pull Request #3
  
• GitHub Pull Request #3
  
• GitHub Pull Request #49
  
• GitHub Pull Request #109
  
• GitHub Pull Request #167
  
• GitHub Pull Request #272
  
• GitHub Pull Request #50
  
• GitHub Pull Request #99
  
• GitHub Pull Request #58
  
• GitHub Pull Request #189
  
• GitHub Pull Request #3
  
• GitHub Pull Request #205
  
• GitHub Pull Request #159
  
• GitHub Pull Request #97
  
• GitHub Pull Request #214
  
• GitHub Pull Request #124
  
• GitHub Pull Request #50
  
• GitHub Pull Request #185
  
• GitHub Pull Request #20
  
• GitHub Pull Request #169
  
• GitHub Pull Request #183
  
• GitHub Pull Request #20
  
• GitHub Pull Request #154
  
• GitHub Pull Request #641
  
• GitHub Pull Request #79
  
• GitHub Pull Request #90
  
• GitHub Pull Request #1104
  

Backported to: 4.0.0-alpha-7

0 votes, 8 watchers

[jira-importer]

Rostislav Krasny commented

Elliotte Rusty Harold has found a problematic code that currently could be fixed by using StringEscapeUtils.escapeXml10() from commons-lang3
Read his comment here: #303 (comment)

That problematic code exists in:

• org.apache.maven.toolchain.building.DefaultToolchainsBuilder
• org.apache.maven.settings.building.DefaultSettingsBuilder

However the StringEscapeUtils in commons-lang3 is deprecated and the same class in commons-text is recommended to use instead.
But if you remove the commons-lang3 you probably won't agree to add the commons-text as a new dependency. Right?

Then a code like following PoC (that uses only the standard Java API) could be used to escape special XML characters by XML entities:

        XMLOutputFactory xmlOutputFactory = XMLOutputFactory.newInstance();

        StringWriter stringWriter = new StringWriter();
        try {
            XMLStreamWriter xmlStreamWriter = xmlOutputFactory.createXMLStreamWriter(stringWriter);
            xmlStreamWriter.writeCharacters("a<bc>d&ff");
        } catch (XMLStreamException e) {
            e.printStackTrace();
        }

        System.out.println(stringWriter.toString());

What do you think about adding a static escapeXml() method with a code like that into some utility class and what utility class would you recommend?

[jira-importer]

Elliotte Rusty Harold commented

IMHO plexus-utils and maven-shared-utils are not as well maintained or reliable as commons-lang. I'd pick commons-lang over either of those, given a choice.

[jira-importer]

Michael Osipov commented

Agree with Elliotte Rusty Harold, I have also said that I would deprecate in P-U and M-S-U which is available in C-L.

[jira-importer]

Sylwester Lachiewicz commented

i belive this one should be closed as we have not reverse direction

[jira-importer]

Tim te Beek commented

I'm working on a replacement recipe for StringUtils.isEmpty / isNotEmpty:
openrewrite/rewrite-migrate-java#209
We look to have 1122 such method calls in Apache Maven repositories.
My recipe won't yet replace all of them, but a good portion can be simplified.

Also see the excel file added to this issue: [^dtPKn.xlsx]
That's created through running the following on Apache Maven repositories through: https://public.moderne.io/recipes/builder

type: specs.openrewrite.org/v1beta/recipe
name: com.github.timtebeek.maven.rewrite.Find
displayName: Find
description: Find
recipeList:
  - org.openrewrite.java.search.FindMethods:
      methodPattern: "*..StringUtils isEmpty(..)"
  - org.openrewrite.java.search.FindMethods:
      methodPattern: "*..StringUtils isNotEmpty(..)"

Seeing how https://issues.apache.org/jira/browse/MNG-6825 is already closed,
I could use this issue code for those replacements if we keep it open just a bit longer.

[jira-importer]

Elliotte Rusty Harold commented

That link goes to a login page. It would be better not to require a login there but that's not a blocker for PRs. Feel free to send more.

[jira-importer]

Elliotte Rusty Harold commented

There is no official minutes for recording agreements, mailing list, Jira, or otherwise. Every dev and committer seems to have a slightly different and conflicting picture of what is and is not required for what. The best way to avoid complaining about the lack of Jira is not to complain about the lack of a Jira. Other than that, devs should use reasonable judgment.

[jira-importer]

Michael Osipov commented

Tamas Cservenak, isn't this solved?