Restricted native access to java.lang.System

[namannigam]

While using the following

Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937)
Maven home: /opt/homebrew/Cellar/maven/3.9.9/libexec
Java version: 24-ea, vendor: Oracle Corporation, runtime: /Library/Java/JavaVirtualMachines/jdk-24.jdk/Contents/Home
Default locale: en_IN, platform encoding: UTF-8
OS name: "mac os x", version: "15.3.1", arch: "aarch64", family: "mac"

and performing a build on any of my Java projects, I get the WARNING shared below.

WARNING: A restricted method in java.lang.System has been called
WARNING: java.lang.System::load has been called by org.fusesource.jansi.internal.JansiLoader in an unnamed module (file:/opt/homebrew/Cellar/maven/3.9.9/libexec/lib/jansi-2.4.1.jar)
WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
WARNING: Restricted methods will be blocked in a future release unless native access is enabled

Though the way to ignore this is already suggested, registering this issue to look towards a long term resolution.

[garretwilson]

This does appear in Maven 3.9.9, but not Maven 3.9.10. Maybe Maven stopped using the library.

However this is a problem for any application that uses this library, such as my own globalmentor-application library. Upgrading to Java 21 means that all CLIs using my application library now show the above warning.

Fiddling with the logging to hide the warnings not a solution. Java 25 LTS is coming out soon, and I don't know if this method call will even be allowed then.

[garretwilson]

If we are forced to have a native access flag, then at least Jansi needs to be moved to its own module so that the security attack/vulnerability surface can be minimized, rather than allowing "all unnamed modules".

[cowwoc]

I agree with @garretwilson. This needs to be moved into its own module.

@garretwilson Maven still depends on JAnsi but they temporarily worked around the problem by granting access to "all unnamed modules".

[garretwilson]

I was about to consider the feasibility of contributing the modularization work, but I just noticed that the release notes for v2.4.2 indicate this library has moved to org.jline:jansi. However there is little other information. Is org.jline:jansi a drop-in replacement? What is the repository for org.jline:jansi? Should tickets like this be moved to that other repository? Should we discuss modularization in the context of this new library? etc.

[metametadata]

What is the repository for org.jline:jansi?

I guess this is the maintained project: https://github.com/jline/jline3.
Jansi source: https://github.com/jline/jline3/tree/master/jansi-core/src/main/java/org/jline/jansi.

There also seems to be a similar issue jline/jline3#1067.