[Regression] commons-configuration2 is pulled in as a required dependency about shiro HOT 12 CLOSED

May be just adding the dependency in optional scope will be enough

from shiro.

I am not certain this is a bug. I believe the code started as optional, but later became required, but the optionality was not removed from the code.
IMHO it would be too much of a risk to make it optional at this time, because it would mysteriously break functionality existing applications currently rely on and require inclusions of explicit additional dependency for existing applications.

Perhaps the "action item" is to remove the above reflection / if statement from the code itself?

from shiro.

Maybe someone else can chime in?

from shiro.

I think this is a bug, I will go deeper.

It's well optional on config-ogdl:

But not in core:

from shiro.

Maybe not a bug but a code smell? Perhaps the required dependency should be moved into ogdl and removed from core but net effect wouldn't change

from shiro.

@lprimak the problem was introduced in this commit:
5755721

Can you explain why adding a provided dependency because of compiler warning?

from shiro.

I remember... it's an OSGi warning from the bnd plugin

from shiro.

I will try a PR to fix it then... thanks for your research @fpapon

from shiro.

The warning from the bnd plugin comes from these lines:

I will make some test in Karaf to see why we need them. I think we don't need to add these import package because we are not using them.

from shiro.

No need. Making it optional in core worked and there is no warning

from shiro.

@papegaaij Thank you for the report! This snuck in during build / code cleanup

from shiro.

No problem. I just happen to notice it because commons-configuration2 triggered a failure due to its dependency on a javax API. Thanks for fixing this!

from shiro.