Dependencies requiring attention

[copierrj]

We've a couple of dependencies that require our attention:

• de.odysseus.staxon:staxon (dead project, only used by deegree-services-csw)
• org.jboss.weld.servlet:weld-servlet-shaded (used in deegree-jsf-core, reevaluate usage of shaded jar)
• commons-collections:commons-collections (pulled in as transitive dependency, replaced by commons-collections:commons-collections4 which is also used by deegree) (Replace commons-collections #1891)
• javax.cache:cache-api (outdated version, transitive dependency of org.ehcache:ehcache, currently unmanaged)
• org.apache.ws.commons.axiom:* (Get rid of Axiom  #770)
• io.airlift:aircompressor (outdated version, transitive dependency of org.deegree:imageio-ext-geocore)

[tfr42]

The usage of org.jboss.weld.servlet:weld-servlet-shaded has the advantage that it is one JAR with all its dependencies so that CDI with JSF works. The disadvantage is that we may not see that transitive dependencies interfere with the deegree webapp dependencies. So we shall move to org.jboss.weld.servlet:weld-servlet-core.

[stephanr]

Looking at the POM we are currently using, there are some more dependencies defined; see [1].

• [1] https://repo1.maven.org/maven2/org/jboss/weld/servlet/weld-servlet-shaded/5.1.6.Final/weld-servlet-shaded-5.1.6.Final.pom

[tfr42]

PR #1923 fixes the Weld dependency issue by switching to the plain dependency of weld.