MLE-24504 Bumped Jakarta and removed javax.ws

The javax.ws.rs-api dependency was only needed for a collection class that wasn't needed.

Also forcing the usage of commons-lang3 as Black Duck mysteriously thinks an instance of 3.7 is being brought in as a direct dependency somehow.

Author: rjrudin

.copyrightconfig

@@ -11,4 +11,4 @@ startyear: 2010
 #   - Dotfiles already skipped automatically
 # Enable by removing the leading '# ' from the next line and editing values.
 # filesexcluded: third_party/*, docs/generated/*.md, assets/*.png, scripts/temp_*.py, vendor/lib.js
-filesexcluded: .github/*, README.md, Jenkinsfile, gradle/*, docker-compose.yml, *.gradle, gradle.properties, gradlew, gradlew.bat, **/test/resources/**, *.md
+filesexcluded: .github/*, README.md, Jenkinsfile, gradle/*, docker-compose.yml, *.gradle, gradle.properties, gradlew, gradlew.bat, **/test/resources/**, *.md, pom.xml

.gitignore

@@ -40,3 +40,5 @@ ml-development-tools/src/test/java/com/marklogic/client/test/dbfunction/generate
 docker/
 
 .kotlin
+
+dep.txt

build.gradle

@@ -31,6 +31,13 @@ subprojects {
 
 	configurations {
 		testImplementation.extendsFrom compileOnly
+
+		all {
+			resolutionStrategy {
+				// Forcing the latest commons-lang3 version to eliminate CVEs.
+				force "org.apache.commons:commons-lang3:3.19.0"
+			}
+		}
 	}
 
 	repositories {

examples/build.gradle

@@ -6,6 +6,7 @@ plugins {
 
 dependencies {
 	implementation project(':marklogic-client-api')
+	implementation "jakarta.xml.bind:jakarta.xml.bind-api:4.0.4"
 
 	// The 'api' configuration is used so that the test configuration in marklogic-client-api doesn't have to declare
 	// all of these dependencies. This library project won't otherwise be depended on by anything else as it's not

marklogic-client-api/build.gradle

@@ -12,11 +12,12 @@ group = 'com.marklogic'
 description = "The official MarkLogic Java client API."
 
 dependencies {
-	// With 7.0.0, now using the Jakarta JAXB APIs instead of the JAVAX JAXB APIs that were bundled in Java 8.
-	// To ease support for Java 8, we are depending on version 3.x of the Jakarta JAXB APIs as those only require Java 8,
-	// whereas the 4.x version requires Java 11 or higher.
-	api "jakarta.xml.bind:jakarta.xml.bind-api:3.0.1"
-	implementation "org.glassfish.jaxb:jaxb-runtime:3.0.2"
+	// Using the latest version now that the 8.0.0 release requires Java 17.
+	// This is now an implementation dependency as opposed to an api dependency in 7.x and earlier.
+	// The only time it appears in the public API is when a user uses JAXBHandle.
+	// But in that scenario, the user would already be using JAXB in their application.
+	implementation "jakarta.xml.bind:jakarta.xml.bind-api:4.0.4"
+	implementation "org.glassfish.jaxb:jaxb-runtime:4.0.6"
 
 	implementation "com.squareup.okhttp3:okhttp:${okhttpVersion}"
 	implementation "com.squareup.okhttp3:logging-interceptor:${okhttpVersion}"
@@ -27,9 +28,10 @@ dependencies {
 	// take 50s instead of 2 to 3s. Haven't dug into the details, but seems like the call isn't lazy and the entire set
 	// of URIs is being retrieved. This implementation - in the old "com.sun.mail" package but still adhering to the new
 	// jakarta.mail API - works fine and performs well for eval calls.
+	// As of the 8.0.0 release - this still is a good solution, particularly as com.sun.mail:jakarta.mail received a
+	// recent patch release and is therefore still being maintained.
 	implementation "com.sun.mail:jakarta.mail:2.0.2"
 
-	implementation 'javax.ws.rs:javax.ws.rs-api:2.1.1'
 	implementation 'org.slf4j:slf4j-api:2.0.17'
 	implementation "com.fasterxml.jackson.core:jackson-databind:${jacksonVersion}"
 	implementation "com.fasterxml.jackson.dataformat:jackson-dataformat-csv:${jacksonVersion}"

marklogic-client-api/src/main/java/com/marklogic/client/impl/RequestParametersImplementation.java

@@ -3,22 +3,24 @@
  */
 package com.marklogic.client.impl;
 
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
-
-import javax.ws.rs.core.AbstractMultivaluedMap;
-import javax.ws.rs.core.MultivaluedMap;
 
 public abstract class RequestParametersImplementation {
-  private MultivaluedMap<String, String> map =
-    new AbstractMultivaluedMap<String,String>(new ConcurrentHashMap<>()) {};
 
-  protected RequestParametersImplementation() {
-    super();
-  }
+	// Prior to 8.0.0, this was a threadsafe map. However, that fact was not documented for a user. And in practice,
+	// it would not make sense for multiple threads to share a mutable instance of this, or of one of its subclasses.
+	// Additionally, the impl was from the 'javax.ws.rs:javax.ws.rs-api:2.1.1' dependency which wasn't used for
+	// anything else. So for 8.0.0, this is now simply a map that matches the intended usage of this class and its
+	// subclasses, which is to be used by a single thread.
+	private final Map<String, List<String>> map = new HashMap<>();
+
+	protected RequestParametersImplementation() {
+		super();
+	}
 
-  protected Map<String,List<String>> getMap() {
-    return map;
-  }
+	protected Map<String, List<String>> getMap() {
+		return map;
+	}
 }