Skip to content

Commit f5ac9ef

Browse files
mstahvvaadin-bot
mstahv
authored and
vaadin-bot
committed
fix: do not leak internally used dependencies to actual apps, not even as optionals (#23011)
Uses shade plugin to pull in some transitive dependencies to internal "flow-build-util" module. Although they are not ending up to the actual production artifact, they lower the DX as in IDE it may appear one has them evailable. Fixes #23007
1 parent 5b9304e commit f5ac9ef

File tree

14 files changed

+161
-4
lines changed

14 files changed

+161
-4
lines changed

‎flow-build-tools/pom.xml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@
1010
<packaging>jar</packaging>
1111
<name>Flow Frontend Build Tools</name>
1212
<description>A module to handle frontend build tools common to the plugins and dev server</description>
13+
<properties>
14+
<!-- It appears that sonar does not like shade plugin -->
15+
<sonar.skip>true</sonar.skip>
16+
</properties>
1317

1418
<dependencies>
1519

@@ -38,4 +42,97 @@
3842

3943
</dependencies>
4044

45+
<build>
46+
<plugins>
47+
<plugin>
48+
<groupId>org.apache.maven.plugins</groupId>
49+
<artifactId>maven-shade-plugin</artifactId>
50+
<version>3.6.1</version>
51+
<executions>
52+
<execution>
53+
<goals>
54+
<goal>shade</goal>
55+
</goals>
56+
<phase>package</phase>
57+
<configuration>
58+
<shadedArtifactAttached>true</shadedArtifactAttached>
59+
<shadedClassifierName>shaded</shadedClassifierName>
60+
<createDependencyReducedPom>true</createDependencyReducedPom>
61+
<dependencyReducedPomLocation>${project.build.directory}/dependency-reduced-pom.xml</dependencyReducedPomLocation>
62+
<artifactSet>
63+
<includes>
64+
<include>org.apache.commons:commons-compress</include>
65+
<include>commons-io:commons-io</include>
66+
<include>commons-codec:commons-codec</include>
67+
<include>org.apache.commons:commons-lang3</include>
68+
</includes>
69+
</artifactSet>
70+
<relocations>
71+
<relocation>
72+
<pattern>org.apache.commons.compress</pattern>
73+
<shadedPattern>com.vaadin.frontendtools.internal.commons.compress</shadedPattern>
74+
</relocation>
75+
<relocation>
76+
<pattern>org.apache.commons.io</pattern>
77+
<shadedPattern>com.vaadin.frontendtools.internal.commons.io</shadedPattern>
78+
</relocation>
79+
<relocation>
80+
<pattern>org.apache.commons.codec</pattern>
81+
<shadedPattern>com.vaadin.frontendtools.internal.commons.codec</shadedPattern>
82+
</relocation>
83+
<relocation>
84+
<pattern>org.apache.commons.lang3</pattern>
85+
<shadedPattern>com.vaadin.frontendtools.internal.commons.lang3</shadedPattern>
86+
</relocation>
87+
</relocations>
88+
<filters>
89+
<filter>
90+
<artifact>*:*</artifact>
91+
<excludes>
92+
<!-- Security signatures -->
93+
<exclude>META-INF/*.SF</exclude>
94+
<exclude>META-INF/*.DSA</exclude>
95+
<exclude>META-INF/*.RSA</exclude>
96+
<exclude>META-INF/SIG-*</exclude>
97+
<!-- Duplicate licenses -->
98+
<exclude>META-INF/LICENSE*</exclude>
99+
<exclude>META-INF/NOTICE*</exclude>
100+
<exclude>META-INF/DEPENDENCIES</exclude>
101+
<!-- Module info -->
102+
<exclude>module-info.class</exclude>
103+
<!-- Multi-Release JAR files -->
104+
<exclude>META-INF/versions/**</exclude>
105+
<!-- GraalVM native-image configs (reference unshaded class names) -->
106+
<exclude>META-INF/native-image/**</exclude>
107+
<!-- Dependency Maven metadata -->
108+
<exclude>META-INF/maven/**</exclude>
109+
</excludes>
110+
</filter>
111+
<filter>
112+
<!-- Exclude compressors with optional dependencies we don't need -->
113+
<artifact>org.apache.commons:commons-compress</artifact>
114+
<excludes>
115+
<exclude>org/apache/commons/compress/compressors/xz/**</exclude>
116+
<exclude>org/apache/commons/compress/compressors/lzma/**</exclude>
117+
<exclude>org/apache/commons/compress/compressors/brotli/**</exclude>
118+
<exclude>org/apache/commons/compress/compressors/zstandard/**</exclude>
119+
<exclude>org/apache/commons/compress/compressors/snappy/**</exclude>
120+
<exclude>org/apache/commons/compress/compressors/lz4/**</exclude>
121+
<exclude>org/apache/commons/compress/archivers/sevenz/**</exclude>
122+
</excludes>
123+
</filter>
124+
</filters>
125+
<transformers>
126+
<!-- Merge SPI service files -->
127+
<transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
128+
<!-- Handle Apache license files -->
129+
<transformer implementation="org.apache.maven.plugins.shade.resource.ApacheLicenseResourceTransformer"/>
130+
</transformers>
131+
</configuration>
132+
</execution>
133+
</executions>
134+
</plugin>
135+
</plugins>
136+
</build>
137+
41138
</project>

‎flow-client/pom.xml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,17 @@
169169
<scope>test</scope>
170170
</dependency>
171171

172+
<dependency>
173+
<groupId>commons-io</groupId>
174+
<artifactId>commons-io</artifactId>
175+
<scope>test</scope>
176+
</dependency>
177+
<dependency>
178+
<groupId>org.apache.commons</groupId>
179+
<artifactId>commons-lang3</artifactId>
180+
<scope>test</scope>
181+
</dependency>
182+
172183
</dependencies>
173184

174185
<build>

‎flow-data/pom.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,11 @@
4242
<scope>provided</scope>
4343
</dependency>
4444

45+
<dependency>
46+
<groupId>commons-io</groupId>
47+
<artifactId>commons-io</artifactId>
48+
<scope>test</scope>
49+
</dependency>
4550
<dependency>
4651
<groupId>org.apache.commons</groupId>
4752
<artifactId>commons-lang3</artifactId>

‎flow-plugins/flow-plugin-base/pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
<groupId>com.vaadin</groupId>
2424
<artifactId>flow-build-tools</artifactId>
2525
<version>${project.version}</version>
26+
<classifier>shaded</classifier>
2627
</dependency>
2728
<dependency>
2829
<groupId>com.vaadin</groupId>

‎flow-server/pom.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
<groupId>com.vaadin</groupId>
2020
<artifactId>flow-build-tools</artifactId>
2121
<version>${project.version}</version>
22+
<classifier>shaded</classifier>
2223
<!-- Note, ideally vaadin-server should not depend this module at all
2324
and development time tooling shared with plugins should end up here.
2425
Temporarily build this way so that commons-compress can be ditched
@@ -91,6 +92,12 @@
9192
<artifactId>commons-io</artifactId>
9293
<scope>test</scope>
9394
</dependency>
95+
<dependency>
96+
<groupId>org.apache.commons</groupId>
97+
<artifactId>commons-compress</artifactId>
98+
<version>1.28.0</version>
99+
<scope>test</scope>
100+
</dependency>
94101
<dependency>
95102
<groupId>tools.jackson.core</groupId>
96103
<artifactId>jackson-core</artifactId>

‎flow-server/src/test/java/com/vaadin/flow/server/startup/ServletContainerInitializerTest.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,9 @@ && isBadSubType(clazz)) {
149149

150150
private Stream<String> getExcludedPatterns() {
151151
return Stream.of("com\\.vaadin\\.flow\\..*osgi\\..*",
152-
"com\\.vaadin\\.flow\\.server\\.startup\\.LookupInitializer\\$OsgiLookupImpl");
152+
"com\\.vaadin\\.flow\\.server\\.startup\\.LookupInitializer\\$OsgiLookupImpl",
153+
// Shaded third-party libraries
154+
"com\\.vaadin\\.frontendtools\\.internal\\..*");
153155
}
154156

155157
private boolean isBadSubType(Class<?> clazz) {

‎flow-test-generic/src/main/java/com/vaadin/flow/testutil/ClassesSerializableTest.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@ public abstract class ClassesSerializableTest extends ClassFinder {
6060
@SuppressWarnings("WeakerAccess")
6161
protected Stream<String> getExcludedPatterns() {
6262
return Stream.of(
63+
// Shaded third-party libraries
64+
"com\\.vaadin\\.frontendtools\\.internal\\..*",
6365
"com\\.vaadin\\.frontendtools\\.installer\\.DefaultArchiveExtractor",
6466
"com\\.vaadin\\.frontendtools\\.installer\\.ArchiveExtractor",
6567
"com\\.vaadin\\.flow\\.data\\.validator\\.BeanValidator\\$LazyFactoryInitializer",

‎flow-tests/pom.xml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,16 @@
8080
<version>${project.version}</version>
8181
<scope>test</scope>
8282
</dependency>
83+
<dependency>
84+
<groupId>commons-io</groupId>
85+
<artifactId>commons-io</artifactId>
86+
<scope>test</scope>
87+
</dependency>
88+
<dependency>
89+
<groupId>org.apache.commons</groupId>
90+
<artifactId>commons-lang3</artifactId>
91+
<scope>test</scope>
92+
</dependency>
8393
<dependency>
8494
<groupId>org.slf4j</groupId>
8595
<artifactId>slf4j-simple</artifactId>

‎flow-tests/test-live-reload/pom.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@
4141
<artifactId>flow-test-lumo</artifactId>
4242
<version>${project.version}</version>
4343
</dependency>
44+
<dependency>
45+
<groupId>commons-io</groupId>
46+
<artifactId>commons-io</artifactId>
47+
</dependency>
4448
</dependencies>
4549

4650
<build>

‎flow-tests/test-root-context/pom.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,10 @@
5454
<version>${project.version}</version>
5555
</dependency>
5656

57+
<dependency>
58+
<groupId>commons-io</groupId>
59+
<artifactId>commons-io</artifactId>
60+
</dependency>
5761
<dependency>
5862
<groupId>org.apache.commons</groupId>
5963
<artifactId>commons-lang3</artifactId>

0 commit comments

Comments
 (0)