shashank created CAMEL-25686:
--------------------------------
Summary: parent - import org.ow2.asm:asm-bom so that asm-commons,
asm-tree, asm-util and asm-analysis follow asm-version like asm (today
camel-web3j, camel-cassandraql and camel-drill resolve them at 5.0.3 / 9.2 /
9.5 next to asm 9.10.1)
Key: CAMEL-25686
URL: https://issues.apache.org/jira/browse/CAMEL-25686
Project: Camel
Issue Type: Task
Reporter: shashank
Assignee: shashank
{{parent/pom.xml}} manages only {{org.ow2.asm:asm}} at {{asm-version}}
(9.10.1). The other ASM artifacts are not managed, so they keep the version of
the library that brings them, while {{asm}} is moved to {{asm-version}}. In the
review of the camel-wasm PR #27793 (CAMEL-25606) importing
{{org.ow2.asm:asm-bom}} in {{parent/pom.xml}} was suggested as a follow-up,
because a later change of {{asm-version}} would move only {{asm}} and leave the
four others of the Endive compiler behind.
The mix is already there today. {{mvn dependency:tree -Dincludes=org.ow2.asm}}
over the build on main (cd2ce899764e; all modules except
{{tests/test-bundles}}, which did not resolve offline; {{tests/camel-itest}}
and {{tests/camel-streamcaching-test}} checked separately, only {{asm}} itself):
||module||path||asm||asm-commons / asm-tree / asm-util / asm-analysis||
|camel-web3j|web3j core 5.0.0 > jnr-unixsocket 0.21 > jnr-ffi
2.1.9|9.10.1|5.0.3|
|camel-test-infra-cassandra (and camel-test-infra-all, where asm-commons is
already 9.10.1)|testcontainers-cassandra > cassandra-driver-core 3.10.0 >
jnr-ffi 2.1.7|9.10.1|5.0.3|
|camel-cassandraql|java-driver-core 4.19.3 > jnr-posix 3.1.15 > jnr-ffi
2.2.11|9.10.1|9.2|
|camel-drill|drill-jdbc 1.22.0 > drill-java-exec|9.10.1|9.5|
|camel-wasm, camel-opa|Endive compiler 1.1.0 / 1.0.0|9.10.1|9.10.1 (from
Endive's own import of asm-bom 9.10.1)|
With {{-Dasm-version=9.9.1}} (a stand-in for a future change of the property)
camel-wasm and camel-opa get {{asm}} 9.9.1 and the four others at 9.10.1.
h3. Change
Replace the managed {{asm}} entry with an import of {{org.ow2.asm:asm-bom}} at
{{asm-version}} ({{<type>pom</type>}}, {{<scope>import</scope>}}, as the parent
already imports the junit, netty and jackson boms). After the change the same
full-build {{dependency:tree}} shows every ASM artifact at 9.10.1 in every
module, and with {{-Dasm-version=9.9.1}} all five follow the property. No other
module manages an ASM artifact ({{camel-package-maven-plugin}} already declares
{{asm-tree}} with {{asm-version}}). The only resolved versions that change are
the four artifacts in the modules of the table (5.0.3 / 9.2 / 9.5 to 9.10.1).
Tests with the change: camel-wasm 133, camel-opa 112, camel-web3j 132 (67
skipped), camel-cassandraql 8, camel-drill 7 (1 skipped),
camel-test-infra-cassandra built; 0 failures. Not run: the integration tests of
camel-cassandraql and camel-drill (containers), and nothing in these suites
exercises jnr-ffi's generated code, so the newer ASM under jnr-ffi is checked
by resolution only (today jnr-ffi already runs with {{asm}} 9.10.1 next to its
older companions).
How it was found: following up the review comment on PR #27793; the full-build
dependency tree then showed the existing mismatches.
Affected: main. camel-4.23.x has the same single managed {{asm}} entry;
camel-4.22.x and camel-4.18.x do not manage ASM in {{parent/pom.xml}} (read,
not run). As a build alignment this is for main only.
Duplicate check (2026-10-15): JIRA text "asm-bom" (CAMEL-24939, which added the
managed {{asm}} entry; nothing about the bom), "asm-commons" (old OSGi/Karaf
tickets only); GitHub pull requests "asm-bom" (only #27793 itself and unrelated
dependabot bumps).
_Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
