[
https://issues.apache.org/jira/browse/CAMEL-25686?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-25686 started by shashank.
----------------------------------------
> parent - import org.ow2.asm:asm-bom so that asm-commons, asm-tree, asm-util
> and asm-analysis follow asm-version like asm (today camel-web3j,
> camel-cassandraql and camel-drill resolve them at 5.0.3 / 9.2 / 9.5 next to
> asm 9.10.1)
> ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25686
> URL: https://issues.apache.org/jira/browse/CAMEL-25686
> Project: Camel
> Issue Type: Task
> Reporter: shashank
> Assignee: shashank
> Priority: Minor
>
> {{parent/pom.xml}} manages only {{org.ow2.asm:asm}} at {{asm-version}}
> (9.10.1). The other ASM artifacts are not managed, so they keep the version
> of the library that brings them, while {{asm}} is moved to {{asm-version}}.
> In the review of the camel-wasm PR #27793 (CAMEL-25606) importing
> {{org.ow2.asm:asm-bom}} in {{parent/pom.xml}} was suggested as a follow-up,
> because a later change of {{asm-version}} would move only {{asm}} and leave
> the four others of the Endive compiler behind.
> The mix is already there today. {{mvn dependency:tree
> -Dincludes=org.ow2.asm}} over the build on main (cd2ce899764e; all modules
> except {{tests/test-bundles}}, which did not resolve offline;
> {{tests/camel-itest}} and {{tests/camel-streamcaching-test}} checked
> separately, only {{asm}} itself):
> ||module||path||asm||asm-commons / asm-tree / asm-util / asm-analysis||
> |camel-web3j|web3j core 5.0.0 > jnr-unixsocket 0.21 > jnr-ffi
> 2.1.9|9.10.1|5.0.3|
> |camel-test-infra-cassandra (and camel-test-infra-all, where asm-commons is
> already 9.10.1)|testcontainers-cassandra > cassandra-driver-core 3.10.0 >
> jnr-ffi 2.1.7|9.10.1|5.0.3|
> |camel-cassandraql|java-driver-core 4.19.3 > jnr-posix 3.1.15 > jnr-ffi
> 2.2.11|9.10.1|9.2|
> |camel-drill|drill-jdbc 1.22.0 > drill-java-exec|9.10.1|9.5|
> |camel-wasm, camel-opa|Endive compiler 1.1.0 / 1.0.0|9.10.1|9.10.1 (from
> Endive's own import of asm-bom 9.10.1)|
> With {{-Dasm-version=9.9.1}} (a stand-in for a future change of the property)
> camel-wasm and camel-opa get {{asm}} 9.9.1 and the four others at 9.10.1.
> h3. Change
> Replace the managed {{asm}} entry with an import of {{org.ow2.asm:asm-bom}}
> at {{asm-version}} ({{<type>pom</type>}}, {{<scope>import</scope>}}, as the
> parent already imports the junit, netty and jackson boms). After the change
> the same full-build {{dependency:tree}} shows every ASM artifact at 9.10.1 in
> every module, and with {{-Dasm-version=9.9.1}} all five follow the property.
> No other module manages an ASM artifact ({{camel-package-maven-plugin}}
> already declares {{asm-tree}} with {{asm-version}}). The only resolved
> versions that change are the four artifacts in the modules of the table
> (5.0.3 / 9.2 / 9.5 to 9.10.1).
> Tests with the change: camel-wasm 133, camel-opa 112, camel-web3j 132 (67
> skipped), camel-cassandraql 8, camel-drill 7 (1 skipped),
> camel-test-infra-cassandra built; 0 failures. Not run: the integration tests
> of camel-cassandraql and camel-drill (containers), and nothing in these
> suites exercises jnr-ffi's generated code, so the newer ASM under jnr-ffi is
> checked by resolution only (today jnr-ffi already runs with {{asm}} 9.10.1
> next to its older companions).
> How it was found: following up the review comment on PR #27793; the
> full-build dependency tree then showed the existing mismatches.
> Affected: main. camel-4.23.x has the same single managed {{asm}} entry;
> camel-4.22.x and camel-4.18.x do not manage ASM in {{parent/pom.xml}} (read,
> not run). As a build alignment this is for main only.
> Duplicate check (2026-10-15): JIRA text "asm-bom" (CAMEL-24939, which added
> the managed {{asm}} entry; nothing about the bom), "asm-commons" (old
> OSGi/Karaf tickets only); GitHub pull requests "asm-bom" (only #27793 itself
> and unrelated dependabot bumps).
> _Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
