Question: why the switch from `bcprov-jdk15on` to `bcprov-jdk15to18`?

[Stephan202]

After upgrading to sendgrid-java version 4.6.1 our internal build started to flag the following BanDuplicateClasses violation:

[WARNING] Rule 0: org.apache.maven.plugins.enforcer.BanDuplicateClasses failed with message:
Duplicate class found:

  Found in:
    org.bouncycastle:bcprov-jdk15to18:jar:1.65:compile
    org.bouncycastle:bcprov-jdk15on:jar:1.66:compile
  Duplicate classes:
    org/bouncycastle/LICENSE.class
There may be others but <findAllDuplicates> was set to false, so failing fast

Turns out this is because sendgrid-java switched from bcprov-jdk15on to bcprov-jdk15to18 in d9f4413, while we have another dependency that also pulls in bcprov-jdk15on.

There are of course several ways to resolve or silence this issue on our side, but before I select any of those I wanted to ask you what the reason for this change was. We use sendgrid-java with JDK 11, and bcprov-jdk15on would actually seem to be the better choice, since it also caters to JDK 9+, IIUC.

CC @eshanholtz.

[thinkingserious]

Hello @Stephan202,

We were having problems shading the new 1.66 release of bcprov-jdk15on.

With best regards,

Elmer

[Stephan202]

Hi @thinkingserious! Thanks for the explanation. I managed to reproduce the issue.

It seems another (better?) fix is to upgrade the maven-shared-plugin. When I apply this patch against 88b85cb (i.e. the commit before the bcprov-jdk15on -> bcprov-jdk15to18 switch) then the build passes:

diff --git a/pom.xml b/pom.xml
index 561d291..f71cb2b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -124,7 +124,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-shade-plugin</artifactId>
-            <version>3.2.1</version>
+            <version>3.2.4</version>
             <configuration>
               <relocations>
                 <relocation>
@@ -233,7 +233,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-shade-plugin</artifactId>
-        <version>3.2.1</version>
+        <version>3.2.4</version>
         <configuration>
           <relocations>
             <relocation>

(Running the failing build with -e shows that the "Unsupported class file major version 59" error is thrown by ASM, and the plugin upgraded that dependency in a more recent version. That's probably why this fixes it.)

Would you consider a PR in which the plugin is upgraded and bcprov-jdk15to18 is switched back to bcprov-jdk15on?

[childish-sambino]

Yup, a PR is welcome!

[Stephan202]

@childish-sambino alright, here you go: #643 :)