Building shaded jars results in lot of warnings (due to transitive dependencies to graalvm artifacts)

[ujibang]

Describe the bug

To build a shaded jar, we can define a plugin to depend on restheart core.

An example is https://github.com/SoftInstigate/web-frameworks/tree/master/java/restheart

The pom sets this dependency:

<dependencies>
    <dependency>
        <groupId>org.restheart</groupId>
        <artifactId>restheart</artifactId>
        <version>${restheart.version}</version>
      </dependency>
</dependencies>

It transitively adds dependencies to org.graalvm.polyglot:js-community

This is the output of mvn dependency:tree

[INFO] org.restheart:benchmark:jar:1.0.0
[INFO] \- org.restheart:restheart:jar:8.0.1:compile
[INFO]    \- org.graalvm.polyglot:js-community:pom:24.0.0:compile <=====
[INFO]       +- org.graalvm.js:js-language:jar:24.0.0:runtime
[INFO]       |  +- org.graalvm.regex:regex:jar:24.0.0:runtime
[INFO]       |  +- org.graalvm.truffle:truffle-api:jar:24.0.0:runtime
[INFO]       |  +- org.graalvm.polyglot:polyglot:jar:24.0.0:runtime
[INFO]       |  |  +- org.graalvm.sdk:collections:jar:24.0.0:runtime
[INFO]       |  |  \- org.graalvm.sdk:nativeimage:jar:24.0.0:runtime
[INFO]       |  |     \- org.graalvm.sdk:word:jar:24.0.0:runtime
[INFO]       |  \- org.graalvm.shadowed:icu4j:jar:24.0.0:runtime
[INFO]       \- org.graalvm.truffle:truffle-runtime:jar:24.0.0:runtime
[INFO]          +- org.graalvm.sdk:jniutils:jar:24.0.0:runtime
[INFO]          \- org.graalvm.truffle:truffle-compiler:jar:24.0.0:runtime

When building, the maven-shade-plugin logs several warnings

To Reproduce

Steps to reproduce the behavior:

$ git clone --depth 1 [email protected]:SoftInstigate/web-frameworks.git
$ cd web-frameworks/java/restheart/

edit pom.xml and remove the following lines (workaround to avoid the warnings)

              <!-- avoids including graalvm transitive dependencies into shaded jar-->
              <artifactSet>
                <excludes>
                    <exclude>org.graalvm.*:*</exclude>
               </excludes>

$ mvn clean package
....
INFO] Including org.restheart:restheart:jar:8.0.1 in the shaded jar.
[INFO] Including org.graalvm.js:js-language:jar:24.0.0 in the shaded jar.
[INFO] Including org.graalvm.regex:regex:jar:24.0.0 in the shaded jar.
[INFO] Including org.graalvm.truffle:truffle-api:jar:24.0.0 in the shaded jar.
[INFO] Including org.graalvm.polyglot:polyglot:jar:24.0.0 in the shaded jar.
[INFO] Including org.graalvm.sdk:collections:jar:24.0.0 in the shaded jar.
[INFO] Including org.graalvm.sdk:nativeimage:jar:24.0.0 in the shaded jar.
[INFO] Including org.graalvm.sdk:word:jar:24.0.0 in the shaded jar.
[INFO] Including org.graalvm.shadowed:icu4j:jar:24.0.0 in the shaded jar.
[INFO] Including org.graalvm.truffle:truffle-runtime:jar:24.0.0 in the shaded jar.
[INFO] Including org.graalvm.sdk:jniutils:jar:24.0.0 in the shaded jar.
[INFO] Including org.graalvm.truffle:truffle-compiler:jar:24.0.0 in the shaded jar.
[INFO] Skipping pom dependency org.graalvm.polyglot:js-community:pom:24.0.0 in the shaded jar.
[INFO] Dependency-reduced POM written at: /Users/uji/development/web-frameworks/java/restheart/dependency-reduced-pom.xml
[WARNING] Discovered module-info.class. Shading will break its strong encapsulation.
[WARNING] Discovered module-info.class. Shading will break its strong encapsulation.
....
[WARNING] js-language-24.0.0.jar, restheart-8.0.1.jar define 4987 overlapping classes and resources:
[WARNING]   - META-INF/services/com.oracle.truffle.js.runtime.Evaluator
[WARNING]   - com.oracle.js.parser.AbstractParser
[WARNING]   - com.oracle.js.parser.AbstractParser$1
[WARNING]   - com.oracle.js.parser.CoverExpressionError
[WARNING]   - com.oracle.js.parser.ECMAErrors
...lot of warnings...

Expected behavior

Adding a dependency to org.restheart:restheart should not transitively add a dependency to org.graalvm.polyglot:polyglot and org.graalvm.polyglot:js-community.

[ujibang]

the problem is the dependency <type>pom</type>.

the pom file https://repo1.maven.org/maven2/org/graalvm/polyglot/js-community/24.0.1/js-community-24.0.1.pom just includes org.graalvm.js:js-language and org.graalvm.truffle:truffle-runtime.

Replacing the dependency org.graalvm.polyglot:js-community:pom with org.graalvm.js:js-language and org.graalvm.truffle:truffle-runtime fixes the issue

[ujibang]

fixed in 8.0.4