updating jenkins base version and bom configuration

[itsAftabAlam]

Updating jenkins base version and corresponding BOM configuration. Made relevant changes to resolve issues with dependencies.

Testing done

Tests passed

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did

[felfert]

This won't work, because jclouds currently does NOT support gson >= 2.9.0
See https://issues.jenkins.io/browse/JENKINS-72475 and my corresponding PR #165

[itsAftabAlam]

Thanks for reviewing the PR! I didn't expected that! Just curious how does it sneaked through the tests? Can you give some insights so that I do not repeat the same mistake again.

[felfert]

Because there are no tests for that in the plugin. The relevant tests are in jclouds, not in the plugin. It would require connecting to a real cloud provider including the necessary credentials. For obvious reasons, I cannot make the credentials public.

This is a stacktrace from before #165 which shows that this happens deep down in jclouds.

[felfert]

Please revert this chunk mentioned above.

[itsAftabAlam]

If I revert back to previous gson version, it will raise Maven Enforcer errors referring RequireUpperBoundDeps. Can you please suggest the required steps to resolve it?

[felfert]

If I revert back to previous gson version, it will raise Maven Enforcer errors referring RequireUpperBoundDeps. Can you please suggest the required steps to resolve it?

Oh, did not know that. Well I don't know how to override the maven enforcer parameters or if that is even possible. Until then, I'm afraid this has to wait until jclouds-2.6.0 is released.

@basil Sorry for the intrusion - Could you please help out and comment on that?

[basil]

Continuing to bundle the old JAR and masking the classes is a valid solution, and this was also done in jenkinsci/artifact-manager-s3-plugin#447.

To silence Enforcer you can use a code snippet like https://github.com/jenkinsci/gitlab-plugin/blob/d38e95e166e43d1e1a87fc4e6dbff838a34a164f/pom.xml#L303-L325 but even better is to exclude the newer version from wherever it is coming from (use mvn dependency:tree to view the tree) using <exclusion> so that Enforcer isn't triggered in the first place.

[itsAftabAlam]

Thanks for the reviews @felfert @basil. I will try to resolve the issue using the said approach.

[jonesbusy]

Continuing to bundle the old JAR and masking the classes is a valid solution, and this was also done in jenkinsci/artifact-manager-s3-plugin#447.

I think it's the best solution because will also prevent future issue when dependents plugin depends on a newer version of GSON.

[basil]

I think it's the best solution

There are other problems when multiple plugins bundle the same JAR, such as linkage errors when the same class is loaded by two different class loaders and instances try to interact with each other. That is why we generally prefer library plugins in the Jenkins ecosystem. This is likely less of an issue for JClouds because it loads GSON privately and not as part of a public API.

[felfert]

Thanks for the reviews @felfert @basil. I will try to resolve the issue using the said approach.

To sum it up, you basically need 2 changes:

1. Revert the gson version (just like I told you before)
2. Add the following inside the <build><plugins> </plugins></build> block (new. Override maven-enforcer settings):

    <plugin>
        <artifactId>maven-enforcer-plugin</artifactId>
        <executions>
          <execution>
            <id>display-info</id>
            <configuration>
              <rules>
                <requireUpperBoundDeps>
                  <excludes combine.children="append">
                    <exclude>com.google.code.gson:gson</exclude>
                  </excludes>
                </requireUpperBoundDeps>
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>

[itsAftabAlam]

I hope this resolves the issue.

[felfert]

I hope this resolves the issue.

Yep, LGTM