Drop the cruft (#225)

* Drop commons-collections

Single class mildly used it. Simple replacement added.

* Drop other deprecated dependency

* Null safe

* Maven Artifact should be deprecated, is a mixed bad of mixed concepts

* Remove inherited fluff

.github/workflows/maven-verify.yml

@@ -26,4 +26,3 @@ jobs:
     uses: apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml@v4
     with:
           ff-jdk: "21"
-          ff-jdk-distribution: "corretto"

pom.xml

@@ -54,7 +54,7 @@
   </contributors>
 
   <prerequisites>
-    <maven>${mavenVersion}</maven>
+    <maven>3.6.3</maven>
   </prerequisites>
 
   <scm>
@@ -79,35 +79,14 @@
   </distributionManagement>
 
   <properties>
-    <mavenVersion>3.6.3</mavenVersion>
+    <mavenVersion>3.9.7</mavenVersion>
     <javaVersion>8</javaVersion>
-    <sisu.version>0.3.5</sisu.version>
     <currentVersion>${project.version}</currentVersion>
     <asmVersion>9.7</asmVersion>
-    <slf4j.version>1.7.32</slf4j.version>
+    <slf4j.version>1.7.36</slf4j.version>
     <project.build.outputTimestamp>2024-04-20T15:33:41Z</project.build.outputTimestamp>
   </properties>
 
-  <dependencyManagement>
-    <dependencies>
-      <dependency>
-        <groupId>org.eclipse.sisu</groupId>
-        <artifactId>org.eclipse.sisu.inject</artifactId>
-        <version>${sisu.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.eclipse.sisu</groupId>
-        <artifactId>org.eclipse.sisu.plexus</artifactId>
-        <version>${sisu.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>com.google.inject</groupId>
-        <artifactId>guice</artifactId>
-        <version>5.1.0</version>
-      </dependency>
-    </dependencies>
-  </dependencyManagement>
-
   <dependencies>
     <!-- Maven -->
     <dependency>
@@ -144,10 +123,7 @@
     <dependency>
       <groupId>org.codehaus.plexus</groupId>
       <artifactId>plexus-utils</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.codehaus.plexus</groupId>
-      <artifactId>plexus-xml</artifactId>
+      <version>3.5.1</version>
     </dependency>
 
     <!-- DI -->
@@ -181,25 +157,20 @@
       <version>2.0.6.1</version>
     </dependency>
     <dependency>
-      <groupId>org.apache.maven.shared</groupId>
-      <artifactId>maven-dependency-tree</artifactId>
-      <version>3.2.1</version>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-compress</artifactId>
+      <version>1.26.2</version>
     </dependency>
     <dependency>
       <groupId>commons-io</groupId>
       <artifactId>commons-io</artifactId>
-      <version>2.13.0</version>
+      <version>2.16.1</version>
     </dependency>
     <dependency>
       <groupId>org.vafer</groupId>
       <artifactId>jdependency</artifactId>
       <version>2.10</version>
     </dependency>
-    <dependency>
-      <groupId>org.apache.commons</groupId>
-      <artifactId>commons-collections4</artifactId>
-      <version>4.4</version>
-    </dependency>
 
     <!-- Test -->
     <!-- Used by: TransformerTesterRule only -->
@@ -211,6 +182,7 @@
     <dependency>
       <groupId>com.google.inject</groupId>
       <artifactId>guice</artifactId>
+      <version>5.1.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -228,13 +200,13 @@
     <dependency>
       <groupId>org.xmlunit</groupId>
       <artifactId>xmlunit-legacy</artifactId>
-      <version>2.9.1</version>
+      <version>2.10.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
       <artifactId>mockito-core</artifactId>
-      <version>2.28.2</version>
+      <version>3.12.4</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -255,11 +227,6 @@
       <version>3.3.0</version>
       <scope>test</scope>
     </dependency>
-    <dependency>
-      <groupId>org.apache.commons</groupId>
-      <artifactId>commons-compress</artifactId>
-      <version>1.26.1</version>
-    </dependency>
   </dependencies>
 
   <build>

src/main/java/org/apache/maven/plugins/shade/DefaultShader.java

@@ -24,24 +24,26 @@
 import java.io.BufferedOutputStream;
 import java.io.ByteArrayInputStream;
 import java.io.File;
-import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.OutputStreamWriter;
 import java.io.PushbackInputStream;
 import java.io.Writer;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Calendar;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.Enumeration;
+import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.Callable;
@@ -54,8 +56,6 @@
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipException;
 
-import org.apache.commons.collections4.MultiValuedMap;
-import org.apache.commons.collections4.multimap.HashSetValuedHashMap;
 import org.apache.commons.compress.archivers.zip.ExtraFieldUtils;
 import org.apache.commons.compress.archivers.zip.X5455_ExtendedTimestamp;
 import org.apache.commons.compress.archivers.zip.ZipExtraField;
@@ -137,26 +137,26 @@ public void shade(ShadeRequest shadeRequest) throws IOException, MojoExecutionEx
             goThroughAllJarEntriesForManifestTransformer(shadeRequest, resources, manifestTransformer, out);
 
             // CHECKSTYLE_OFF: MagicNumber
-            MultiValuedMap<String, File> duplicates = new HashSetValuedHashMap<>(10000, 3);
+            Map<String, HashSet<File>> duplicates = new HashMap<>();
             // CHECKSTYLE_ON: MagicNumber
 
             shadeJars(shadeRequest, resources, transformers, out, duplicates, packageMapper);
 
             // CHECKSTYLE_OFF: MagicNumber
-            MultiValuedMap<Collection<File>, String> overlapping = new HashSetValuedHashMap<>(20, 15);
+            Map<Collection<File>, HashSet<String>> overlapping = new HashMap<>();
             // CHECKSTYLE_ON: MagicNumber
 
             for (String clazz : duplicates.keySet()) {
                 Collection<File> jarz = duplicates.get(clazz);
                 if (jarz.size() > 1) {
-                    overlapping.put(jarz, clazz);
+                    overlapping.computeIfAbsent(jarz, k -> new HashSet<>()).add(clazz);
                 }
             }
 
             // Log a summary of duplicates
             logSummaryOfDuplicates(overlapping);
 
-            if (overlapping.keySet().size() > 0) {
+            if (!overlapping.keySet().isEmpty()) {
                 showOverlappingWarning();
             }
 
@@ -230,7 +230,7 @@ private void shadeJars(
             Set<String> resources,
             List<ResourceTransformer> transformers,
             JarOutputStream jos,
-            MultiValuedMap<String, File> duplicates,
+            Map<String, HashSet<File>> duplicates,
             DefaultPackageMapper packageMapper)
             throws IOException {
         for (File jar : shadeRequest.getJars()) {
@@ -262,7 +262,7 @@ private void shadeDir(
             List<ResourceTransformer> transformers,
             DefaultPackageMapper packageMapper,
             JarOutputStream jos,
-            MultiValuedMap<String, File> duplicates,
+            Map<String, HashSet<File>> duplicates,
             File jar,
             File current,
             String prefix,
@@ -308,7 +308,7 @@ private void shadeDir(
                         new Callable<InputStream>() {
                             @Override
                             public InputStream call() throws Exception {
-                                return new FileInputStream(file);
+                                return Files.newInputStream(file.toPath());
                             }
                         },
                         name,
@@ -326,7 +326,7 @@ private void shadeJar(
             List<ResourceTransformer> transformers,
             DefaultPackageMapper packageMapper,
             JarOutputStream jos,
-            MultiValuedMap<String, File> duplicates,
+            Map<String, HashSet<File>> duplicates,
             File jar,
             List<Filter> jarFilters)
             throws IOException {
@@ -387,7 +387,7 @@ private void shadeJarEntry(
             List<ResourceTransformer> transformers,
             DefaultPackageMapper packageMapper,
             JarOutputStream jos,
-            MultiValuedMap<String, File> duplicates,
+            Map<String, HashSet<File>> duplicates,
             File jar,
             Callable<InputStream> inputProvider,
             String name,
@@ -406,7 +406,7 @@ private void shadeJarEntry(
                 }
             }
 
-            duplicates.put(name, jar);
+            duplicates.computeIfAbsent(name, k -> new HashSet<>()).add(jar);
             if (name.endsWith(".class")) {
                 addRemappedClass(jos, jar, name, time, in, packageMapper);
             } else if (shadeRequest.isShadeSourcesContent() && name.endsWith(".java")) {
@@ -426,7 +426,7 @@ private void shadeJarEntry(
 
                     addResource(resources, jos, mappedName, inputProvider, time, method);
                 } else {
-                    duplicates.removeMapping(name, jar);
+                    duplicates.computeIfAbsent(name, k -> new HashSet<>()).remove(jar);
                 }
             }
         }
@@ -471,7 +471,7 @@ private void showOverlappingWarning() {
         logger.warn("See https://maven.apache.org/plugins/maven-shade-plugin/");
     }
 
-    private void logSummaryOfDuplicates(MultiValuedMap<Collection<File>, String> overlapping) {
+    private void logSummaryOfDuplicates(Map<Collection<File>, HashSet<String>> overlapping) {
         for (Collection<File> jarz : overlapping.keySet()) {
             List<String> jarzS = new ArrayList<>();
 

src/main/java/org/apache/maven/plugins/shade/mojo/ShadeMojo.java

@@ -35,6 +35,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.stream.Collectors;
 
 import org.apache.maven.RepositoryUtils;
 import org.apache.maven.artifact.Artifact;
@@ -67,12 +68,13 @@
 import org.apache.maven.project.ProjectBuildingException;
 import org.apache.maven.project.ProjectBuildingRequest;
 import org.apache.maven.project.ProjectBuildingResult;
-import org.apache.maven.shared.dependency.graph.DependencyGraphBuilder;
-import org.apache.maven.shared.dependency.graph.DependencyGraphBuilderException;
-import org.apache.maven.shared.dependency.graph.DependencyNode;
 import org.codehaus.plexus.util.IOUtil;
 import org.codehaus.plexus.util.WriterFactory;
 import org.eclipse.aether.RepositorySystem;
+import org.eclipse.aether.collection.CollectRequest;
+import org.eclipse.aether.collection.CollectResult;
+import org.eclipse.aether.collection.DependencyCollectionException;
+import org.eclipse.aether.graph.DependencyNode;
 import org.eclipse.aether.resolution.ArtifactRequest;
 import org.eclipse.aether.resolution.ArtifactResolutionException;
 import org.eclipse.aether.resolution.ArtifactResult;
@@ -400,12 +402,6 @@ public class ShadeMojo extends AbstractMojo {
     @Inject
     private RepositorySystem repositorySystem;
 
-    /**
-     * The dependency graph builder to use.
-     */
-    @Inject
-    private DependencyGraphBuilder dependencyGraphBuilder;
-
     /**
      * ProjectBuilder, needed to create projects from the artifacts.
      */
@@ -985,7 +981,7 @@ private File shadedTestArtifactFile() {
     // We need to find the direct dependencies that have been included in the uber JAR so that we can modify the
     // POM accordingly.
     private void createDependencyReducedPom(Set<String> artifactsToRemove)
-            throws IOException, DependencyGraphBuilderException, ProjectBuildingException {
+            throws IOException, ProjectBuildingException, DependencyCollectionException {
         List<Dependency> transitiveDeps = new ArrayList<>();
 
         // NOTE: By using the getArtifacts() we get the completely evaluated artifacts
@@ -1053,7 +1049,7 @@ private void createDependencyReducedPom(Set<String> artifactsToRemove)
 
     private void rewriteDependencyReducedPomIfWeHaveReduction(
             List<Dependency> dependencies, boolean modified, List<Dependency> transitiveDeps, Model model)
-            throws IOException, ProjectBuildingException, DependencyGraphBuilderException {
+            throws IOException, ProjectBuildingException, DependencyCollectionException {
         if (modified) {
             for (int loopCounter = 0; modified; loopCounter++) {
 
@@ -1182,18 +1178,30 @@ private String getId(String groupId, String artifactId, String type, String clas
 
     public boolean updateExcludesInDeps(
             MavenProject project, List<Dependency> dependencies, List<Dependency> transitiveDeps)
-            throws DependencyGraphBuilderException {
-        MavenProject original = session.getProjectBuildingRequest().getProject();
-        try {
-            session.getProjectBuildingRequest().setProject(project);
-            DependencyNode node =
-                    dependencyGraphBuilder.buildDependencyGraph(session.getProjectBuildingRequest(), null);
-            boolean modified = false;
-            for (DependencyNode n2 : node.getChildren()) {
-                String artifactId2 = getId(n2.getArtifact());
+            throws DependencyCollectionException {
+        CollectRequest collectRequest = new CollectRequest();
+        collectRequest.setRootArtifact(RepositoryUtils.toArtifact(project.getArtifact()));
+        collectRequest.setRepositories(project.getRemoteProjectRepositories());
+        collectRequest.setDependencies(project.getDependencies().stream()
+                .map(d -> RepositoryUtils.toDependency(
+                        d, session.getRepositorySession().getArtifactTypeRegistry()))
+                .collect(Collectors.toList()));
+        if (project.getDependencyManagement() != null) {
+            collectRequest.setManagedDependencies(project.getDependencyManagement().getDependencies().stream()
+                    .map(d -> RepositoryUtils.toDependency(
+                            d, session.getRepositorySession().getArtifactTypeRegistry()))
+                    .collect(Collectors.toList()));
+        }
+        CollectResult result = repositorySystem.collectDependencies(session.getRepositorySession(), collectRequest);
+        boolean modified = false;
+        if (result.getRoot() != null) {
+            for (DependencyNode n2 : result.getRoot().getChildren()) {
+                String artifactId2 = getId(RepositoryUtils.toArtifact(n2.getArtifact()));
 
                 for (DependencyNode n3 : n2.getChildren()) {
-                    Artifact artifact3 = n3.getArtifact();
+                    // stupid m-a Artifact that has no idea what it is: dependency or artifact?
+                    Artifact artifact3 = RepositoryUtils.toArtifact(n3.getArtifact());
+                    artifact3.setScope(n3.getDependency().getScope());
                     String artifactId3 = getId(artifact3);
 
                     // check if it really isn't in the list of original dependencies. Maven
@@ -1240,11 +1248,8 @@ public boolean updateExcludesInDeps(
                     }
                 }
             }
-            return modified;
-        } finally {
-            // restore it
-            session.getProjectBuildingRequest().setProject(original);
         }
+        return modified;
     }
 
     private boolean dependencyHasExclusion(Dependency dep, Artifact exclusionToCheck) {

src/main/java/org/apache/maven/plugins/shade/resource/properties/io/NoCloseOutputStream.java

@@ -22,7 +22,7 @@
 import java.io.OutputStream;
 
 /**
- * Simple output stream replacing close call by a simpe flush.
+ * Simple output stream replacing close call by a simple flush.
  * Useful for output streams nesting streams (like jar output streams) and using a stream encoder.
  */
 public class NoCloseOutputStream extends OutputStream {