#51 Remove dependencies from jar (#52)

exasol · Oct 11, 2022 · 7e89bcc · 7e89bcc
1 parent 3aff6fe
commit 7e89bcc
Show file tree

Hide file tree

Showing 6 changed files with 75 additions and 96 deletions.
diff --git a/dependencies.md b/dependencies.md
@@ -32,26 +32,25 @@
 | [Maven Flatten Plugin][21]                              | [Apache Software Licenese][1]                 |
 | [scala-maven-plugin][22]                                | [Public domain (Unlicense)][23]               |
 | [ScalaTest Maven Plugin][24]                            | [the Apache License, ASL Version 2.0][16]     |
-| [Apache Maven Assembly Plugin][25]                      | [Apache License, Version 2.0][2]              |
-| [OpenFastTrace Maven Plugin][26]                        | [GNU General Public License v3.0][27]         |
-| [Project keeper maven plugin][28]                       | [The MIT License][29]                         |
-| [org.sonatype.ossindex.maven:ossindex-maven-plugin][30] | [ASL2][1]                                     |
-| [Maven Surefire Plugin][31]                             | [Apache License, Version 2.0][2]              |
-| [Versions Maven Plugin][32]                             | [Apache License, Version 2.0][2]              |
-| [Apache Maven Deploy Plugin][33]                        | [Apache License, Version 2.0][2]              |
-| [Apache Maven GPG Plugin][34]                           | [Apache License, Version 2.0][2]              |
-| [Apache Maven Source Plugin][35]                        | [Apache License, Version 2.0][2]              |
-| [Apache Maven Javadoc Plugin][36]                       | [Apache License, Version 2.0][2]              |
-| [Nexus Staging Maven Plugin][37]                        | [Eclipse Public License][38]                  |
-| [Maven Failsafe Plugin][39]                             | [Apache License, Version 2.0][2]              |
-| [JaCoCo :: Maven Plugin][40]                            | [Eclipse Public License 2.0][41]              |
-| [error-code-crawler-maven-plugin][42]                   | [MIT License][43]                             |
-| [Reproducible Build Maven Plugin][44]                   | [Apache 2.0][1]                               |
-| [Maven Clean Plugin][45]                                | [The Apache Software License, Version 2.0][1] |
-| [Maven Resources Plugin][46]                            | [The Apache Software License, Version 2.0][1] |
-| [Maven JAR Plugin][47]                                  | [The Apache Software License, Version 2.0][1] |
-| [Maven Install Plugin][48]                              | [The Apache Software License, Version 2.0][1] |
-| [Maven Site Plugin 3][49]                               | [The Apache Software License, Version 2.0][1] |
+| [OpenFastTrace Maven Plugin][25]                        | [GNU General Public License v3.0][26]         |
+| [Project keeper maven plugin][27]                       | [The MIT License][28]                         |
+| [org.sonatype.ossindex.maven:ossindex-maven-plugin][29] | [ASL2][1]                                     |
+| [Maven Surefire Plugin][30]                             | [Apache License, Version 2.0][2]              |
+| [Versions Maven Plugin][31]                             | [Apache License, Version 2.0][2]              |
+| [Apache Maven Deploy Plugin][32]                        | [Apache License, Version 2.0][2]              |
+| [Apache Maven GPG Plugin][33]                           | [Apache License, Version 2.0][2]              |
+| [Apache Maven Source Plugin][34]                        | [Apache License, Version 2.0][2]              |
+| [Apache Maven Javadoc Plugin][35]                       | [Apache License, Version 2.0][2]              |
+| [Nexus Staging Maven Plugin][36]                        | [Eclipse Public License][37]                  |
+| [Maven Failsafe Plugin][38]                             | [Apache License, Version 2.0][2]              |
+| [JaCoCo :: Maven Plugin][39]                            | [Eclipse Public License 2.0][40]              |
+| [error-code-crawler-maven-plugin][41]                   | [MIT License][42]                             |
+| [Reproducible Build Maven Plugin][43]                   | [Apache 2.0][1]                               |
+| [Maven Clean Plugin][44]                                | [The Apache Software License, Version 2.0][1] |
+| [Maven Resources Plugin][45]                            | [The Apache Software License, Version 2.0][1] |
+| [Maven JAR Plugin][46]                                  | [The Apache Software License, Version 2.0][1] |
+| [Maven Install Plugin][47]                              | [The Apache Software License, Version 2.0][1] |
+| [Maven Site Plugin 3][48]                               | [The Apache Software License, Version 2.0][1] |
 
 [0]: https://parquet.apache.org
 [1]: http://www.apache.org/licenses/LICENSE-2.0.txt
@@ -78,28 +77,27 @@
 [22]: http://github.com/davidB/scala-maven-plugin
 [23]: http://unlicense.org/
 [24]: https://www.scalatest.org/user_guide/using_the_scalatest_maven_plugin
-[25]: https://maven.apache.org/plugins/maven-assembly-plugin/
-[26]: https://github.com/itsallcode/openfasttrace-maven-plugin
-[27]: https://www.gnu.org/licenses/gpl-3.0.html
-[28]: https://github.com/exasol/project-keeper/
-[29]: https://github.com/exasol/project-keeper/blob/main/LICENSE
-[30]: https://sonatype.github.io/ossindex-maven/maven-plugin/
-[31]: https://maven.apache.org/surefire/maven-surefire-plugin/
-[32]: http://www.mojohaus.org/versions-maven-plugin/
-[33]: https://maven.apache.org/plugins/maven-deploy-plugin/
-[34]: https://maven.apache.org/plugins/maven-gpg-plugin/
-[35]: https://maven.apache.org/plugins/maven-source-plugin/
-[36]: https://maven.apache.org/plugins/maven-javadoc-plugin/
-[37]: http://www.sonatype.com/public-parent/nexus-maven-plugins/nexus-staging/nexus-staging-maven-plugin/
-[38]: http://www.eclipse.org/legal/epl-v10.html
-[39]: https://maven.apache.org/surefire/maven-failsafe-plugin/
-[40]: https://www.jacoco.org/jacoco/trunk/doc/maven.html
-[41]: https://www.eclipse.org/legal/epl-2.0/
-[42]: https://github.com/exasol/error-code-crawler-maven-plugin/
-[43]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE
-[44]: http://zlika.github.io/reproducible-build-maven-plugin
-[45]: http://maven.apache.org/plugins/maven-clean-plugin/
-[46]: http://maven.apache.org/plugins/maven-resources-plugin/
-[47]: http://maven.apache.org/plugins/maven-jar-plugin/
-[48]: http://maven.apache.org/plugins/maven-install-plugin/
-[49]: http://maven.apache.org/plugins/maven-site-plugin/
+[25]: https://github.com/itsallcode/openfasttrace-maven-plugin
+[26]: https://www.gnu.org/licenses/gpl-3.0.html
+[27]: https://github.com/exasol/project-keeper/
+[28]: https://github.com/exasol/project-keeper/blob/main/LICENSE
+[29]: https://sonatype.github.io/ossindex-maven/maven-plugin/
+[30]: https://maven.apache.org/surefire/maven-surefire-plugin/
+[31]: http://www.mojohaus.org/versions-maven-plugin/
+[32]: https://maven.apache.org/plugins/maven-deploy-plugin/
+[33]: https://maven.apache.org/plugins/maven-gpg-plugin/
+[34]: https://maven.apache.org/plugins/maven-source-plugin/
+[35]: https://maven.apache.org/plugins/maven-javadoc-plugin/
+[36]: http://www.sonatype.com/public-parent/nexus-maven-plugins/nexus-staging/nexus-staging-maven-plugin/
+[37]: http://www.eclipse.org/legal/epl-v10.html
+[38]: https://maven.apache.org/surefire/maven-failsafe-plugin/
+[39]: https://www.jacoco.org/jacoco/trunk/doc/maven.html
+[40]: https://www.eclipse.org/legal/epl-2.0/
+[41]: https://github.com/exasol/error-code-crawler-maven-plugin/
+[42]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE
+[43]: http://zlika.github.io/reproducible-build-maven-plugin
+[44]: http://maven.apache.org/plugins/maven-clean-plugin/
+[45]: http://maven.apache.org/plugins/maven-resources-plugin/
+[46]: http://maven.apache.org/plugins/maven-jar-plugin/
+[47]: http://maven.apache.org/plugins/maven-install-plugin/
+[48]: http://maven.apache.org/plugins/maven-site-plugin/
diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md
@@ -1,5 +1,6 @@
 # Changes
 
+* [2.0.0](changes_2.0.0.md)
 * [1.3.3](changes_1.3.3.md)
 * [1.3.2](changes_1.3.2.md)
 * [1.3.1](changes_1.3.1.md)

diff --git a/doc/changes/changes_2.0.0.md b/doc/changes/changes_2.0.0.md
@@ -0,0 +1,21 @@
+# Parquet for Java 2.0.0, released 2022-10-11
+
+Code name: Remove packed dependencies from JAR
+
+## Summary
+
+This is a breaking change. The built JAR contained classes from all dependencies. We removed them, and now dependencies must be resolved via Maven Central.
+
+## Features
+
+* #51: Removed packed dependencies from JAR
+
+## Dependency Updates
+
+### Compile Dependency Updates
+
+* Updated `org.scala-lang:scala-library:2.13.9` to `2.13.10`
+
+### Plugin Dependency Updates
+
+* Removed `org.apache.maven.plugins:maven-assembly-plugin:3.3.0`
diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom
@@ -3,7 +3,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.exasol</groupId>
     <artifactId>parquet-io-java-generated-parent</artifactId>
-    <version>1.3.3</version>
+    <version>2.0.0</version>
     <packaging>pom</packaging>
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

diff --git a/pom.xml b/pom.xml
@@ -3,12 +3,12 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.exasol</groupId>
     <artifactId>parquet-io-java</artifactId>
-    <version>1.3.3</version>
+    <version>2.0.0</version>
     <name>Parquet for Java</name>
     <description>This project provides a library that reads Parquet files into Java objects.</description>
     <url>https://github.com/exasol/parquet-io-java/</url>
     <properties>
-        <scala.version>2.13.9</scala.version>
+        <scala.version>2.13.10</scala.version>
         <scala.compat.version>2.13</scala.compat.version>
         <mockito.version>4.8.0</mockito.version>
     </properties>
@@ -215,31 +215,6 @@
                     </execution>
                 </executions>
             </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-assembly-plugin</artifactId>
-                <version>3.3.0</version>
-                <configuration>
-                    <descriptors>
-                        <descriptor>src/assembly/all-dependencies.xml</descriptor>
-                    </descriptors>
-                    <appendAssemblyId>false</appendAssemblyId>
-                    <archive>
-                        <manifest>
-                            <addClasspath>true</addClasspath>
-                        </manifest>
-                    </archive>
-                </configuration>
-                <executions>
-                    <execution>
-                        <id>make-assembly</id>
-                        <phase>package</phase>
-                        <goals>
-                            <goal>single</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
             <plugin>
                 <groupId>org.itsallcode</groupId>
                 <artifactId>openfasttrace-maven-plugin</artifactId>
@@ -277,6 +252,12 @@
                     <excludeVulnerabilityIds>
                         <!-- com.google.guava:guava: Excluded because we assume that the attacker does not have access to the machine. -->
                         <exclude>sonatype-2020-0926</exclude>
+                        <!-- org.apache.hadoop:hadoop-common:jar:3.3.4: CWE-611: Improper Restriction of XML External Entity Reference ('XXE') (8.6); https://ossindex.sonatype.org/vulnerability/sonatype-2022-5820
+                        No update available -->
+                        <exclude>sonatype-2022-5820</exclude>
+                        <!-- org.apache.hadoop:hadoop-hdfs-client:jar:3.3.4: CWE-611: Improper Restriction of XML External Entity Reference ('XXE') (8.6); https://ossindex.sonatype.org/vulnerability/sonatype-2022-5732
+                        No update available -->
+                        <exclude>sonatype-2022-5732</exclude>
                     </excludeVulnerabilityIds>
                 </configuration>
             </plugin>
@@ -297,7 +278,7 @@
     <parent>
         <artifactId>parquet-io-java-generated-parent</artifactId>
         <groupId>com.exasol</groupId>
-        <version>1.3.3</version>
+        <version>2.0.0</version>
         <relativePath>pk_generated_parent.pom</relativePath>
     </parent>
 </project>
diff --git a/src/assembly/all-dependencies.xml b/src/assembly/all-dependencies.xml