Skip to content

Bring build.xml dependency versions in line with Gradle - #1429

Merged
pjfanning merged 2 commits into
apache:trunkfrom
pjfanning:build-xml-dep-versions
Oct 17, 2026
Merged

pjfanning merged 2 commits into
apache:trunkfrom
pjfanning:build-xml-dep-versions

Conversation

@pjfanning

Copy link
Copy Markdown
Member

Updates the Ant build's third-party jars to the versions the Gradle build resolves:

artifact old new
commons-codec 1.22.1 1.23.0
commons-collections4 4.5.0 4.6.0
log4j-api 2.26.0 2.26.1
opentest4j 1.2.0 1.3.0
jmh-core / jmh-generator-annprocess 1.35 1.37
xmlunit-core 2.10.3 2.14.0
mockito-core 5.20.0 5.24.0
byte-buddy / byte-buddy-agent 1.18.10 1.18.15 (matches poi-ooxml-lite-agent)
objenesis 3.1 3.3
commons-logging (main-tests) 1.2 1.4.0
bcprov / bcpkix / bcutil / bcpg 1.85 1.86
stax2-api 4.2.1 4.3.1
pdfbox / pdfbox-io / fontbox 3.0.5 3.0.8
graphics2d 3.0.3 3.0.5
guava 33.7.1-jre 33.7.2-jre
javassist 3.27.0-GA 3.28.0-GA
slf4j-api (ooxml-tests) 2.0.17 2.0.20
  • The replaced versions are added to check-jars so they're deleted from a cached lib/ (the Ant CI job caches lib under a fixed key); otherwise old and new jars would both sit on the module path.
  • The spotbugs section is left alone, since it is pinned to spotbugs 4.9.8's own manifest.
  • xmlsec is left out; it's handled in Upgrade xmlsec to 4.0.4 #1428.
  • Fixes the stale gradleVersion = '9.6.1' in the wrapper task (the wrapper itself is already 9.8.1). Gradle 9.8.1 and Ant 1.10.18 are both the latest releases.

Tested locally with Ant: test-main -Dtestpattern=TestSheetUtil (mockito) and test-ooxml -Dtestpattern=TestSignatureInfo (bouncycastle) pass. Also checked that check-jars removes dummy old-version jars.

🤖 Generated with Claude Code

pjfanning and others added 2 commits October 17, 2026 16:03
Update the Ant third-party jar versions to match what the Gradle build
resolves, and add the replaced versions to check-jars so that stale jars
in a cached lib/ directory get removed. Also fix the stale gradleVersion
in the wrapper task (the wrapper itself is already on 9.8.1).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
commons-logging 1.4.0 ships a module-info, so it is no longer an automatic
module and pdfbox's use of it fails with NoClassDefFoundError unless it is
added as a root module. Also check for the commons-logging jar so that a
version bump triggers the download.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@pjfanning
pjfanning merged commit f0d1dc3 into apache:trunk Oct 17, 2026
4 checks passed
@pjfanning
pjfanning deleted the build-xml-dep-versions branch October 17, 2026 16:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant