#1287 FindBugs 3.0 RC 2 dependencies on a BCEL SNAPSHOT

[Baron Roberts]

It appears that FindBugs RC 2 has a dependency on a SNAPSHOT version of BCEL. If FindBugs 3 ships with this dependency, how will users of the JAR resolve this dependency against Central?

[Andrey Loskutov]

I do not see any other download as 5.2 on BCEL site:
http://commons.apache.org/proper/commons-bcel/download_bcel.cgi

Any suggestions where to find 6.0 final?
Regards,
Andrey

[Baron Roberts]

Since you have to effectively create your own release, you can give it your own groupId, which you have done, leave the artifactId as bcel, and change the version to 6.0 (i.e. remove the SNAPSHOT). Upload that artifact to Central and have FindBugs dependency be on this artifact. That way when the BCEL project releases their 6.0, it will not clash in terms of artifact name. However, a project using both the FindBugs JAR and BCEL will risk clashes.

Even safer is to use the Maven Shade Plugin and bring BCEL into the FindBugs JAR. You can use the plugin's capability to remap the namespace to something in the FindBugs namespace. This way if a project uses FindBugs JAR and the official BCEL, there will be now collisions both in terms of artifact and class namespace.

[Andrey Loskutov]

Baron,
Could you craft a patch?
Honestly speaking I'm not using maven at all and so have literally no idea what you are talking about.
Regards,
Andrey

[Baron Roberts]

Thinking about the situation a bit more, I realize that FindBugs plugins like fb-contrib rely on the BCEL version provided as a transitive dependency of FindBugs. Therefore, BCEL cannot be shaded (i.e. its namespace must be preserved and it must not be hidden). So the best thing for you to do is my first suggestions, which is to upload your BCEL 6 artifact as:

groupId: com.google.code.findbugs
artifactId: bcel
version: 6.0

Change the bcel dependency in findbugs/findbugs/pom.xml from version 6.0-SNAPSHOT to simply 6.0. Eventually, when the Apache BCEL project releases version 6.0, you can change your dependency to it.

Cheers,
Baron

[Richard Fearn]

See also Support Request #24 for some discussion about which revision of BCEL is included with FindBugs 3.0.0.

[Steve Brown]

The Maven release plugin does not allow projects containing snapshot dependencies to be released. This means that projects having a dependency on findbugs cannot be released unless the bcel dependency is excluded in the dependency definition, which is a workaround, not a solution.

I agree with the solution proposed by Baron Roberts. Is this issue being resolved?

[Andrey Loskutov]

@Steve: neither me nor Bill are maven users, so I can't say if this is solved or not. But it looks like someone already created maven thingy here: http://mvnrepository.com/artifact/com.google.code.findbugs/bcel-findbugs

So please if you are maven user and this artifact helps you (or your maven beast) to solve the issue, leave a comment here.
Thanks,
Andrey

[Steve Brown]

@Andrey

Thanks for the reply. OK. The issue is that the dependency:

<dependency>
    <groupId>com.google.code.findbugs</groupId>
    <artifactId>bcel</artifactId>
    <version>6.0-SNAPSHOT</version>
</dependency>

should be:

<dependency>
    <groupId>com.google.code.findbugs</groupId>
    <artifactId>bcel-findbugs</artifactId>
    <version>6.0</version>
</dependency>

in the file findbugs/findbugs/pom.xml at lines 180 -184 inclusive.

I can run "mvn clean install" to build the findbugs.jar file, with this change in place. I haven't the facilities to build all of FindBugs.

I hope this helps.

[Charles Chan]

This was fixed as part of https://sourceforge.net/p/findbugs/patches/247/#1559