JDK 26 warns about reflective mutation

[geoand]

When building a Quarkus quickstart with Maven 3.9.12 using JDK 26 EA.34, I get:

WARNING: Final field _cipher in class org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher has been mutated reflectively by class org.eclipse.sisu.bean.BeanPropertyField in unnamed module @4b44655e (file:/home/gandrian/.sdkman/candidates/maven/current/lib/org.eclipse.sisu.inject-0.9.0.M4.jar)
WARNING: Use --enable-final-field-mutation=ALL-UNNAMED to avoid a warning
WARNING: Mutating final fields will be blocked in a future release unless final field mutation is enabled

This is because of JEP 500

[cstamas]

That is weird, as IF we talk about versions used in Maven 3.9.12, then you have some issues. For start, the DefaultSecDispatcher is JSR3330 managed (sisu) and not Plexus managed (should not be):
https://github.com/codehaus-plexus/plexus-sec-dispatcher/blob/plexus-sec-dispatcher-2.0/src/main/java/org/sonatype/plexus/components/sec/dispatcher/DefaultSecDispatcher.java#L53-L74

It uses JSR330 annotations and ctor injection, hence the fields are really final.

OTOH, this could mean you have some rogue plexus.xml on classpath? Check out your classpath for paths like:

• /META-INF/plexus/components.xml and those should not manage DefaultSecDispatcher at all

Given Plexus is only field injection capable, it means for some reason Plexus managed this bean for you.

[geoand]

Oh, that's very interesting.

When I search for DefaultSecDispatcher in my IDE, it returns these:

which come from quarkus-ide-launcher

and

[cstamas]

Yes, original Plexus DI was field injection capable only, hence your components had to have def ctor and fields annotated with @Requirement annotation.

With Sisu and JSR330 this changes.

But, just to make this more interesting: Smallrye Beanbag also does field injection 😉 (but unsure can that one be blamed here at all or not; ie. does it also interpret discovered plexus XML or not)

[geoand]

cc @aloubyansky @dmlloyd

[cstamas]

I think you have this one: https://github.com/apache/maven/blob/maven-3.9.x/maven-core/src/main/resources/META-INF/plexus/components.xml#L114-L132
Unpacked as part of maven-resolver transitive dep https://github.com/quarkusio/quarkus/blob/main/independent-projects/bootstrap/maven-resolver/pom.xml#L89-L92

[cstamas]

Btw, this implies vanilla Maven should produce this warning on 26? Let me try.

[cstamas]

Yup, there is is: line 7
https://gist.github.com/cstamas/b3b8efb6b8a80d253b0b3b54dcf38415

[geoand]

Indeed, I see the same when running the command in a directory that is not a Maven project

[cstamas]

Fix for Maven 3.9.x (we are soon coming out with 3.9.13 release):
apache/maven#11711

[geoand]

Thanks a lot!

[cstamas]

Closing out, as this is not a Sisu issue due:

• Sisu DI is a JSR330 container and performs ctor injection, as expected
• OTOH, Plexus Shim (drop in replacement for old Plexus DI) must perform field injection, as Plexus DI was only capable of doing that (Also, annotations @Requirement are applicable only to fields, and Plexus XML descriptor can target fields only as well)
• What happened here is that user (Maven project) was "sloppy": component that was converted to JSR330 (and use final fields and ctor injection) but was left to be managed by Plexus DI, that did field injection into final marked fields. And that triggered warnings on Java 26 due JEP 500.

In short: mixing of components is not recommended, and moving off from Plexus DI (to JSR330) is warmly recommended.