Upgrade library dependencies to recent releases during early OH5.2 milestone phase #5256
Description
Follow-up to #4949.
Core has a lot few dependencies which are not up to date.
Basically we have a set of dependencies which get upgraded in a regular frequency: e.g. Karaf, Jetty, PaxWeb, some of the commons libs, asm (typically all of them on every Karaf release); Xtext/Xtend, guava, ecj, etc.
In addition, there are a lot of dependencies which have not seen an upgrade over years. This typically leads to many outdated dependencies still being pulled in or other upgrades being blocked by dependency conflicts.
There is a list of dependencies which still need attention (will post an excerpt from mvn versions:display-dependency-updates below in the comment).
Deprecated javax namespace is still a topic, not all dependencies already support jakarta namespace (e.g. hivemq-mqtt).
We cannot work on most of this close to a release, as sometimes files are missing on jfrog and break plugin installation, etc.
Related PRs:
- Upgrade Karaf to 4.4.9 #5195
- Karaf features: Update supported schema versions #5254
- Upgrade Maven and downgrade karaf-maven-plugin #5261
- Upgrade jmdns to 3.6.3 #5263
- Upgrade commons-pool2 to 2.13.1 #5264
- Upgrade hivemq-mqtt-client to 1.3.12 #5265 (and Netty 4.1.126 to 4.1.130)
- Upgrade Jollyday to 1.8.1 #5266
- Upgrade pdfbox from to 3.0.1 #5267
- Upgrade Swagger to 2.2.41 #5269
- [upgradetool] Bump commons-cli to 1.11 #5270
- Upgrade json-path to 2.10.0 #5271
- Upgrade Gson to 2.13.2 #5275
- Upgrade logback to 1.5.24 #5277
- Upgrade Mockito to 5.21, junit-jupiter to 5.14.2 #5281
- Bump jackson.version from 2.20.1 to 2.21.0 #5294
- Upgrade bndtools to 7.2.1 and re-establish iTests #5279
- Bump ch.qos.logback:logback-core from 1.5.24 to 1.5.25 in /bundles/org.openhab.core.test #5298
- Upgrade to Pax Web 8.0.34 / Jetty 9.4.58.v20250814 #5324
- Upgrade Karaf to 4.4.10 #5353
TODO
- No update since years:
** jamod [transport.modbus] -> transition to j2mod [transport.modbus] Transition from jamod to j2mod #5258
** javazoom/jl mp3 audio library - fix bug with latest Eclipse Eclipse 2025-12 - Oomph installer fails openhab-distro#1856
- revisit bndtools downgrade in distro
- Karaf 4.5 - not yet available
- ecj 3.45 - not yet available
- possibly switch from SAT 0.18 to 1.0 (currently only available as -SNAPSHOT)
- possibly revisit SAT rule sets for 1.0 release
TODO - this is an excerpt of
mvn versions:display-dependency-updates -nsu -Dmaven.version.ignore=".*-beta-.*,.*\.BETA[0-9]+,.*-M[0-9]+,.*alpha[0-9]+,.*-b[0-9]+,.*2\.0\.1\.MR,.*\.M[0-9]+" -B -Dversions.outputLineWidth=120 |tee deps
cat deps|grep -v Downl|grep "\.\.\."|grep -v "openHAB Core"|grep -- "->" |grep -v "jetty:jetty-" | grep -v "web:pax-web" |sort -u
Those packages have not been addressed yet, some are transitive deps still:
No upgrade, transitive or blocked:
args4j:args4j ................................................................................... 2.33 -> 2.37 (do not find dep in tree)
de.rototor.pdfbox:graphics2d .................................................................. 3.0.1 -> 3.0.5 (from xchart)
com.google.errorprone:error_prone_annotations ............................................... 2.23.0 -> 2.46.0 upgrade to 2.41.0, transitive dep of gson
com.neuronrobotics:nrjavaserial .......................................................... 3.14.0 -> 5.2.1.OH1 (intended)
commons-cli:commons-cli ..................................................................... 1.10.0 -> 1.11.0 upgraded in upgradetool, otherwise transitive dep from mwe2
org.apache.cxf:cxf-rt-rs-client ............................................................... 3.6.9 -> 4.1.4 in sync with Karaf, no strict dep to version from Karaf but to other deps
org.apache.cxf:cxf-rt-rs-sse .................................................................. 3.6.9 -> 4.1.4 in sync with Karaf, no strict dep to version from Karaf but to other deps
org.apache.felix:org.apache.felix.configurator .............................................. 1.0.16 -> 1.0.18 in sync with Karaf
org.apache.felix:org.apache.felix.http.servlet-api ............................................ 1.2.0 -> 6.1.0 to be done with Karaf 4.5.0
org.apache.felix:org.apache.felix.inventory ................................................... 1.1.0 -> 2.0.0 in sync wit Karaf, 2.0 would be javax
org.apache.felix:org.apache.felix.scr ........................................................ 2.2.6 -> 2.2.14 to be done with Karaf 4.5.0
org.apache.felix:org.apache.felix.webconsole ................................................ 4.8.12 -> 5.0.18 to be done with Karaf 4.5.0
org.apache.felix:org.apache.felix.webconsole.plugins.ds ....................................... 2.2.0 -> 2.3.0 to be done with Karaf 4.5.0
org.apache.maven:maven-plugin-api ........................................................ 3.9.6 -> 4.0.0-rc-5 (no, still rc)
org.apache.pdfbox:pdfbox ..................................................................... 2.0.27 -> 3.0.6 (from xchart, we upgrade to 3.0.1)
org.apache.servicemix.bundles:org.apache.servicemix.bundles.saaj-impl ..................... 1.4.0_2 -> 1.5.1_1 same release date, javax -> jakarta, postponed
org.apache.xbean:xbean-finder ................................................................... 4.28 -> 4.29 (with Karaf 4.4.10 or 4.5.0, already merged on both branches)
org.apache.xbean:xbean-bundleutils .............................................................. 4.28 -> 4.29 (with Karaf 4.4.10 or 4.5.0, already merged on both branches)
org.eclipse.emf:org.eclipse.emf.codegen ..................................................... 2.23.0 -> 2.27.0 (xtext generator)
org.eclipse.emf:org.eclipse.emf.codegen.ecore ............................................... 2.37.0 -> 2.44.0 (xtext generator)
org.eclipse.emf:org.eclipse.emf.common ...................................................... 2.30.0 -> 2.44.0 (xtext generator)
org.eclipse.emf:org.eclipse.emf.ecore ....................................................... 2.36.0 -> 2.41.0 (xtext generator)
org.eclipse.emf:org.eclipse.emf.ecore.xmi ................................................... 2.37.0 -> 2.39.0 (xtext generator)
org.eclipse.jdt:org.eclipse.jdt.core ........................................................ 3.37.0 -> 3.44.0 (xtext generator)
org.eclipse.jdt:org.eclipse.jdt.debug ..................................................... 3.21.300 -> 3.25.0 (xtext generator)
org.eclipse.jdt:org.eclipse.jdt.launching ................................................. 3.21.100 -> 3.24.0 (xtext generator)
org.eclipse.platform:org.eclipse.core.commands ............................................ 3.12.0 -> 3.12.500 (xtext generator)
org.eclipse.platform:org.eclipse.core.contenttype ......................................... 3.9.300 -> 3.9.800 (xtext generator)
org.eclipse.platform:org.eclipse.core.expressions ......................................... 3.9.300 -> 3.9.500 (xtext generator)
org.eclipse.platform:org.eclipse.core.filesystem ........................................ 1.10.300 -> 1.11.400 (xtext generator)
org.eclipse.platform:org.eclipse.core.jobs .............................................. 3.15.200 -> 3.15.700 (xtext generator)
org.eclipse.platform:org.eclipse.core.resources ......................................... 3.20.100 -> 3.23.100 (xtext generator)
org.eclipse.platform:org.eclipse.core.runtime ............................................. 3.31.0 -> 3.34.100 (xtext generator)
org.eclipse.platform:org.eclipse.core.variables ........................................... 3.6.300 -> 3.6.700 (xtext generator)
org.eclipse.platform:org.eclipse.debug.core ............................................. 3.21.300 -> 3.23.200 (xtext generator)
org.eclipse.platform:org.eclipse.equinox.app ................................................ 1.7.0 -> 1.7.500 (xtext generator)
org.eclipse.platform:org.eclipse.equinox.common ........................................... 3.19.0 -> 3.20.300 (xtext generator)
org.eclipse.platform:org.eclipse.equinox.preferences ...................................... 3.11.0 -> 3.12.100 (xtext generator)
org.eclipse.platform:org.eclipse.equinox.registry ......................................... 3.12.0 -> 3.12.600 (xtext generator)
org.eclipse.platform:org.eclipse.text ..................................................... 3.14.0 -> 3.14.500 (xtext generator)
org.hamcrest:hamcrest-core ........................................................................ 1.3 -> 3.0 (do not find dep in tree)
org.junit.jupiter:* ....................................................... 5.14.2 -> 6.0.2 see below
org.junit.platform:* ................................................... 1.14.2 -> 6.0.2 conflicts with biz.aQute.tester.junit-platform from 7.2.1 still req. <2.0
org.ow2.asm:asm ................................................................................. 9.9 -> 9.9.1 Karaf 4.4.10 or 4.5.0
org.ops4j.pax.logging:pax-logging-api ......................................................... 2.3.0 -> 2.3.1 in sync with Karaf
org.ops4j.pax.logging:pax-logging-log4j2 ...................................................... 2.3.0 -> 2.3.1 in sync with Karaf
Open / In Analysis
biz.aQute.bnd:biz.aQute.tester.junit-platform ................................................. 7.1.0 -> 7.2.0
com.fasterxml.woodstox:woodstox-core .......................................................... 6.6.2 -> 7.1.1
com.itemis.maven.plugins:unleash-scm-provider-git ............................................. 2.2.0 -> 2.3.0
com.sun.xml.bind:jaxb-osgi .................................................................... 2.3.9 -> 4.0.6
io.micrometer:micrometer-commons ............................................................ 1.16.0 -> 1.16.1
io.micrometer:micrometer-core ............................................................... 1.16.0 -> 1.16.1
jakarta.annotation:jakarta.annotation-api ..................................................... 2.1.1 -> 3.0.0
jakarta.xml.bind:jakarta.xml.bind-api ......................................................... 2.3.3 -> 4.0.4
org.antlr:antlr-runtime ......................................................................... 3.2 -> 3.5.3 version 3.2 is transitive dep of xtext, but investigate why we pull in an OH specific version in addition to org.antlr:antlr-runtime
org.apache.maven.plugin-tools:maven-plugin-annotations ...................................... 3.15.1 -> 3.15.2
org.eclipse.emf:org.eclipse.emf.ecore.change ................................................ 2.16.0 -> 2.17.0
org.eclipse.jdt:org.eclipse.jdt.annotation ................................................ 2.2.100 -> 2.4.100
org.eclipse.jdt:org.eclipse.jdt.annotation ................................................ 2.2.600 -> 2.4.100
org.eclipse.platform:org.eclipse.equinox.event ............................................ 1.6.300 -> 1.7.300
org.eclipse.platform:org.eclipse.equinox.log.stream ....................................... 1.1.200 -> 1.2.100
org.eclipse.platform:org.eclipse.equinox.metatype ......................................... 1.6.400 -> 1.6.900
org.eclipse.platform:org.eclipse.osgi ....................................................... 3.18.0 -> 3.24.0
org.eclipse.platform:org.eclipse.osgi ....................................................... 3.19.0 -> 3.24.0
org.glassfish.jaxb:jaxb-runtime ............................................................... 2.3.9 -> 4.0.6
Problems:
org.eclipse.jdt:ecj ......................................................................... 3.43.0 -> 3.44.0 - 3.44 has unexpected issues with annotations, waiting for 3.45
jakarta namespace, maybe best in conjunction with Karaf 4.5
conflicts with hivemq (+dagger)
- still forces us to use mvn:jakarta.inject/jakarta.inject-api/1.0.5 in addons/mqtt.generic, -> 2.x