dependency analysis in gitlab

NationalSecurityAgency · Apr 18, 2024 · c3f4042 · c3f4042
1 parent bb8d353
commit c3f4042
Show file tree

Hide file tree

Showing 45 changed files with 2,456 additions and 686 deletions.
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -72,6 +72,9 @@ jobs:
         $RUN_TESTS \
           || { echo "***** TESTS FAILED. Attempting retry."; $RUN_TESTS; } \
           || { echo "***** TESTS FAILED. Attempting final retry."; $RUN_TESTS; }
+    - name: Analyze Dependencies
+      run: |
+        mvn -V -B -e -ntp "-Dstyle.color=always" dependency:analyze package -DskipTests=true
 
   # This step can be uncommented to support feature development.  When developing a 
   # feature which spans multiple repos, you can update the poms to use the latest 
@@ -171,4 +174,3 @@ jobs:
     #     docker tag ${IMAGE_NAME}:${TAG} ${REMOTE_IMAGE_NAME}:${TAG}
     #     docker images
     #     docker push ${REMOTE_IMAGE_NAME}:${TAG}
-
diff --git a/common-test/pom.xml b/common-test/pom.xml
@@ -19,18 +19,12 @@
         </dependency>
         <dependency>
             <groupId>org.apache.accumulo</groupId>
-            <artifactId>accumulo-server-base</artifactId>
+            <artifactId>accumulo-core</artifactId>
             <exclusions>
                 <exclusion>
-                    <groupId>org.apache.zookeeper</groupId>
-                    <artifactId>zookeeper</artifactId>
+                    <groupId>org.apache.hadoop</groupId>
+                    <artifactId>hadoop-client</artifactId>
                 </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.hadoop</groupId>
-            <artifactId>hadoop-client</artifactId>
-            <exclusions>
                 <exclusion>
                     <groupId>org.apache.hadoop</groupId>
                     <artifactId>hadoop-common</artifactId>

diff --git a/pom.xml b/pom.xml
@@ -54,18 +54,25 @@
         <version.commons-io>2.6</version.commons-io>
         <version.commons-jexl3>3.3</version.commons-jexl3>
         <version.commons-lang>2.6</version.commons-lang>
+        <version.commons-lang3>3.9</version.commons-lang3>
         <version.commons-logging>1.2</version.commons-logging>
+        <version.commons-math3>3.0</version.commons-math3>
         <version.commons-pool>1.6</version.commons-pool>
         <version.commons-text>1.8</version.commons-text>
+        <version.commons-vfs2>2.3</version.commons-vfs2>
         <version.curator>5.2.0</version.curator>
         <version.deltaspike>1.9.0</version.deltaspike>
+        <version.dnsjava>2.1.8</version.dnsjava>
+        <version.dropwizard-metrics>3.2.6</version.dropwizard-metrics>
         <version.easymock>5.2.0</version.easymock>
         <version.eclipse.emf>2.15.0</version.eclipse.emf>
+        <version.fastutil>8.1.1</version.fastutil>
         <version.geoserver>2.22.5</version.geoserver>
         <version.geotools>28.1</version.geotools>
         <version.geowave>1.2.0</version.geowave>
         <version.google-guava>31.1-jre</version.google-guava>
         <version.googlecode-findbugs>2.0.3</version.googlecode-findbugs>
+        <version.googlecode-gson>2.9.0</version.googlecode-gson>
         <version.googlecode-json-simple>1.1.1</version.googlecode-json-simple>
         <version.hadoop>3.3.5</version.hadoop>
         <version.hadoop-shaded>1.1.1</version.hadoop-shaded>
@@ -75,13 +82,27 @@
         <version.infinispan>9.4.21.Final</version.infinispan>
         <version.jackson>2.10.0.pr1</version.jackson>
         <version.jackson-mapper-asl>1.9.13</version.jackson-mapper-asl>
+        <version.jakarta.annotation-api>1.3.4</version.jakarta.annotation-api>
+        <version.jakarta.xml.bind-api>2.3.3</version.jakarta.xml.bind-api>
         <version.javassist>3.24.0-GA</version.javassist>
         <version.javastatsd>3.1.0</version.javastatsd>
         <version.javax-validation>2.0.1.Final</version.javax-validation>
+        <version.javax.inject>1</version.javax.inject>
+        <version.javax.jaxb-api>2.2.11</version.javax.jaxb-api>
+        <version.javax.mail-api>1.5.4</version.javax.mail-api>
+        <version.javax.servlet-api>2.5</version.javax.servlet-api>
+        <version.javax.ws.rs-api>2.1.1</version.javax.ws.rs-api>
+        <version.jboss>1.0.1.Final</version.jboss>
+        <version.jboss-servlet-api-4.0>1.0.0.Final</version.jboss-servlet-api-4.0>
+        <version.jboss.logging>3.4.0.Final</version.jboss.logging>
+        <version.jboss.resteasy>3.0.12.Final</version.jboss.resteasy>
+        <version.jboss.shrinkwrap>1.2.6</version.jboss.shrinkwrap>
+        <version.jboss.xnio>3.7.2.Final</version.jboss.xnio>
         <version.jcommander>1.72</version.jcommander>
         <version.jetty>6.1.26</version.jetty>
         <version.jgroups>4.0.19.Final</version.jgroups>
         <version.jjwt>0.11.2</version.jjwt>
+        <version.jline>2.12</version.jline>
         <version.json>20231013</version.json>
         <version.jts>1.19.0</version.jts>
         <version.junit>4.13.2</version.junit>
@@ -91,6 +112,7 @@
         <version.kryonet>2.20</version.kryonet>
         <version.log4j2>2.17.2</version.log4j2>
         <version.lucene>7.5.0</version.lucene>
+        <version.maven-enforcer-plugin>3.4.1</version.maven-enforcer-plugin>
         <version.maven-install-plugin>2.5.2</version.maven-install-plugin>
         <version.metrics-cdi>1.6.0</version.metrics-cdi>
         <version.microservice.accumulo-api>3.0.0</version.microservice.accumulo-api>
@@ -109,6 +131,7 @@
         <version.mysql-connector>8.0.28</version.mysql-connector>
         <version.netty>4.1.42.Final</version.netty>
         <version.objenesis>2.1</version.objenesis>
+        <version.opencsv>2.3</version.opencsv>
         <version.picketbox>5.0.3.Final</version.picketbox>
         <version.powermock>2.0.9</version.powermock>
         <version.protobuf>3.16.3</version.protobuf>
@@ -120,14 +143,19 @@
         <version.stream>2.9.6</version.stream>
         <version.surefire.plugin>3.2.5</version.surefire.plugin>
         <version.thrift>0.17.0</version.thrift>
+        <version.undertow-core>2.0.21.Final</version.undertow-core>
+        <version.undertow-servlet>1.2.6.Final</version.undertow-servlet>
         <version.weld>3.1.1.Final</version.weld>
         <version.weld-se>3.1.1.Final</version.weld-se>
         <!-- Different version of weld for tests since the Arquillian embedded EE container needs an older version. -->
         <version.weld-test>2.3.5.Final</version.weld-test>
         <version.wildfly>17.0.1.Final</version.wildfly>
+        <version.wildfly-common>1.5.1.Final</version.wildfly-common>
+        <version.wildfly-elytron>1.9.1.Final</version.wildfly-elytron>
         <version.woodstox-core>5.4.0</version.woodstox-core>
         <version.woodstox-stax2>3.1.4</version.woodstox-stax2>
         <version.xerces>2.12.2</version.xerces>
+        <version.xml-apis>1.4.01</version.xml-apis>
         <version.zookeeper>3.8.3</version.zookeeper>
         <!-- Unless a version is duplicated multiple times, just place the version on the dependency in dependencyManagement. -->
     </properties>
@@ -1421,7 +1449,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-dependency-plugin</artifactId>
-                    <version>3.1.1</version>
+                    <version>3.4.0</version>
                     <dependencies>
                         <dependency>
                             <groupId>ch.qos.reload4j</groupId>
@@ -1449,7 +1477,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-enforcer-plugin</artifactId>
-                    <version>3.0.0</version>
+                    <version>${version.maven-enforcer-plugin}</version>
                     <executions>
                         <execution>
                             <id>enforce-maven</id>
@@ -1474,8 +1502,12 @@
                                     <bannedDependencies>
                                         <excludes>
                                             <exclude>log4j:log4j</exclude>
+                                            <exclude>ch.qos.reload4j:reload4j</exclude>
                                             <exclude>org.slf4j:slf4j-log4j12</exclude>
+                                            <exclude>org.slf4j:slf4j-reload4j</exclude>
+                                            <exclude>joda-time:joda-time</exclude>
                                         </excludes>
+                                        <searchTransitive>true</searchTransitive>
                                     </bannedDependencies>
                                 </rules>
                                 <fail>true</fail>
@@ -1761,7 +1793,7 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-enforcer-plugin</artifactId>
-                        <version>3.3.0</version>
+                        <version>${version.maven-enforcer-plugin}</version>
                         <dependencies>
                             <dependency>
                                 <groupId>de.skuzzle.enforcer</groupId>
@@ -2228,7 +2260,7 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-enforcer-plugin</artifactId>
-                        <version>3.3.0</version>
+                        <version>${version.maven-enforcer-plugin}</version>
                         <executions>
                             <execution>
                                 <id>enforce-versions</id>

diff --git a/warehouse/accumulo-extensions/pom.xml b/warehouse/accumulo-extensions/pom.xml
@@ -9,35 +9,33 @@
     <artifactId>datawave-accumulo-extensions</artifactId>
     <name>${project.artifactId}</name>
     <dependencies>
-        <dependency>
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-        </dependency>
         <dependency>
             <groupId>org.apache.accumulo</groupId>
             <artifactId>accumulo-core</artifactId>
         </dependency>
-        <dependency>
-            <groupId>org.apache.accumulo</groupId>
-            <artifactId>accumulo-server-base</artifactId>
-        </dependency>
         <dependency>
             <groupId>org.apache.hadoop</groupId>
             <artifactId>hadoop-client-api</artifactId>
+            <version>${version.hadoop}</version>
         </dependency>
         <dependency>
-            <groupId>org.apache.hadoop</groupId>
-            <artifactId>hadoop-client-runtime</artifactId>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-1.2-api</artifactId>
         </dependency>
         <dependency>
-            <groupId>com.fasterxml.woodstox</groupId>
-            <artifactId>woodstox-core</artifactId>
-            <scope>provided</scope>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
         </dependency>
         <dependency>
-            <groupId>org.apache.accumulo</groupId>
-            <artifactId>accumulo-start</artifactId>
-            <scope>provided</scope>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>gov.nsa.datawave</groupId>
+            <artifactId>datawave-common-test</artifactId>
+            <version>${project.version}</version>
+            <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>junit</groupId>

diff --git a/warehouse/assemble/webservice/pom.xml b/warehouse/assemble/webservice/pom.xml
@@ -9,25 +9,18 @@
     <artifactId>assemble-webservice</artifactId>
     <name>${project.artifactId}</name>
     <dependencies>
-        <dependency>
-            <groupId>commons-configuration</groupId>
-            <artifactId>commons-configuration</artifactId>
-        </dependency>
         <dependency>
             <groupId>gov.nsa.datawave</groupId>
             <artifactId>datawave-ingest-core</artifactId>
         </dependency>
         <dependency>
-            <groupId>gov.nsa.datawave</groupId>
-            <artifactId>datawave-query-core</artifactId>
+            <groupId>org.apache.accumulo</groupId>
+            <artifactId>accumulo-core</artifactId>
         </dependency>
         <dependency>
             <groupId>org.apache.hadoop</groupId>
             <artifactId>hadoop-client-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.hadoop</groupId>
-            <artifactId>hadoop-client-runtime</artifactId>
+            <version>${version.hadoop}</version>
         </dependency>
         <dependency>
             <groupId>org.powermock</groupId>
@@ -37,40 +30,5 @@
             <groupId>org.powermock</groupId>
             <artifactId>powermock-module-junit4</artifactId>
         </dependency>
-        <dependency>
-            <groupId>gov.nsa.datawave.webservices</groupId>
-            <artifactId>datawave-ws-client</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>gov.nsa.datawave.webservices</groupId>
-            <artifactId>datawave-ws-common</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>gov.nsa.datawave.webservices</groupId>
-            <artifactId>datawave-ws-common-util</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>gov.nsa.datawave.webservices</groupId>
-            <artifactId>datawave-ws-map-reduce</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>gov.nsa.datawave.webservices</groupId>
-            <artifactId>datawave-ws-query</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.jboss.resteasy</groupId>
-            <artifactId>resteasy-jaxrs</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>junit</groupId>
-            <artifactId>junit</artifactId>
-            <scope>test</scope>
-        </dependency>
     </dependencies>
 </project>
diff --git a/warehouse/common/pom.xml b/warehouse/common/pom.xml
@@ -9,10 +9,6 @@
     <artifactId>datawave-common</artifactId>
     <name>${project.artifactId}</name>
     <dependencies>
-        <dependency>
-            <groupId>com.clearspring.analytics</groupId>
-            <artifactId>stream</artifactId>
-        </dependency>
         <dependency>
             <groupId>commons-cli</groupId>
             <artifactId>commons-cli</artifactId>
@@ -21,31 +17,6 @@
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
         </dependency>
-        <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>net.sf.opencsv</groupId>
-            <artifactId>opencsv</artifactId>
-            <version>2.3</version>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.accumulo</groupId>
-            <artifactId>accumulo-core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-1.2-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-core</artifactId>
-        </dependency>
         <dependency>
             <groupId>org.easymock</groupId>
             <artifactId>easymock</artifactId>