The month of September was a bit more quiet regarding the activity of the Stewardship SIG, though we again managed to push some important changes and updates, both to reduce the number of packages we possibly need to maintain, and to bring the whole stack into better shape and more up-to-date again.

We removed some unused functionality from our packages, which let us trim the dependency tree some more. Notably, by dropping the direct dependency of Maven on logback, our packages no longer require Groovy or Gradle, not even transitively.

The support for Markdown in the doxia maven modules was also removed in preparation for version updates, which would introduce not-yet-packaged dependencies for the Markdown support anyway.

The unused support for memoryfilesystem was removed from assertj-core to further reduce the number of packages we need to maintain.

package version release changes
maven 3.5.4 12.fc32, 12.fc31 remove dependency on logback
maven-doxia-sitetools 1.7.5 6.fc32 disable markdown support
maven-doxia 1.7 12.fc32 disable itext support
assertj-core 3.8.0 6.fc32 drop memoryfilesystem dependency

We also worked on getting updates for Jackson out fast, since some security vulnerabilities for jackson-databind were recently published (CVE-2019-12086, CVE-2019-12384, CVE-2019-12814, CVE-2019-14379, CVE-2019-14439). These have all been fixed with the 2.9.9.3 release of jackson-databind, which required updating its sister projects to 2.9.9 as well.

package version release changes
jackson-bom 2.9.9 1.fc32, 1.fc31, 1.fc30, 1.fc29 2.9.8 → 2.9.9
jackson-annotations 2.9.9 1.fc32, 1.fc31, 1.fc30, 1.fc29 2.9.8 → 2.9.9
jackson-core 2.9.9 1.fc32, 1.fc31, 1.fc30, 1.fc29 2.9.8 → 2.9.9
jackson-databind 2.9.9.3 1.fc32, 1.fc31, 1.fc30, 1.fc29 2.9.8 → 2.9.9.3

We also managed to finally update some packages related to maven-invoker to their latest versions, which required a coordinated update to maven-invoker, maven-invoker-plugin, and a patch to port xmvn to these new versions.

package version release changes
maven-invoker 3.0.1 1.fc32 2.2 → 3.0.1
maven-invoker-plugin 3.2.0 1.fc32 1.10 → 3.2.0
xmvn 3.0.0 27.fc32 port to maven-invoker 3.0.1

Recently, the old Felix OSGi implementation was retired from fedora, in favor of OSGi Core 7.0.0, and all packages using the old Felix implementation needed to migrate. With some help from Mat Booth I pushed the necessary changes to all our packages (and some others as well, not listed below).

package version release changes
apache-commons-compress 1.18 7.fc32 migrate to osgi-core
snappy-java 1.1.2.4 13.fc32 migrate to osgi-core
xbean 4.14 2.fc32 migrate to osgi-core
woodstox-core 6.0.1 2.fc32 5.2.1 → 6.0.1 and migrate to OSGi 7

Last, we were able to update both maven-doxia and maven-doxia-sitetools to their latest versions. As mentioned above, this meant disabling the (unused) support for Markdown, since the library that’s used for Markdown support was changed from pegdown (which was packaged for fedora) to flexmark, which isn’t available in fedora.

package version release changes
maven-doxia 1.9 1.fc32 1.7 → 1.9
maven-doxia-sitetools 1.9.1 1.fc32 1.7.5 → 1.9.1