Bump org.apache.rat:apache-rat-plugin from 0.16.1 to 0.18

[dependabot]

Bumps org.apache.rat:apache-rat-plugin from 0.16.1 to 0.18.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[slawekjaranowski]

To check .... 0.18 requires JDK 17+

https://issues.apache.org/jira/browse/RAT-478
https://creadur.apache.org/rat/changes.html#a0.18

[ottlinger]

@slawekjaranowski if I'm not too mistaken you may run with older JDKs, but any animal-sniffer-runs will fail as we rely on dependencies requiring >=JDK17.

As a compromise Creadur 0.17 could be used within the ASF parent.

[slawekjaranowski]

Last time we revert updates to 0.17

• #561

[slawekjaranowski]

I would like to update to 0.18, in ASF parent we don't have any execution neither configuration, we only manage a version.

Child projects should manage executing in proper JDK, eg by profiles if needed.

[slachiewicz]

Agree, better to use latest version

[slachiewicz]

[INFO] --- apache-rat:0.18:check (rat-check) @ mvnd-build-maven-plugin ---
[WARNING] Use of deprecated option 'exclude'. Deprecated for removal since 0.17: Use <inputExclude> instead.

[WARNING]  * org.apache.rat:apache-rat-plugin:0.18
[WARNING]   Declared at location(s):
[WARNING]    * org.apache.maven:maven-parent:49 (/Users/xxx/.m2/repository/org/apache/maven/maven-parent/49/maven-parent-49.pom) @ line 1328
[WARNING]   Mojo INTERNAL issue(s):
[WARNING]    * Mojo apache-rat:check (org.apache.rat.mp.RatCheckMojo)
[WARNING]      - Parameter 'excludes' is deprecated: Deprecated for removal since 0.17: Use <inputExclude> instead.

[ctubbsii]

If I'm understanding this correctly, executing this plugin requires JDK 17, but the POM specifies a minimalJavaBuildVersion using the javaVersion property, which defaults to 8.

You can't use rat 0.18 with the default settings.

I think upstream creadur/rat needs to fix this before it is updated in the Apache parent POM. They should set a minimalJavaBuildVersion to 17, and set maven.compiler.release to 8 instead of setting maven.compiler.source and maven.compiler.target to 17. It seems that was the intent with their use of the animal sniffer plugin to enforce that it works with Java 8, but they couldn't figure out how to get that to work when building with newer java versions, or something, so they opened mojohaus/animal-sniffer#316 about it and built 0.18 in a way that requires Java 17. I commented on that issue explaining how it needs to be fixed.

I recommend rat remove the animal sniffer plugin, fix their build to target Java 8 release while using a build JDK of 17 and the release flag, and then re-release as 0.19, and then update the Apache parent POM to 0.19 with the fixed rat plugin.

Also, there was another PR against this project that tried to bump to 0.18 (and a redundant issue), which also removed the commons-lang3 dependency override, which this PR does not do.

[ctubbsii]

https://issues.apache.org/jira/browse/RAT-478 and other patches in 0.18 have already gone down the path of strictly requiring at least Java 11 at runtime (tika dependencies require Java 11) and has already made code changes that only compile with Java 17 (pattern matching instanceof). So, it's a bit tricky to have a RAT version that supports the current default Java version in this parent POM, unless RAT is willing to revert some things.

It will not be possible to update rat in this POM unless the minimalJavaBuildVersion is also bumped to 17. That's the path I would recommend. The minimal is currently set to the same as javaVersion, but it doesn't need to be.

[ctubbsii]

Suggested change

	<minimalJavaBuildVersion>17</minimalJavaBuildVersion>

[ctubbsii]

Suggested change