Skip to content

chroe(deps): replace dependencies without license for Airlock onboarding #14692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hj690 wants to merge 2 commits into
base: main
Choose a base branch
from
+208 −19
Open

chroe(deps): replace dependencies without license for Airlock onboarding #14692

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
30e5942
build: replace non-curatable dependencies and align profiles for Airlock
hj690 Oct 20, 2026
df950d7
build: ignore the isorelax replacement in dependency:analyze
hj690 Oct 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 30 additions & 16 deletions google-auth-library-java/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -398,22 +398,6 @@
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>clirr-maven-plugin</artifactId>
<configuration>
<ignoredDifferencesFile>clirr-ignored-differences.xml
</ignoredDifferencesFile>
<logResults>true</logResults>
</configuration>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-resources-plugin</artifactId>
Expand All @@ -437,6 +421,36 @@
</build>

<profiles>
<profile>
<!-- CLIRR in a profile with the same id as java-shared-config, so the release scripts
(-P=-clirr-compatibility-check) do not resolve clirr-maven-plugin 2.8. Its dependency
tree (plexus-components 1.1.4, classworlds 1.1-alpha-2, ...) is not in Airlock
(b/568717591). The JDK activation keeps CLIRR on by default for CI. -->
<id>clirr-compatibility-check</id>
<activation>
<jdk>[1.8,)</jdk>
</activation>
<build>
<plugins>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>clirr-maven-plugin</artifactId>
<configuration>
<ignoredDifferencesFile>clirr-ignored-differences.xml
</ignoredDifferencesFile>
<logResults>true</logResults>
</configuration>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
<profile>
<id>slf4j2x-test</id>
<!-- This profile is for logging test only, use instead of the default slf4j2x -->
Expand Down
32 changes: 32 additions & 0 deletions java-cloud-bom/dashboard/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,19 @@
<groupId>com.google.cloud.tools</groupId>
<artifactId>dependencies</artifactId>
<version>1.5.15</version>
<!-- isorelax:isorelax:20030108 has no license metadata (b/568717591). Use the

@blakeli0 blakeli0 Oct 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

com.google.cloud.tools:dependencies is from https://github.com/GoogleCloudPlatform/cloud-opensource-java/blob/master/dependencies/pom.xml which is also owned by us. Can we update isorelax there, make a new release and then update the version here? So that we don't have to exclude it in multiple different places?

same JARV classes from org.netbeans.external:isorelax (MIT, version 20041111). -->
<exclusions>
<exclusion>
<groupId>isorelax</groupId>
<artifactId>isorelax</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.netbeans.external</groupId>
<artifactId>isorelax</artifactId>
<version>RELEASE310</version>
</dependency>
<dependency>
<groupId>com.google.code.findbugs</groupId>
Expand All @@ -134,6 +147,25 @@

<build>
<plugins>
<!-- org.netbeans.external:isorelax replaces isorelax:isorelax (see the dependencies above).
com.google.cloud.tools:dependencies uses it at runtime. No code in this module uses
it directly, so dependency:analyze reports it as unused. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<configuration>
<ignoredUnusedDeclaredDependencies>
<ignoredUnusedDeclaredDependency>org.netbeans.external:isorelax</ignoredUnusedDeclaredDependency>
</ignoredUnusedDeclaredDependencies>
</configuration>
</plugin>
<!-- The parent (dependencies-parent 1.5.15) pins surefire 2.22.2, which pulls slf4j-api:1.5.6
and classworlds:1.1. Those are not in Airlock (b/568717591). -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>3.5.3</version>
</plugin>
Comment thread
hj690 marked this conversation as resolved.
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>exec-maven-plugin</artifactId>
Expand Down
26 changes: 26 additions & 0 deletions java-cloud-bom/libraries-release-data/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,20 @@
<artifactId>dependencies</artifactId>
<version>1.5.15</version>
<scope>compile</scope>
<!-- isorelax:isorelax:20030108 has no license metadata (b/568717591). Use the
same JARV classes from org.netbeans.external:isorelax (MIT, version 20041111). -->
<exclusions>
<exclusion>
<groupId>isorelax</groupId>
<artifactId>isorelax</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.netbeans.external</groupId>
<artifactId>isorelax</artifactId>
<version>RELEASE310</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.apache.maven.resolver</groupId>
Expand All @@ -37,6 +51,18 @@

<build>
<plugins>
<!-- org.netbeans.external:isorelax replaces isorelax:isorelax (see the dependencies above).
com.google.cloud.tools:dependencies uses it at runtime. No code in this module uses
it directly, so dependency:analyze reports it as unused. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<configuration>
<ignoredUnusedDeclaredDependencies>
<ignoredUnusedDeclaredDependency>org.netbeans.external:isorelax</ignoredUnusedDeclaredDependency>
</ignoredUnusedDeclaredDependencies>
</configuration>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>exec-maven-plugin</artifactId>
Expand Down
16 changes: 15 additions & 1 deletion java-cloud-bom/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,11 +44,25 @@
<module>release-note-generation</module>
<module>libraries-release-data</module>
<module>tests</module>
<module>tests/dependency-convergence</module>
<!-- tests/dependency-convergence is not in the reactor. It depends on every artifact of the
latest libraries-bom, so a release resolves the whole release train it just published.
Under Airlock-only resolution that fails until Airlock imports every new 1P artifact
(b/568717591). CI runs it on its own: .kokoro/dashboard.sh (dependency-convergence-check). -->
<module>tests/validate-bom</module>
</modules>

<build>
<pluginManagement>

@blakeli0 blakeli0 Oct 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

java-shared-config already contains maven-surefire-plugin v3.5.2. It is the parent for pretty much all other modules, can we make java-cloud-pom extend from java-shared-config as well? So we have only one place for the plugin version.

<plugins>
<!-- Pin surefire. Without a pin, Maven uses its default binding (2.17 on Maven 3.9.12), which
pulls classworlds:1.1 and classworlds:1.1-alpha-2. Those are not in Airlock (b/568717591). -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>3.5.3</version>
</plugin>
Comment thread
hj690 marked this conversation as resolved.
</plugins>
</pluginManagement>
<plugins>
<plugin>
<!-- This root pom.xml is not referenced by the BOMs and no need to
Expand Down
25 changes: 25 additions & 0 deletions java-cloud-bom/release-note-generation/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,19 @@
<groupId>com.google.cloud.tools</groupId>
<artifactId>dependencies</artifactId>
<version>1.5.15</version>
<!-- isorelax:isorelax:20030108 has no license metadata (b/568717591). Use the
same JARV classes from org.netbeans.external:isorelax (MIT, version 20041111). -->
<exclusions>
<exclusion>
<groupId>isorelax</groupId>
<artifactId>isorelax</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.netbeans.external</groupId>
<artifactId>isorelax</artifactId>
<version>RELEASE310</version>
</dependency>
<dependency>
<groupId>junit</groupId>
Expand Down Expand Up @@ -53,6 +66,18 @@

<build>
<plugins>
<!-- org.netbeans.external:isorelax replaces isorelax:isorelax (see the dependencies above).
com.google.cloud.tools:dependencies uses it at runtime. No code in this module uses
it directly, so dependency:analyze reports it as unused. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<configuration>
<ignoredUnusedDeclaredDependencies>
<ignoredUnusedDeclaredDependency>org.netbeans.external:isorelax</ignoredUnusedDeclaredDependency>
</ignoredUnusedDeclaredDependencies>
</configuration>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>exec-maven-plugin</artifactId>
Expand Down
26 changes: 26 additions & 0 deletions java-cloud-bom/tests/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,20 @@
<artifactId>dependencies</artifactId>
<version>1.5.15</version>
<scope>test</scope>
<!-- isorelax:isorelax:20030108 has no license metadata (b/568717591). Use the
same JARV classes from org.netbeans.external:isorelax (MIT, version 20041111). -->
<exclusions>
<exclusion>
<groupId>isorelax</groupId>
<artifactId>isorelax</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.netbeans.external</groupId>
<artifactId>isorelax</artifactId>
<version>RELEASE310</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.google.truth</groupId>
Expand Down Expand Up @@ -86,6 +100,18 @@
<build>
<!-- To use the plugin goals in your POM or parent POM -->
<plugins>
<!-- org.netbeans.external:isorelax replaces isorelax:isorelax (see the dependencies above).
com.google.cloud.tools:dependencies uses it at runtime. No code in this module uses
it directly, so dependency:analyze reports it as unused. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<configuration>
<ignoredUnusedDeclaredDependencies>
<ignoredUnusedDeclaredDependency>org.netbeans.external:isorelax</ignoredUnusedDeclaredDependency>
</ignoredUnusedDeclaredDependencies>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
Expand Down
25 changes: 25 additions & 0 deletions java-cloud-bom/tests/validate-bom/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,19 @@
<groupId>com.google.cloud.tools</groupId>
<artifactId>dependencies</artifactId>
<version>1.5.15</version>
<!-- isorelax:isorelax:20030108 has no license metadata (b/568717591). Use the
same JARV classes from org.netbeans.external:isorelax (MIT, version 20041111). -->
<exclusions>
<exclusion>
<groupId>isorelax</groupId>
<artifactId>isorelax</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.netbeans.external</groupId>
<artifactId>isorelax</artifactId>
<version>RELEASE310</version>
</dependency>
<dependency>
<groupId>org.apache.maven.resolver</groupId>
Expand All @@ -73,6 +86,18 @@

<build>
<plugins>
<!-- org.netbeans.external:isorelax replaces isorelax:isorelax (see the dependencies above).
com.google.cloud.tools:dependencies uses it at runtime. No code in this module uses
it directly, so dependency:analyze reports it as unused. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<configuration>
<ignoredUnusedDeclaredDependencies>
<ignoredUnusedDeclaredDependency>org.netbeans.external:isorelax</ignoredUnusedDeclaredDependency>
</ignoredUnusedDeclaredDependencies>
</configuration>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>exec-maven-plugin</artifactId>
Expand Down
2 changes: 1 addition & 1 deletion java-samples/native-image-sample/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
<dependency>
<groupId>com.google.cloud</groupId>
<artifactId>libraries-bom</artifactId>
<version>26.86.0</version>
<version>26.90.0</version>
<type>pom</type>
<scope>import</scope>
</dependency>
Expand Down
2 changes: 1 addition & 1 deletion java-spanner/samples/snippets/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@
<dependency>
<groupId>com.google.cloud</groupId>
<artifactId>libraries-bom</artifactId>
<version>26.80.0</version>
<version>26.90.0</version>
<type>pom</type>
<scope>import</scope>
</dependency>
Expand Down
14 changes: 14 additions & 0 deletions sdk-platform-java/java-shared-dependencies/dependency-convergence-check/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,20 @@
<artifactId>dependencies</artifactId>
<version>1.5.13</version>
<scope>test</scope>
<!-- isorelax:isorelax:20030108 has no license metadata (b/568717591). Use the
same JARV classes from org.netbeans.external:isorelax (MIT, version 20041111). -->
<exclusions>
<exclusion>
<groupId>isorelax</groupId>
<artifactId>isorelax</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.netbeans.external</groupId>
<artifactId>isorelax</artifactId>
<version>RELEASE310</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>junit</groupId>
Expand Down
13 changes: 13 additions & 0 deletions sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,19 @@
<groupId>com.google.cloud.tools</groupId>
<artifactId>dependencies</artifactId>
<version>1.5.13</version>
<!-- isorelax:isorelax:20030108 has no license metadata (b/568717591). Use the
same JARV classes from org.netbeans.external:isorelax (MIT, version 20041111). -->
<exclusions>
<exclusion>
<groupId>isorelax</groupId>
<artifactId>isorelax</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.netbeans.external</groupId>
<artifactId>isorelax</artifactId>
<version>RELEASE310</version>
</dependency>
<dependency>
<groupId>junit</groupId>
Expand Down
Loading