java.lang.ClassNotFoundException: org.apache.commons.codec.Charsets with 9.0.10

[andreas-hartmann]

java.lang.ClassNotFoundException: org.apache.commons.codec.Charsets with 9.0.10

[ina-lieder]

@jeremylong unfortunately the suggested fix didn't work, the error still happens.

Please have a look at the bug described here "https://issues.apache.org/jira/browse/COMPRESS-659".
The affected version is 1.26.0 (it is the version used by dependencyCheck from the version 9.0.10)

An update to version Commons Compress 1.26.1 would probably fix the problem.

[jeremylong]

fixed with jeremylong/DependencyCheck#6585

[ina-lieder]

It looks like it's related to:

"Commons-compress 1.26.0 contains changes to make use of commons-codec,
rather than its own copy of files, but I see that the POM marks
commons-codec as optional."

-> https://www.mail-archive.com/[email protected]/msg74958.html

[jeremylong]

I wish I would have re-read this issue an hour ago... Temporary fix is likely just updating the current workaround:

https://github.com/dependency-check/dependency-check-gradle?tab=readme-ov-file#gradle-build-environment

/buildSrc/build.gradle

dependencies {
    constraints {
        // org.owasp.dependencycheck needs at least this version of jackson. Other plugins pull in older versions..
        add("implementation", "com.fasterxml.jackson:jackson-bom:2.16.1")
        // org.owasp.dependencycheck needs these versions. Other plugins pull in older versions..
        add("implementation", "org.apache.commons:commons-lang3:3.14.0")
        add("implementation", "org.apache.commons:commons-text:1.11.0")
    }
    compileOnly 'commons-codec:commons-codec:1.16.1'
}

[jeremylong]

Did you notice the typo I made in the suggestion?

/buildSrc/build.gradle

dependencies {
    constraints {
        // org.owasp.dependencycheck needs at least this version of jackson. Other plugins pull in older versions..
        add("implementation", "com.fasterxml.jackson:jackson-bom:2.16.1")
        // org.owasp.dependencycheck needs these versions. Other plugins pull in older versions..
        add("implementation", "org.apache.commons:commons-lang3:3.14.0")
        add("implementation", "org.apache.commons:commons-text:1.11.0")
    }
    compileOnly 'commons-codec:commons-codec:1.26.1'
}

[ina-lieder]

@jeremylong thank you for your answer!

Im not sure whar the correct correction should be :) The last published version of commons-codec is, like suggested in the first fix, the v1.16.1 (https://mvnrepository.com/artifact/commons-codec/commons-codec)

If you mean, we should force the gradle resolution of commons-compress to v1.26.1 - it's allready done in our projects and the error remains the same..