Upgrade org.apache.commons.fileupload to latest version (1.4.0)

[eclipse-rap]

Upgrade org.apache.commons.fileupload to latest version (1.4.0)

[mknauer]

Reading the 1.4 release notes I don't see any reason or incompatibility that would require to keep the older 1.3.3 version that was mentioned in the original bug report. Instead I would suggest to start upgrading to 1.4.

Additionally I believe there is no further IP check required for the library dependency upgrade in RAP Runtime. First, there is an already approved CQ 21543 available for another project in the files, second (and more important) according to the project handbook, ClearlyDefined is a trusted source of license information. By using the Eclipse Dash License Tool I get the following positive result for maven/mavencentral/commons-fileupload/commons-fileupload/1.4 from ClearlyDefined:

$ echo "maven/mavencentral/commons-fileupload/commons-fileupload/1.4" | java -jar org.eclipse.dash.licenses-0.0.1-20220803.055044-505.jar -
[main] INFO Querying Eclipse Foundation for license data for 1 items.
[main] INFO Found 0 items.
[main] INFO Querying ClearlyDefined for license data for 1 items.
[main] INFO Found 1 items.
[main] INFO Vetted license information was found for all content. No further investigation is required.

Unfortunately none of the clean versions are available for consumption from Eclipse Orbit, i.e. we need to find a good way to integrate this library in the RAP build process.

[mknauer]

The fix includes...

• the update of org.apache.commons.fileupload 1.3.2 to org.apache.commons.commons-fileupload 1.4.0 and
• the update of org.apache.commons.io 2.2 to org.apache.commons.commons-io 2.11.0.

Please note that the bundle symbolic name has changed because the new bundles are now consumed from Eclipse Platform which itself started to consume them directly from Maven Central.

[bwolff]

Hi,

I run into a Maven dependency resolution issue related to the version bump of commons-fileupload to 1.4.0 in my project. It seems the resulting POM dependency entry of org.apache.commons.fileupload looks like this:

<dependency>
  <groupId>commons-fileupload</groupId>
  <artifactId>commons-fileupload</artifactId>
  <version>1.4.0</version>
</dependency>

It refers to version 1.4.0, but the actual version of the commons-fileupload artefact is 1.4 (d'oh!). See: https://search.maven.org/artifact/commons-fileupload/commons-fileupload/1.4/jar

Maven treats versions 1.4 and 1.4.0 differently and fails to resolve the correct artefact from Maven central. The workaround is to declare a direct dependency to commons-fileupload in version 1.4.

I'm not sure how the pom.xml is generated, but it probably takes the information from the bundle dependencies, which afaik requires the use of the 3 part semvers, so there might be a version incompatibility between the bundle and Maven dependency worlds.

NB: I should mention that I'm experiencing this problem in a Gradle build and haven't tested it with a Maven build. However, since the version in the pom does not correspond to the artefact version in Maven central, other Maven builds might run into this issue as well.