LUCENE-5715: Upgrade direct dependencies known to be older than transitive dependencies

git-svn-id: https://svn.apache.org/repos/asf/lucene/dev/trunk@1600444 13f79535-47bb-0310-9956-ffa450edef68

lucene/CHANGES.txt

@@ -293,6 +293,14 @@ Build
   specifiable in lucene/ivy-ignore-conflicts.properties.
   (Steve Rowe)
   
+* LUCENE-5715: Upgrade direct dependencies known to be older than transitive
+  dependencies: com.sun.jersey.version:1.8->1.9; com.sun.xml.bind:jaxb-impl:2.2.2->2.2.3-1;
+  commons-beanutils:commons-beanutils:1.7.0->1.8.3; commons-digester:commons-digester:2.0->2.1;
+  commons-io:commons-io:2.1->2.3; commons-logging:commons-logging:1.1.1->1.1.3;
+  io.netty:netty:3.6.2.Final->3.7.0.Final; javax.activation:activation:1.1->1.1.1;
+  javax.mail:mail:1.4.1->1.4.3; log4j:log4j:1.2.16->1.2.17; org.apache.avro:avro:1.7.4->1.7.5;
+  org.tukaani:xz:1.2->1.4; org.xerial.snappy:snappy-java:1.0.4.1->1.0.5 (Steve Rowe)
+
 ======================= Lucene 4.8.1 =======================
 
 Bug fixes

lucene/ivy-ignore-conflicts.properties

@@ -10,23 +10,5 @@
 # trigger a conflict) when the ant check-lib-versions target is run.
 
 /com.google.guava/guava = 16.0.1
-
-com.sun.jersey.ignore.versions = 1.9
-/com.sun.jersey.contribs/jersey-guice = ${com.sun.jersey.ignore.versions}
-/com.sun.jersey/jersey-core = ${com.sun.jersey.ignore.versions}
-/com.sun.jersey/jersey-json = ${com.sun.jersey.ignore.versions}
-/com.sun.jersey/jersey-server = ${com.sun.jersey.ignore.versions}
-
-/com.sun.xml.bind/jaxb-impl = 2.2.3-1
-/commons-beanutils/commons-beanutils = 1.8.0, 1.8.3
-/commons-digester/commons-digester = 2.1
-/commons-io/commons-io = 2.3
-/commons-logging/commons-logging = 1.1.3
-/io.netty/netty = 3.7.0.Final
-/javax.activation/activation = 1.1.1
 /javax.servlet/servlet-api = 2.5, 3.0-alpha-1
-/log4j/log4j = 1.2.17
-/org.apache.avro/avro = 1.7.5
 /org.ow2.asm/asm = 5.0_BETA
-/org.tukaani/xz = 1.4
-/org.xerial.snappy/snappy-java = 1.0.5

lucene/ivy-versions.properties

@@ -38,42 +38,42 @@ com.google.inject.guice.version = 3.0
 /com.ibm.icu/icu4j = 53.1
 /com.spatial4j/spatial4j = 0.4.1
 
-com.sun.jersey.version = 1.8
+com.sun.jersey.version = 1.9
 /com.sun.jersey.contribs/jersey-guice = ${com.sun.jersey.version}
 /com.sun.jersey/jersey-bundle = ${com.sun.jersey.version}
 /com.sun.jersey/jersey-core = ${com.sun.jersey.version}
 /com.sun.jersey/jersey-json = ${com.sun.jersey.version}
 /com.sun.jersey/jersey-server = ${com.sun.jersey.version}
 
-/com.sun.xml.bind/jaxb-impl = 2.2.2
+/com.sun.xml.bind/jaxb-impl = 2.2.3-1
 /com.thoughtworks.paranamer/paranamer = 2.3
 /com.typesafe/config = 1.0.2
 /com.uwyn/jhighlight = 1.0
-/commons-beanutils/commons-beanutils = 1.7.0
+/commons-beanutils/commons-beanutils = 1.8.3
 /commons-cli/commons-cli = 1.2
 /commons-codec/commons-codec = 1.9
 /commons-collections/commons-collections = 3.2.1
 /commons-configuration/commons-configuration = 1.6
-/commons-digester/commons-digester = 2.0
+/commons-digester/commons-digester = 2.1
 /commons-fileupload/commons-fileupload = 1.2.1
-/commons-io/commons-io = 2.1
+/commons-io/commons-io = 2.3
 /commons-lang/commons-lang = 2.6
-/commons-logging/commons-logging = 1.1.1
+/commons-logging/commons-logging = 1.1.3
 /de.l3s.boilerpipe/boilerpipe = 1.1.0
 /dom4j/dom4j = 1.6.1
 /edu.ucar/netcdf = 4.2-min
 /hsqldb/hsqldb = 1.8.0.10
-/io.netty/netty = 3.6.2.Final
+/io.netty/netty = 3.7.0.Final
 /jakarta-regexp/jakarta-regexp = 1.4
-/javax.activation/activation = 1.1
+/javax.activation/activation = 1.1.1
 /javax.inject/javax.inject= 1
-/javax.mail/mail = 1.4.1
+/javax.mail/mail = 1.4.3
 /javax.servlet/javax.servlet-api = 3.0.1
 /javax.servlet/servlet-api = 2.4
 /jdom/jdom = 1.0
 /joda-time/joda-time = 2.2
 /junit/junit = 4.10
-/log4j/log4j = 1.2.16
+/log4j/log4j = 1.2.17
 /mecab/mecab-ipadic = 2.7.0-20070801
 /mecab/mecab-naist-jdic = 0.6.3b-20111013
 /net.arnx/jsonic = 1.2.7
@@ -82,7 +82,7 @@ com.sun.jersey.version = 1.8
 /net.sourceforge.nekohtml/nekohtml = 1.9.17
 /org.antlr/antlr-runtime = 3.5
 /org.apache.ant/ant = 1.8.2
-/org.apache.avro/avro = 1.7.4
+/org.apache.avro/avro = 1.7.5
 /org.apache.commons/commons-compress = 1.7
 /org.apache.derby/derby = 10.9.1.0
 
@@ -228,7 +228,7 @@ org.slf4j.version = 1.7.6
 /org.slf4j/slf4j-api = ${org.slf4j.version}
 /org.slf4j/slf4j-log4j12 = ${org.slf4j.version}
 
-/org.tukaani/xz = 1.2
+/org.tukaani/xz = 1.4
-/org.xerial.snappy/snappy-java = 1.0.4.1
+/org.xerial.snappy/snappy-java = 1.0.5
 /rome/rome = 0.9
 /xerces/xercesImpl = 2.9.1

lucene/licenses/commons-logging-1.1.1.jar.sha1

@@ -1 +0,0 @@
-5043bfebc3db072ed80fbd362e7caf00e885d8ae

lucene/licenses/commons-logging-1.1.3.jar.sha1

@@ -0,0 +1 @@
+f6f66e966c70a83ffbdb6f17a0919eaf7c8aca7f

lucene/tools/src/java/org/apache/lucene/validation/LibVersionsCheckTask.java

@@ -29,6 +29,7 @@ import org.apache.lucene.validation.ivyde.IvyNodeElementAdapter;
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.Project;
 import org.apache.tools.ant.Task;
+import org.apache.tools.ant.types.LogLevel;
 import org.apache.tools.ant.types.Resource;
 import org.apache.tools.ant.types.ResourceCollection;
 import org.apache.tools.ant.types.resources.FileResource;
@@ -131,7 +132,7 @@ public class LibVersionsCheckTask extends Task {
    * be conflicting indirect dependencies if Lucene/Solr
    * were to use transitive dependencies.
    */
-  private Map<String,Versions> directDependencies = new LinkedHashMap<>();
+  private Map<String,Dependency> directDependencies = new LinkedHashMap<>();
 
   /**
    * All /org/name keys found in ivy-ignore-conflicts.properties,
@@ -140,12 +141,18 @@ public class LibVersionsCheckTask extends Task {
    */
   private Map<String,HashSet<String>> ignoreConflictVersions = new HashMap<>();
 
-  private class Versions {
+  private class Dependency {
-    String direct;
+    String org;
-    LinkedHashMap<IvyNodeElement,Set<String>> conflictLocations = new LinkedHashMap<>(); // dependency path -> moduleNames
+    String name;
+    String directVersion;
+    String latestVersion;
     boolean directlyReferenced = false;
-    Versions(String direct) {
+    LinkedHashMap<IvyNodeElement,Set<String>> conflictLocations = new LinkedHashMap<>(); // dependency path -> moduleNames
-      this.direct = direct;
+    
+    Dependency(String org, String name, String directVersion) {
+      this.org = org;
+      this.name = name;
+      this.directVersion = directVersion;
     }
   }
   
@@ -220,6 +227,9 @@ public class LibVersionsCheckTask extends Task {
         if ( ! resolveTransitively(ivyXmlFile)) {
           ++numErrors;
         }
+        if ( ! findLatestConflictVersions()) {
+          ++numErrors;
+        }
       } catch (Exception e) {
         throw new BuildException("Exception reading file " + ivyXmlFile.getPath() + " - " + e.toString(), e);
       }
@@ -227,7 +237,7 @@ public class LibVersionsCheckTask extends Task {
     }
 
     log("Checking for orphans in " + centralizedVersionsFile.getName(), verboseLevel);
-    for (Map.Entry<String,Versions> entry : directDependencies.entrySet()) {
+    for (Map.Entry<String,Dependency> entry : directDependencies.entrySet()) {
       String coordinateKey = entry.getKey();
       if ( ! entry.getValue().directlyReferenced) {
         log("ORPHAN coordinate key '" + coordinateKey + "' in " + centralizedVersionsFile.getName()
@@ -255,6 +265,67 @@ public class LibVersionsCheckTask extends Task {
     }
   }
 
+  private boolean findLatestConflictVersions() {
+    boolean success = true;
+    StringBuilder latestIvyXml = new StringBuilder();
+    latestIvyXml.append("<ivy-module version=\"2.0\">\n");
+    latestIvyXml.append("  <info organisation=\"org.apache.lucene\" module=\"core-tools-find-latest-revision\"/>\n");
+    latestIvyXml.append("  <configurations>\n");
+    latestIvyXml.append("    <conf name=\"default\" transitive=\"false\"/>\n");
+    latestIvyXml.append("  </configurations>\n");
+    latestIvyXml.append("  <dependencies>\n");
+    for (Map.Entry<String, Dependency> directDependency : directDependencies.entrySet()) {
+      Dependency dependency = directDependency.getValue();
+      if (dependency.conflictLocations.entrySet().isEmpty()) {
+        continue;
+      }
+      latestIvyXml.append("    <dependency org=\"");
+      latestIvyXml.append(dependency.org);
+      latestIvyXml.append("\" name=\"");
+      latestIvyXml.append(dependency.name);
+      latestIvyXml.append("\" rev=\"latest.release\" conf=\"default->*\"/>\n");
+    }
+    latestIvyXml.append("  </dependencies>\n");
+    latestIvyXml.append("</ivy-module>\n");
+    File buildDir = new File(commonBuildDir, "ivy-transitive-resolve");
+    if ( ! buildDir.exists() && ! buildDir.mkdirs()) {
+      throw new BuildException("Could not create temp directory " + buildDir.getPath());
+    }
+    File findLatestIvyXmlFile = new File(buildDir, "find.latest.conflicts.ivy.xml");
+    try {
+      try (Writer writer = new OutputStreamWriter(new FileOutputStream(findLatestIvyXmlFile), StandardCharsets.UTF_8)) {
+        writer.write(latestIvyXml.toString());
+      }
+      ResolveOptions options = new ResolveOptions();
+      options.setDownload(false);           // Download only module descriptors, not artifacts
+      options.setTransitive(false);         // Resolve only direct dependencies
+      options.setUseCacheOnly(false);       // Download the internet!
+      options.setOutputReport(false);       // Don't print to the console
+      options.setLog(LogOptions.LOG_QUIET); // Don't log to the console
+      options.setConfs(new String[] {"*"}); // Resolve all configurations
+      ResolveReport resolveReport = ivy.resolve(findLatestIvyXmlFile.toURI().toURL(), options);
+      IvyNodeElement root = IvyNodeElementAdapter.adapt(resolveReport);
+      for (IvyNodeElement element : root.getDependencies()) {
+        String coordinate = "/" + element.getOrganization() + "/" + element.getName();
+        Dependency dependency = directDependencies.get(coordinate);
+        if (null == dependency) {
+          log("ERROR: the following coordinate key does not appear in "
+              + centralizedVersionsFile.getName() + ": " + coordinate, Project.MSG_ERR);
+          success = false;
+        } else {
+          dependency.latestVersion = element.getRevision();
+        }
+      }
+    } catch (IOException e) {
+      log("Exception writing to " + findLatestIvyXmlFile.getPath() + ": " + e.toString(), Project.MSG_ERR);
+      success = false;
+    } catch (ParseException e) {
+      log("Exception parsing filename " + findLatestIvyXmlFile.getPath() + ": " + e.toString(), Project.MSG_ERR);
+      success = false;
+    }
+    return success;
+  }
+
   /**
    * Collects indirect dependency version conflicts to ignore 
    * in ivy-ignore-conflicts.properties, and also checks for orphans
@@ -300,10 +371,13 @@ public class LibVersionsCheckTask extends Task {
     }
     for (Object obj : properties.keySet()) {
       String coordinate = (String)obj;
-      if (COORDINATE_KEY_PATTERN.matcher(coordinate).matches()) {
+      Matcher matcher = COORDINATE_KEY_PATTERN.matcher(coordinate);
-        String direct = properties.getProperty(coordinate);
+      if (matcher.matches()) {
-        Versions versions = new Versions(direct);
+        String org = matcher.group(2);
-        directDependencies.put(coordinate, versions);
+        String name = matcher.group(3);
+        String directVersion = properties.getProperty(coordinate);
+        Dependency dependency = new Dependency(org, name, directVersion);
+        directDependencies.put(coordinate, dependency);
       }
     }
   }
@@ -311,7 +385,7 @@ public class LibVersionsCheckTask extends Task {
   /**
    * Transitively resolves all dependencies in the given ivy.xml file,
    * looking for indirect dependencies with versions that conflict
-   * with those of direct dependencies.  Versions conflict when a
+   * with those of direct dependencies.  Dependency conflict when a
    * direct dependency's version is older than that of an indirect
    * dependency with the same /org/name.
    * 
@@ -357,13 +431,13 @@ public class LibVersionsCheckTask extends Task {
       IvyNodeElement root = IvyNodeElementAdapter.adapt(resolveReport);
       for (IvyNodeElement directDependency : root.getDependencies()) {
         String coordinate = "/" + directDependency.getOrganization() + "/" + directDependency.getName();
-        Versions versions = directDependencies.get(coordinate);
+        Dependency dependency = directDependencies.get(coordinate);
-        if (null == versions) {
+        if (null == dependency) {
           log("ERROR: the following coordinate key does not appear in " 
               + centralizedVersionsFile.getName() + ": " + coordinate);
           success = false;
         } else {
-          versions.directlyReferenced = true;
+          dependency.directlyReferenced = true;
           if (collectConflicts(directDependency, directDependency, moduleName)) {
             success = false;
           }
@@ -386,15 +460,15 @@ public class LibVersionsCheckTask extends Task {
     boolean conflicts = false;
     for (IvyNodeElement child : parent.getDependencies()) {
       String coordinate = "/" + child.getOrganization() + "/" + child.getName();
-      Versions versions = directDependencies.get(coordinate);
+      Dependency dependency = directDependencies.get(coordinate);
-      if (null != versions) { // Ignore this indirect dependency if it's not also a direct dependency
+      if (null != dependency) { // Ignore this indirect dependency if it's not also a direct dependency
         String indirectVersion = child.getRevision();
-        if (isConflict(coordinate, versions.direct, indirectVersion)) {
+        if (isConflict(coordinate, dependency.directVersion, indirectVersion)) {
           conflicts = true;
-          Set<String> moduleNames = versions.conflictLocations.get(root);
+          Set<String> moduleNames = dependency.conflictLocations.get(root);
           if (null == moduleNames) {
             moduleNames = new HashSet<>();
-            versions.conflictLocations.put(root, moduleNames);
+            dependency.conflictLocations.put(root, moduleNames);
           }
           moduleNames.add(moduleName);
         }
@@ -499,7 +573,7 @@ public class LibVersionsCheckTask extends Task {
   private int emitConflicts() {
     int conflicts = 0;
     StringBuilder builder = new StringBuilder();
-    for (Map.Entry<String,Versions> directDependency : directDependencies.entrySet()) {
+    for (Map.Entry<String,Dependency> directDependency : directDependencies.entrySet()) {
       String coordinate = directDependency.getKey();
       Set<Map.Entry<IvyNodeElement,Set<String>>> entrySet
           = directDependency.getValue().conflictLocations.entrySet();
@@ -540,14 +614,16 @@ public class LibVersionsCheckTask extends Task {
     for (IvyNodeElement child : parent.getDependencies()) {
       String indirectCoordinate = "/" + child.getOrganization() + "/" + child.getName();
       if (conflictCoordinate.equals(indirectCoordinate)) {
-        String directVersion = directDependencies.get(conflictCoordinate).direct;
+        Dependency dependency = directDependencies.get(conflictCoordinate);
+        String directVersion = dependency.directVersion;
         if (isConflict(conflictCoordinate, directVersion, child.getRevision())) {
           for (int i = 0 ; i < depth - 1 ; ++i) {
             builder.append("    ");
           }
           builder.append("+-- ");
           builder.append(indirectCoordinate).append("=").append(child.getRevision());
-          builder.append(" <<< Conflict (direct=").append(directVersion).append(")\n");
+          builder.append(" <<< Conflict (direct=").append(directVersion);
+          builder.append(", latest=").append(dependency.latestVersion).append(")\n");
           return true;
         }
       } else if (hasConflicts(conflictCoordinate, child)) {
@@ -569,7 +645,8 @@ public class LibVersionsCheckTask extends Task {
     for (IvyNodeElement child : parent.getDependencies()) {
       String indirectCoordinate = "/" + child.getOrganization() + "/" + child.getName();
       if (conflictCoordinate.equals(indirectCoordinate)) {
-        if (isConflict(conflictCoordinate, directDependencies.get(conflictCoordinate).direct, child.getRevision())) {
+        Dependency dependency = directDependencies.get(conflictCoordinate);
+        if (isConflict(conflictCoordinate, dependency.directVersion, child.getRevision())) {
           return true;
         }
       } else if (hasConflicts(conflictCoordinate, child)) {

solr/licenses/activation-1.1.1.jar.sha1

@@ -0,0 +1 @@
+485de3a253e23f645037828c07f1d7f1af40763a

solr/licenses/activation-1.1.jar.sha1

@@ -1 +0,0 @@
-e6cb541461c2834bdea3eb920f1884d1eb508b50

solr/licenses/avro-1.7.4.jar.sha1

@@ -1 +0,0 @@
-416e7030879814f52845b97f04bb50ecd1cef372

solr/licenses/avro-1.7.5.jar.sha1

@@ -0,0 +1 @@
+8343a5b33f56fa16306ed27fa7b1a79278c26c2d

solr/licenses/commons-beanutils-1.7.0.jar.sha1

@@ -1 +0,0 @@
-5675fd96b29656504b86029551973d60fb41339b

solr/licenses/commons-beanutils-1.8.3.jar.sha1

@@ -0,0 +1 @@
+686ef3410bcf4ab8ce7fd0b899e832aaba5facf7

solr/licenses/commons-digester-2.0.jar.sha1

@@ -1 +0,0 @@
-3dbd8a76683cd563583a2c78c356ad8b8acf38bf

solr/licenses/commons-digester-2.1.jar.sha1

@@ -0,0 +1 @@
+73a8001e7a54a255eef0f03521ec1805dc738ca0

solr/licenses/commons-io-2.1.jar.sha1

@@ -1 +0,0 @@
-fd51f906669f49a4ffd06650666c3b8147a6106e

solr/licenses/commons-io-2.3.jar.sha1

@@ -0,0 +1 @@
+cd8d6ffc833cc63c30d712a180f4663d8f55799b

solr/licenses/jaxb-impl-2.2.2.jar.sha1

@@ -1 +0,0 @@
-5b206d63c546fd4a8fa53c3b4a96345ad80fc45a

solr/licenses/jaxb-impl-2.2.3-1.jar.sha1

@@ -0,0 +1 @@
+56baae106392040a45a06d4a41099173425da1e6

solr/licenses/jersey-bundle-1.8.jar.sha1

@@ -1 +0,0 @@
-b59d9d4dd6d6301515697b29260f1f4dcaabd771

solr/licenses/jersey-bundle-1.9.jar.sha1

@@ -0,0 +1 @@
+4dc55ffd69faa3cea5279f606909efe845a38e8f

solr/licenses/jersey-core-1.8.jar.sha1

@@ -1 +0,0 @@
-b6a0553c0eb3da45a9b8947a0a7283b3b9266d0d

solr/licenses/jersey-core-1.9.jar.sha1

@@ -0,0 +1 @@
+8341846f18187013bb9e27e46b7ee00a6395daf4

solr/licenses/jersey-guice-1.8.jar.sha1

@@ -1 +0,0 @@
-f4e7772030608e281bb39ffcc7028c2e430356e7

solr/licenses/jersey-guice-1.9.jar.sha1

@@ -0,0 +1 @@
+5963c28c47df7e5d6ad34cec80c071c368777f7b

solr/licenses/jersey-json-1.8.jar.sha1

@@ -1 +0,0 @@
-825621478fec59983106efaa032c679f925b4eff

solr/licenses/jersey-json-1.9.jar.sha1

@@ -0,0 +1 @@
+1aa73e1896bcc7013fed247157d7f676226eb432

solr/licenses/jersey-server-1.8.jar.sha1

@@ -1 +0,0 @@
-6da1231f5e2d7a9f7d194e292fc3695ba7710b2f

solr/licenses/jersey-server-1.9.jar.sha1

@@ -0,0 +1 @@
+3a6ea7cc5e15c824953f9f3ece2201b634d90d18

solr/licenses/log4j-1.2.16.jar.sha1

@@ -1 +0,0 @@
-7999a63bfccbc7c247a9aea10d83d4272bd492c6

solr/licenses/log4j-1.2.17.jar.sha1

@@ -0,0 +1 @@
+5af35056b4d257e4b64b9e8069c0746e8b08629f

solr/licenses/mail-1.4.1.jar.sha1

@@ -1 +0,0 @@
-8b7bc69010655425dabf091b51d1e90b4de36715

solr/licenses/mail-1.4.3.jar.sha1

@@ -0,0 +1 @@
+8154bf8d666e6db154c548dc31a8d512c273f5ee

solr/licenses/netty-3.6.2.Final.jar.sha1

@@ -1 +0,0 @@
-69be11c61427f0604a30539755add84ad9e37e5e

solr/licenses/netty-3.7.0.Final.jar.sha1

@@ -0,0 +1 @@
+07a8c35599c68c0bf383df74469aa3e03d9aca87

solr/licenses/snappy-java-1.0.4.1.jar.sha1

@@ -1 +0,0 @@
-f88b89a5a21a466aeb0ecf0c063605bd584b4947

solr/licenses/snappy-java-1.0.5.jar.sha1

@@ -0,0 +1 @@
+10cb4550360a0ec6b80f09a5209d00b6058e82bf

solr/licenses/xz-1.2.jar.sha1

@@ -1 +0,0 @@
-bfc66dda280a18ab341b5023248925265c00394c

solr/licenses/xz-1.4.jar.sha1

@@ -0,0 +1 @@
+18a9a2ce6abf32ea1b5fd31dae5210ad93f4e5e3