| Re: [lyo-dev] JDK 16 GA and OSLC RefImpl |
|
Hello Frej, Thank you for being a valuable member of the community! We understand the importance of JDK8 and are also reluctant to move (esp given that Coretto essentially provides a free, supported, and certified JRE till 2026-06).
However, Apache Jena decided to drop JDK8 (I tried to
advocate on jena-users for keeping the JDK8 but failed to convince them). Just as Jena says they don’t have resources to backport/maintain JDK8 port of a newer and better JDK11 JSON-LD library, we won’t have resources to maintain Jena 3.x after Jena drops
it when Jena 4.0 is released. We will, however, do our best to make update releases on Lyo 4.x w/ Jena 3.x for as long as it reasonable. Regarding the features, it’s not about features but about keeping dependencies updated. JSON/XML dependencies of Jena frequently get CVEs and we don’t want to ship Lyo libraries with known security vulnerabilities. I
asked if Jena project would be ready to make security updates for 3.x for a little while longer, but I think they don’t have interest unless someone from the community steps up. Again, we don’t have such bandwidth, unfortunately. Also, Jad has experienced
problems with JSON-LD support under Jena 3 and hopefully Jena 4 will fix that. Right now 4.0 is on Jena 3.15. There is 3.16 and 3.17. I think we should carefully test how Lyo works with them and pick the best/fastest (they recently had quite a few performance regression bugs filed in Jena) one for
Lyo 4.x. Community feedback on your experiences with different Jena 3.x versions is welcome. AFAIK Jena 3.10 and below have an unmitigated security problem, so we will be aiming at 3.10..3.17 (and rather reluctant to downgrade from 3.15). We should also keep in mind that Java EE is now Jakarta EE and we will need to update package names (for Jakarte EE 10; technically the breaking change was made in EE9 but there are no new features to justify breaking
migration other than to test things) to use new versions of Jetty (10+, see
https://www.eclipse.org/jetty/ and see a copy below for archival reasons) or Jersey,which are more critical from security pov than Jena. I think both Jetty 9 and Jersey 3.0 will have some good timeframe for JDK8 support but we need to understand it’s not
unlimited (Jersey 3.0 already dropped old Jetty from examples and tests). Read more on this at
http://blog.supol.cz/?p=202 (who is the project lead for Jersey!). Which brings me to the next point on working out a strategy.
I think there were requests for having some updates to the “oldstable” releases. I consider Lyo 2.1.2 (last one to support Jena 2 and I think JDK 7) and 2.4.0 (last one to support JAX-RS 1 / Wink) to be the “oldstable”
versions. I am happy to assist with making new point releases if someone steps up to maintain the maint-2.1 or maint-2.4 branches. Having Lyo 2.1 and 2.4 to be designated as supported oldstable releases may allow people who need JDK8/Jena2 and above to be
able to use Lyo for years to come. We can then designate 4.x to be oldstable when the time for 5.0 release comes (most likely when every Jena 3.x has a CVE on it which can no longer be fixed just by a dependencyManagement entry to force a Jackson version bump,
for example). I hope I covered all major pieces that constrain the JDK baseline for Lyo. Looking forward to feedback and suggestions. Cheers, Andrew From: François-Régis Jaunatre <frjaunatre@xxxxxxxxxxxxxxxxx> Hi Andrew and Everyone, I have largely missed out on the plans for Lyo, so forgive me if I’m asking questions that I should have read about somewhere already. I wanted to get back on the note below that Lyo 5 would be dropping JDK8. I know that JDK 8 feels old tech, but an OSLC connector is meant to be deployed inside a hosting tool, which gives an implementer very little control over the version
of Java we can rely upon… Which feature are we so desperately expecting from the next Jena that we’d be willing to drop Java8? Best regards, Sincères salutations, François-Régis Jaunatre Check out
OSLC Connect for Jira &
OSLC Connect for Windchill From: oslc-op@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx <oslc-op@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
On Behalf Of Andrii Berezovskyi via lists.oasis-open-projects.org Hello to all Lyo users and developers, JDK 16 has been released:
https://jdk.java.net/16/ I am happy to say that OSLC RefImpl based on Eclipse Lyo builds just fine on JDK 16 GA (and JDK 17-ea, the next LTS):
https://github.com/oslc-op/refimpl/pull/29. Of course, we still support JDKs all the way back to JDK 8 (for now, but we will need to switch to JDK 11 in Lyo 5.0 because of Apache Jena dropping JDK 8). We also updated to Jetty 10 in the meantime:
https://github.com/oslc-op/refimpl/commit/d51ec05182c716a9a97212233bfc46cbb27ed901 Update to Jetty 11 will be a bit tricky as we must switch from javax.* packages from JavaEE to jakartaee.* in JakartaEE (requirement from Oracle, as many of you know). We will think if it’s worth doing so in Lyo 5.0 (your
input is welcome here). See
https://webtide.com/jetty-10-and-11-have-arrived/ if you are interested. Best regards, Andrew _._,_._,_ Links: You receive all messages sent to this group. View/Reply Online (#489) |
Reply To Group |
Reply To Sender |
Mute This Topic |
New Topic _._,_._,_ |
