Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove use of commons collections 3 coming via beanutils #260

Open
sandeepnkulkarni opened this issue Mar 9, 2022 · 5 comments · May be fixed by #488
Open

Remove use of commons collections 3 coming via beanutils #260

sandeepnkulkarni opened this issue Mar 9, 2022 · 5 comments · May be fixed by #488

Comments

@sandeepnkulkarni
Copy link

sandeepnkulkarni commented Mar 9, 2022 •
edited
Loading

commons collections 3 is EOL and there is no new version available since Nov, 2015 after 3.2.2. So it would make sense to remove its use within jasperreports going forward. Our customers have shown concern about its continued use and hence the request.

Currently there is dependency of commons-beanutils 1.9.4. There is major version of beanutils released commons-beanutils2 which no longer needs commons collections 3 and uses commons collections 4 in its place.

Will it be possible to upgrade to use commons-beanutils2?

Edit: Would like point out that it turns out that official beanutils is still not out yet. It is still in SNAPSHOT. But it is released by Melloware on Maven. More information: https://issues.apache.org/jira/browse/BEANUTILS-532
@teodord
Copy link
Collaborator

teodord commented Mar 9, 2022 •
edited
Loading

I think it is too early to consider this. We are not using snapshots.
Also, Commons Beanutils is also used by Commons Digester.
That is a bit harder to replace in JRL.

@sandeepnkulkarni
Copy link
Author

Thanks for quick response. Commons Digester also seems to be EOL as well. Also does not looks like it is being actively maintained. Last release 3.2 was in 2011.

Found that Apache Commons Digester used is v.2.1, a version that has been released in 2010.

@teodord
Copy link
Collaborator

teodord commented Mar 9, 2022 •
edited
Loading

I think Digester is "Feature Complete", not "End of Life". It does what we need and we don't need anything more from it.

@sandeepk-veritas sandeepk-veritas mentioned this issue Jul 31, 2023
Closed
@nicolasmafraintelipost
Copy link

nicolasmafraintelipost commented Jul 26, 2024 •
edited
Loading

Hello, any updates to it? commons-collections 3 is mentioned in vulnerability alerts (Cx78f40514-81ff)

melloware added a commit to melloware/jasperreports that referenced this issue Oct 18, 2024
@melloware
Fix TIBCOSoftware#260: Commons BeanUtils2
28be8e3
@melloware melloware linked a pull request Oct 18, 2024 that will close this issue
Open
3 tasks
@melloware
Copy link

PR submitted

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix #260: Commons BeanUtils2 melloware/jasperreports
4 participants
@teodord @melloware @sandeepnkulkarni @nicolasmafraintelipost