jeremylong / class-file-format-rule Goto Github PK

As can be observed in the failed builds of DependencyCheck dependabot PRs for the maven-enforcer-plugin update from 3.0.0-M3 to 3.0.0 the class-file-format-rule is triggering errors as it depends on an old maven-dependency-tree library (2.2) and maven enforcer plugin depends on a modern edition of it (3.1.0), resulting in a NoSuchMethodException for this rules-plugin's usage of dependency graph traversal logic.

For all dependencies, which are compiled for Java releases before 9, but still be able to facilitate the Java9+ module system will be rejected if a supportedClassFileFormat of 52 or lower is been enforced.
This is the case as the module-info.class must use class file format of 53 or higher, even if all other classes are satisfying the desired class file format.

As more and more libraries will be compiled using Java 7/8, but with Java 9 module-info been present, they will be rejected if the enforced supportedClassFileFormat is not 53 or higher.

Example:

Using <supportedClassFileFormat>52</supportedClassFileFormat> leads to the following issues even thought these dependencies are compiled for Java 7 or 8, but with Java 9 module support:

[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (enforce-classfileformat) @ example ---
[WARNING] Rule 0: org.owasp.maven.enforcer.rule.ClassFileFormatRule failed with message:
The following dependencies exceed the maximum supported JVM class file format (i.e. they were compiled for a newer JVM then this project supports):
com.fasterxml.jackson.core:jackson-core:2.10.1
com.fasterxml.jackson.core:jackson-databind:2.10.1
javax.ws.rs:javax.ws.rs-api:2.1.1
com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.10.1
jakarta.xml.bind:jakarta.xml.bind-api:2.3.2
org.jvnet.mimepull:mimepull:1.9.11
org.glassfish.jersey.core:jersey-common:2.29.1
jakarta.ws.rs:jakarta.ws.rs-api:2.1.6
com.fasterxml.jackson.core:jackson-annotations:2.10.1

A new option to ignore the Java 9+ module-info.class and any class in the META-INF/versions/<n> should probably be added to support multi Java Version module JAR files.