From 2b0e07de72eca43fa0ebce032ed29b4a09fd0649 Mon Sep 17 00:00:00 2001 From: KochTobi Date: Wed, 12 Aug 2026 14:48:32 +0200 Subject: [PATCH 01/11] Fix tests testing against wrong jackson Tests in identity were testing using the wrong jackson version. fixed it. --- .../java/life/qbic/domain/concepts/DomainEvent.java | 4 ++-- identity/pom.xml | 13 ++++++------- .../user/event/UserRegisteredEventSpec.groovy | 6 ++---- 3 files changed, 10 insertions(+), 13 deletions(-) diff --git a/domain-concept/src/main/java/life/qbic/domain/concepts/DomainEvent.java b/domain-concept/src/main/java/life/qbic/domain/concepts/DomainEvent.java index 8239000a2f..49219285be 100644 --- a/domain-concept/src/main/java/life/qbic/domain/concepts/DomainEvent.java +++ b/domain-concept/src/main/java/life/qbic/domain/concepts/DomainEvent.java @@ -1,6 +1,6 @@ package life.qbic.domain.concepts; -import com.fasterxml.jackson.annotation.JsonGetter; +import com.fasterxml.jackson.annotation.JsonProperty; import java.io.Serializable; import java.time.Instant; @@ -14,6 +14,7 @@ */ public abstract class DomainEvent implements Serializable { + @JsonProperty("occurredOn") protected final Instant occurredOn; protected DomainEvent() { @@ -26,7 +27,6 @@ protected DomainEvent() { * @return the instant the of event creation. */ - @JsonGetter("occurredOn") public Instant occurredOn() { return occurredOn; } diff --git a/identity/pom.xml b/identity/pom.xml index 29e3957072..278900d194 100644 --- a/identity/pom.xml +++ b/identity/pom.xml @@ -57,16 +57,10 @@ application-commons - com.fasterxml.jackson.core + tools.jackson.core jackson-core test - - com.fasterxml.jackson.datatype - jackson-datatype-jsr310 - ${jackson-2-bom.version} - test - org.jobrunr jobrunr @@ -85,6 +79,11 @@ com.fasterxml.jackson.core jackson-annotations + + tools.jackson.core + jackson-databind + test + diff --git a/identity/src/test/groovy/life/qbic/identity/domain/user/event/UserRegisteredEventSpec.groovy b/identity/src/test/groovy/life/qbic/identity/domain/user/event/UserRegisteredEventSpec.groovy index 8165ffefeb..bd9019ff7c 100644 --- a/identity/src/test/groovy/life/qbic/identity/domain/user/event/UserRegisteredEventSpec.groovy +++ b/identity/src/test/groovy/life/qbic/identity/domain/user/event/UserRegisteredEventSpec.groovy @@ -1,19 +1,17 @@ package life.qbic.identity.domain.user.event -import com.fasterxml.jackson.databind.ObjectMapper -import com.fasterxml.jackson.databind.json.JsonMapper -import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule import life.qbic.identity.domain.event.UserRegistered import spock.lang.Specification +import tools.jackson.databind.ObjectMapper class UserRegisteredEventSpec extends Specification { def "Ensure serialisation and deserialisation"() { given: UserRegistered userRegistered = UserRegistered.create("1234", "Sven", "sven.fillinger@test.de") + ObjectMapper objectMapper = new ObjectMapper(); when: - ObjectMapper objectMapper = JsonMapper.builder().addModule(new JavaTimeModule()).build() String json = objectMapper.writeValueAsString(userRegistered) UserRegistered deserialised = objectMapper.readValue(json, UserRegistered) From 3fc85af7f304762da8ea3cdbb6a11838a8d6df02 Mon Sep 17 00:00:00 2001 From: KochTobi-Agent Date: Thu, 13 Aug 2026 10:39:35 +0000 Subject: [PATCH 02/11] fix: relocate bundled spring in openbis-api to avoid classpath collision The upstream life.qbic:openbis-api artifact is a shaded uber-jar that bundles an old (2017) Spring Framework compiled against javax.servlet. It defines org.springframework.web.WebApplicationInitializer with onStartup(javax.servlet.ServletContext), which collides with the real spring-web (Spring Framework 7 / Jakarta) version onStartup(jakarta.servlet.ServletContext). Depending on classpath ordering javac picks the wrong definition, so Application.java failed to compile with: "Application is not abstract and does not override abstract method onStartup(javax.servlet.ServletContext)". The datamanager-app module only avoided this by declaring openbis-api as a direct dependency positioned after the Spring deps - a fragile, order-dependent workaround. Add an openbis-api-clean module that shades the upstream jar and relocates the bundled org.springframework.* classes into the private namespace life.qbic.openbis.shaded.org.springframework. This keeps openbis's bundled Spring (which real Spring 7 no longer provides, e.g. org.springframework.remoting.*) available to the openbis client exactly as before, while removing it from the shared namespace so the real Spring is authoritative at compile and runtime. The relocation runs during the compile phase and is unpacked into target/classes so same-reactor consumers see the relocated classes (a package-only shade is invisible to other modules during a single reactor build). project-management-infrastructure now depends on openbis-api-clean instead of the upstream shaded jar, and the now-redundant direct openbis-api dependency is removed from datamanager-app. Verified with: mvn clean compile -Pproduction and mvn test-compile (offline), both BUILD SUCCESS. --- .gitignore | 3 + datamanager-app/pom.xml | 5 - datamanager-bom/pom.xml | 5 + openbis-api-clean/pom.xml | 132 ++++++++++++++++++++++ pom.xml | 1 + project-management-infrastructure/pom.xml | 5 +- 6 files changed, 143 insertions(+), 8 deletions(-) create mode 100644 openbis-api-clean/pom.xml diff --git a/.gitignore b/.gitignore index ccf4e954ec..8bafbc1f56 100644 --- a/.gitignore +++ b/.gitignore @@ -29,6 +29,9 @@ logs # Maven version backups */*.xml.versionsBackup +# Generated by maven-shade-plugin for repackaging modules +*/dependency-reduced-pom.xml + # The following files are generated/updated by vaadin-maven-plugin */node_modules/ */frontend/generated/ diff --git a/datamanager-app/pom.xml b/datamanager-app/pom.xml index 8ed5a02dad..0385caf5f3 100644 --- a/datamanager-app/pom.xml +++ b/datamanager-app/pom.xml @@ -256,11 +256,6 @@ org.slf4j jcl-over-slf4j - - life.qbic - openbis-api - r1700646105 - org.apache.tomcat.embed tomcat-embed-core diff --git a/datamanager-bom/pom.xml b/datamanager-bom/pom.xml index 2edceacd83..9b2e186510 100644 --- a/datamanager-bom/pom.xml +++ b/datamanager-bom/pom.xml @@ -101,6 +101,11 @@ project-management-infrastructure ${project.version} + + life.qbic.datamanager + openbis-api-clean + ${project.version} + life.qbic.datamanager subscription-api diff --git a/openbis-api-clean/pom.xml b/openbis-api-clean/pom.xml new file mode 100644 index 0000000000..ea7ce52740 --- /dev/null +++ b/openbis-api-clean/pom.xml @@ -0,0 +1,132 @@ + + + 4.0.0 + + life.qbic.datamanager + datamanager + 1.15.0 + + + openbis-api-clean + OpenBIS API (de-collided) + + Repackaging of the upstream life.qbic:openbis-api shaded uber-jar that relocates the bundled + org.springframework classes into a private namespace. + + Rationale: the upstream artifact is a shaded uber-jar that bundles an old (2017-era) + Spring Framework compiled against javax.servlet. It defines + org.springframework.web.WebApplicationInitializer with onStartup(javax.servlet.ServletContext), + which collides with the real spring-web (Spring Framework 7 / Jakarta) version that uses + onStartup(jakarta.servlet.ServletContext). Depending on classpath ordering, javac picks the + wrong one and compilation of Application.java fails. + + Removing the bundled spring would break openbis at runtime, because real Spring 7 no longer + ships org.springframework.remoting.* that the openbis client (ch.systemsx.cisd.common.spring, + com.marathon.util.spring) depends on. Relocating it keeps openbis exactly as-is while removing + it from the shared org.springframework namespace so the real Spring is authoritative at both + compile time and runtime. + + The relocation is applied during the compile phase and the result is unpacked into this + module's target/classes so that other modules of the same reactor build see the relocated + classes (a pure shade-repackaging module would only expose them via its jar at package time, + which reactor consumers never see). + + + + + + life.qbic + openbis-api + 20.10.7.3 + r1700646105 + true + + + + + + + + org.apache.maven.plugins + maven-jar-plugin + 3.5.0 + + + default-jar-early + compile + + jar + + + + + + + + org.apache.maven.plugins + maven-shade-plugin + 3.6.0 + + true + + + org.springframework + life.qbic.openbis.shaded.org.springframework + + + + + + + + + relocate + compile + + shade + + + + + + + + org.apache.maven.plugins + maven-antrun-plugin + 3.1.0 + + + unpack-relocated + compile + + run + + + + + + + + + + + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml index 026216559c..c77d677e12 100644 --- a/pom.xml +++ b/pom.xml @@ -29,6 +29,7 @@ domain-concept identity-api identity-infrastructure + openbis-api-clean project-management-infrastructure email-service-provider finances-infrastructure diff --git a/project-management-infrastructure/pom.xml b/project-management-infrastructure/pom.xml index ab4302eedf..bc42ff5249 100644 --- a/project-management-infrastructure/pom.xml +++ b/project-management-infrastructure/pom.xml @@ -20,9 +20,8 @@ logging - life.qbic - openbis-api - r1700646105 + life.qbic.datamanager + openbis-api-clean org.springframework From 79cb77f19bdcf262bafc2603493fa9adc5f3c86d Mon Sep 17 00:00:00 2001 From: KochTobi-Agent Date: Thu, 13 Aug 2026 11:19:12 +0000 Subject: [PATCH 03/11] build(openbis-api-clean): add module that de-collides upstream openbis-api Add a new module that repackages the upstream life.qbic:openbis-api shaded uber-jar. The upstream jar bundles old (2017) third-party classes under the same fully-qualified names as the real runtime dependencies, which collide depending on classpath ordering. The module shades the upstream jar and relocates the bundled org.springframework (javax.servlet flavour, including the WebApplicationInitializer that breaks compilation against Spring Framework 7 / Jakarta) into the private namespace life.qbic.openbis.shaded.org.springframework. The relocation runs during the compile phase and is unpacked into target/classes so same-reactor consumers see the relocated classes. Additional bundled namespaces (org.apache, org.aspectj, org.eclipse, org.slf4j, org.aopalliance, com.fasterxml) will be relocated in follow-up commits. --- .gitignore | 3 + openbis-api-clean/pom.xml | 131 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 134 insertions(+) create mode 100644 openbis-api-clean/pom.xml diff --git a/.gitignore b/.gitignore index ccf4e954ec..8bafbc1f56 100644 --- a/.gitignore +++ b/.gitignore @@ -29,6 +29,9 @@ logs # Maven version backups */*.xml.versionsBackup +# Generated by maven-shade-plugin for repackaging modules +*/dependency-reduced-pom.xml + # The following files are generated/updated by vaadin-maven-plugin */node_modules/ */frontend/generated/ diff --git a/openbis-api-clean/pom.xml b/openbis-api-clean/pom.xml new file mode 100644 index 0000000000..d91908b475 --- /dev/null +++ b/openbis-api-clean/pom.xml @@ -0,0 +1,131 @@ + + + 4.0.0 + + life.qbic.datamanager + datamanager + 1.15.0 + + + openbis-api-clean + OpenBIS API (de-collided) + + Repackaging of the upstream life.qbic:openbis-api shaded uber-jar that relocates bundled + third-party packages into a private namespace. + + Rationale: the upstream artifact is a shaded uber-jar that bundles old (2017-era) copies of + third-party libraries under the same fully-qualified names as the real runtime dependencies. + Depending on classpath ordering these collide with the real libraries. Relocating them to + life.qbic.openbis.shaded.* rewrites both the bundled class files and the references inside the + openbis client classes, so openbis keeps behaving exactly as before while the real libraries + remain the single source of those types at compile time and runtime. + + + + + + life.qbic + openbis-api + 20.10.7.3 + r1700646105 + true + + + + + + + + org.apache.maven.plugins + maven-jar-plugin + 3.5.0 + + + default-jar-early + compile + + jar + + + + default-jar + none + + + + + + + org.apache.maven.plugins + maven-shade-plugin + 3.6.0 + + true + + + + org.springframework + life.qbic.openbis.shaded.org.springframework + + + + + + + + + relocate + compile + + shade + + + + + + + + org.apache.maven.plugins + maven-antrun-plugin + 3.1.0 + + + unpack-relocated + compile + + run + + + + + + + + + + + + + \ No newline at end of file From 7ce74fe43c3e1c45b275dfa1ec4867e3d9786f42 Mon Sep 17 00:00:00 2001 From: KochTobi-Agent Date: Thu, 13 Aug 2026 11:19:18 +0000 Subject: [PATCH 04/11] refactor(openbis-api-clean): relocate bundled org.apache to private namespace Relocate the bundled Apache classes (commons, http, poi, etc.) the upstream openbis-api jar ships into life.qbic.openbis.shaded.org.apache so they cannot shadow the real Apache commons libraries on the app classpath (e.g. the bundled old commons-io IOUtils would otherwise break code expecting the real commons-io API). --- openbis-api-clean/pom.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/openbis-api-clean/pom.xml b/openbis-api-clean/pom.xml index d91908b475..7a88473aa3 100644 --- a/openbis-api-clean/pom.xml +++ b/openbis-api-clean/pom.xml @@ -87,6 +87,12 @@ org.springframework life.qbic.openbis.shaded.org.springframework + + + org.apache + life.qbic.openbis.shaded.org.apache + Date: Thu, 13 Aug 2026 11:19:24 +0000 Subject: [PATCH 05/11] refactor(openbis-api-clean): relocate bundled org.aspectj to private namespace Relocate the old AspectJ classes bundled in the upstream openbis-api jar into life.qbic.openbis.shaded.org.aspectj so they cannot collide with the real aspectjweaver that is pulled in transitively via Spring AOP. --- openbis-api-clean/pom.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/openbis-api-clean/pom.xml b/openbis-api-clean/pom.xml index 7a88473aa3..38aac926aa 100644 --- a/openbis-api-clean/pom.xml +++ b/openbis-api-clean/pom.xml @@ -93,6 +93,12 @@ org.apache life.qbic.openbis.shaded.org.apache + + + org.aspectj + life.qbic.openbis.shaded.org.aspectj + Date: Thu, 13 Aug 2026 11:19:30 +0000 Subject: [PATCH 06/11] refactor(openbis-api-clean): relocate bundled org.eclipse to private namespace Relocate the bundled Eclipse classes the upstream openbis-api jar ships into life.qbic.openbis.shaded.org.eclipse so they cannot collide with the Eclipse / JAXB classes already on the app classpath. --- openbis-api-clean/pom.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/openbis-api-clean/pom.xml b/openbis-api-clean/pom.xml index 38aac926aa..94af6b9563 100644 --- a/openbis-api-clean/pom.xml +++ b/openbis-api-clean/pom.xml @@ -99,6 +99,12 @@ org.aspectj life.qbic.openbis.shaded.org.aspectj + + + org.eclipse + life.qbic.openbis.shaded.org.eclipse + Date: Thu, 13 Aug 2026 11:19:37 +0000 Subject: [PATCH 07/11] refactor(openbis-api-clean): relocate bundled org.slf4j to private namespace Relocate the old slf4j classes bundled in the upstream openbis-api jar into life.qbic.openbis.shaded.org.slf4j so they cannot shadow the real slf4j-api that the application logging facade is built against. --- openbis-api-clean/pom.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/openbis-api-clean/pom.xml b/openbis-api-clean/pom.xml index 94af6b9563..791a45b490 100644 --- a/openbis-api-clean/pom.xml +++ b/openbis-api-clean/pom.xml @@ -105,6 +105,12 @@ org.eclipse life.qbic.openbis.shaded.org.eclipse + + + org.slf4j + life.qbic.openbis.shaded.org.slf4j + Date: Thu, 13 Aug 2026 11:19:42 +0000 Subject: [PATCH 08/11] refactor(openbis-api-clean): relocate bundled org.aopalliance to private namespace Relocate the AOP Alliance classes bundled in the upstream openbis-api jar into life.qbic.openbis.shaded.org.aopalliance so they cannot collide with the org.aopalliance facilities provided by Spring AOP. --- openbis-api-clean/pom.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/openbis-api-clean/pom.xml b/openbis-api-clean/pom.xml index 791a45b490..0adce2437f 100644 --- a/openbis-api-clean/pom.xml +++ b/openbis-api-clean/pom.xml @@ -111,6 +111,12 @@ org.slf4j life.qbic.openbis.shaded.org.slf4j + + + org.aopalliance + life.qbic.openbis.shaded.org.aopalliance + Date: Thu, 13 Aug 2026 11:19:48 +0000 Subject: [PATCH 09/11] refactor(openbis-api-clean): relocate bundled com.fasterxml to private namespace Relocate the old Jackson classes bundled in the upstream openbis-api jar into life.qbic.openbis.shaded.com.fasterxml so they cannot shadow the real com.fasterxml.jackson.* libraries pulled in via Spring Boot and ro-crate. --- openbis-api-clean/pom.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/openbis-api-clean/pom.xml b/openbis-api-clean/pom.xml index 0adce2437f..3723a8d178 100644 --- a/openbis-api-clean/pom.xml +++ b/openbis-api-clean/pom.xml @@ -117,6 +117,12 @@ org.aopalliance life.qbic.openbis.shaded.org.aopalliance + + + com.fasterxml + life.qbic.openbis.shaded.com.fasterxml + Date: Thu, 13 Aug 2026 11:20:10 +0000 Subject: [PATCH 10/11] build: wire openbis-api-clean into the reactor Add the openbis-api-clean module to the root Maven modules, manage its version in datamanager-bom, and switch project-management-infrastructure to depend on openbis-api-clean instead of the upstream shaded life.qbic:openbis-api jar. Remove the now-redundant direct openbis-api dependency from datamanager-app. It was only present to push the upstream jar after the Spring deps on the classpath, an order-dependent workaround for the colliding org.springframework classes that openbis-api-clean now eliminates properly. Verified: mvn clean package -Pproduction -> BUILD SUCCESS. --- datamanager-app/pom.xml | 5 ----- datamanager-bom/pom.xml | 5 +++++ pom.xml | 1 + project-management-infrastructure/pom.xml | 5 ++--- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/datamanager-app/pom.xml b/datamanager-app/pom.xml index 8ed5a02dad..0385caf5f3 100644 --- a/datamanager-app/pom.xml +++ b/datamanager-app/pom.xml @@ -256,11 +256,6 @@ org.slf4j jcl-over-slf4j - - life.qbic - openbis-api - r1700646105 - org.apache.tomcat.embed tomcat-embed-core diff --git a/datamanager-bom/pom.xml b/datamanager-bom/pom.xml index 2edceacd83..9b2e186510 100644 --- a/datamanager-bom/pom.xml +++ b/datamanager-bom/pom.xml @@ -101,6 +101,11 @@ project-management-infrastructure ${project.version} + + life.qbic.datamanager + openbis-api-clean + ${project.version} + life.qbic.datamanager subscription-api diff --git a/pom.xml b/pom.xml index 026216559c..c77d677e12 100644 --- a/pom.xml +++ b/pom.xml @@ -29,6 +29,7 @@ domain-concept identity-api identity-infrastructure + openbis-api-clean project-management-infrastructure email-service-provider finances-infrastructure diff --git a/project-management-infrastructure/pom.xml b/project-management-infrastructure/pom.xml index ab4302eedf..bc42ff5249 100644 --- a/project-management-infrastructure/pom.xml +++ b/project-management-infrastructure/pom.xml @@ -20,9 +20,8 @@ logging - life.qbic - openbis-api - r1700646105 + life.qbic.datamanager + openbis-api-clean org.springframework From b867807d64df030c9d33b7abe441c34d67405e3e Mon Sep 17 00:00:00 2001 From: KochTobi-Agent Date: Thu, 13 Aug 2026 11:20:17 +0000 Subject: [PATCH 11/11] fix(project-management-infrastructure): add compile-scope jackson-databind ro-crate-java brings jackson-databind with runtime scope only, but the module's own code calls into ro-crate-java APIs that expose com.fasterxml.jackson. databind.JsonNode, so jackson-databind must be on the compile classpath. This was previously masked by the bundled Jackson inside the shaded upstream openbis-api jar; after de-colliding openbis (see openbis-api-clean) that bundled Jackson is no longer on the classpath, exposing the gap. --- project-management-infrastructure/pom.xml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/project-management-infrastructure/pom.xml b/project-management-infrastructure/pom.xml index bc42ff5249..94f1e791af 100644 --- a/project-management-infrastructure/pom.xml +++ b/project-management-infrastructure/pom.xml @@ -97,6 +97,17 @@ org.springframework.boot spring-boot-jackson + + + com.fasterxml.jackson.core + jackson-databind + jakarta.xml.bind