build warning about parameter "localRepository" after upgrading to maven 3.9.1

[XN137]

[INFO] --- forbiddenapis:3.3:check (default) @ mycompany-common ---
[WARNING] Parameter 'localRepository' is deprecated core expression; Avoid use of ArtifactRepository type. If you need access to local repository, switch to '${repositorySystemSession}' expression and get LRM from it instead.

the warning seems to come from:
https://issues.apache.org/jira/browse/MNG-7706
where there are suggestions on how mojos should address it

it would be nice to avoid these build warnings in the next forbidden-apis release
thank you!

[uschindler]

I do not think this can be quickly fixed, as forbiddenapis needs to raise the minimum Maven version first.

Does the warning always appear? IMHO, it should only appear if you use the localRepository parameter in the signaturesArtifacts. If you don't refer to those artifacts and just use plain forbiddenapis with bundled sogatures or local files, it should not ptint any warning. If yes, I would recommend to open a bug report at Maven to only print the deprectaed warning when the feature in question is actually used.

[XN137]

thanks for the quick feedback!

yes our build is using <signaturesArtifacts> in the parent pom for all other modules like this:

<signaturesArtifacts>
  <signaturesArtifact>
    <groupId>com.mycompany.tools</groupId>
    <artifactId>mycompany-build-tools</artifactId>
    <version>${project.version}</version>
    <type>jar</type>
    <path>mycompany-forbiddenapis/signatures.txt</path>
  </signaturesArtifact>
</signaturesArtifacts>

if you dont do that i doubt the warning will appear (but i havent tried that out)

I do not think this can be quickly fixed, as forbiddenapis needs to raise the minimum Maven version first.

just wondering: what minimum version would we be needing?
according to my understanding the deprecation warning was only introduced in 3.9.1. however the alternative and more correct way to acquire the same information could be available in much earlier maven versions already (we'd need to try that out i guess).

for example https://github.com/apache/maven-help-plugin/pull/88/files seems to show that having a single MavenProject parameter can be used as a replacement...
and i am guessing that functionality has been available in maven for a longer time already

[uschindler]

All fine, I will check this. The next release is going to come out the next days, so this won't be included.

just wondering: what minimum version would we be needing?

At moment it compiles against Maven 2.0 API, because nothing more was needed for this plugin to work correctly. Upgrading to minimum version 3.0 would be possible, but needs some work. I will check how this can be resolved, but I am on business trip at the moment, so I will only release the current "main" branch soon when ASM has been upgraded and the Java 20 release came out tomorrow.

[uschindler]

It looks like this is the problem, correct?

forbidden-apis/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java

Lines 241 to 245 in 0267abf

	@Component
	private ArtifactFactory artifactFactory;
	@Component
	private ArtifactResolver artifactResolver;

[XN137]

i am guessing it's:

forbidden-apis/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java

Lines 250 to 251 in 0267abf

	@Parameter(defaultValue = "${localRepository}", readonly = true, required = true)
	private ArtifactRepository localRepository;

but if you check the PR i've linked earlier it seems that both these parameters can be replaced by going through a MavenProject parameter

[kwin]

You need to leverage the Resolver API instead which ships with Maven since 3.1.0 (https://cwiki.apache.org/confluence/display/MAVEN/Maven+Ecosystem+Cleanup?focusedCommentId=217389433#MavenEcosystemCleanup-resolverMavenResolver(akaMavenArtifactResolver)). I would recommend to require a newer Maven 3.5 version (as the resolver moved then from Eclipse to ASF). Further details at https://maven.apache.org/resolver/api-compatibility.html#inside-of-maven

[uschindler]

Thanks this information is helpful. I will look into this in the next days.

[Stephan202]

Does the warning always appear? IMHO, it should only appear if you use the localRepository parameter in the signaturesArtifacts.

Our build uses bundledSignatures rather than signaturesArtifacts, and we also see the warning. The changes in #230 make it go away. 👍

[kwin]

@uschindler Gentle ping. Any chance you can look at the PR and afterwards spin a new release?

[uschindler]

Hi, thanks. Sorry for the delay. It is busy to me at moment. Merging is one part, but the release won't come directly afterwards as this needs a bit of planning. I have not yet checked if this causes major API headaches (so 4.0 needs to be released, it that case done other features are on my list). If it can be merged and works with Java 7, no problem to have a release soon.

[kwin]

Yes, Java 7 is still supported: https://maven.apache.org/docs/history.html#maven-3-6-x-and-before

[bmarwell]

@kwin @uschindler Java 7 is very hypothetical. If you have up-to-date plugins, most will already require Java 8. But yes, Maven 3.x Core is still Java 7. May I ask why you would like to support Java 7?