Remove use of commons collections 3 coming via beanutils

[sandeepnkulkarni]

commons collections 3 is EOL and there is no new version available since Nov, 2015 after 3.2.2. So it would make sense to remove its use within jasperreports going forward. Our customers have shown concern about its continued use and hence the request.

Currently there is dependency of commons-beanutils 1.9.4. There is major version of beanutils released commons-beanutils2 which no longer needs commons collections 3 and uses commons collections 4 in its place.

Will it be possible to upgrade to use commons-beanutils2?

Edit: Would like point out that it turns out that official beanutils is still not out yet. It is still in SNAPSHOT. But it is released by Melloware on Maven. More information: https://issues.apache.org/jira/browse/BEANUTILS-532

[teodord]

I think it is too early to consider this. We are not using snapshots.
Also, Commons Beanutils is also used by Commons Digester.
That is a bit harder to replace in JRL.

[sandeepnkulkarni]

Thanks for quick response. Commons Digester also seems to be EOL as well. Also does not looks like it is being actively maintained. Last release 3.2 was in 2011.

Found that Apache Commons Digester used is v.2.1, a version that has been released in 2010.

[teodord]

I think Digester is "Feature Complete", not "End of Life". It does what we need and we don't need anything more from it.

[nicolasmafraintelipost]

Hello, any updates to it? commons-collections 3 is mentioned in vulnerability alerts (Cx78f40514-81ff)

[melloware]

PR submitted

[dovezp]

Regarding BeanUtils2, @teodord & @melloware are we aware of any official release date for BeanUtils2 2.0.0? The versions suggest in https://commons.apache.org/proper/commons-beanutils/changes.html that the next, -M2 to be determined, does anyone have any idea when this will be?

The website lists -M1 and -M2 as a "major release". When will there be an official "final" release without the milestone indicators?

Mitigation for https://issues.apache.org/jira/browse/BEANUTILS-532 looks a release was made through
'melloware' group as a non Apache alternative to swap 2.0.0-M1 to 2.0.0.

For best practices, I would like to see BeanUtils2 be apart of Jasper Report as it has a lot to offer. Currently this remains as a blocker for the migration of our entire software suite from Java 11 to Java 21. Since to Jasper Report 7 requires Java 17 as a minimum runtime.

In addition, a majority of others have a concern with the "security issue" Cx78f40514-81ff / sonatype-2024-3350 / COLLECTIONS-701 from in commons-beanutils & commons-digester but SetUniqueList is not used in these dependencies or used elsewhere in commons-collections 3.2 / commons-collections4. After some investigation I'm hesitant to see the real concern in jasperreport 6.x / 7.x is for the issue Cx78f40514-81ff / sonatype-2024-3350 / COLLECTIONS-701.

[melloware]

2.0.0-M1 is super stable as it was 6 years between releases. I have closed my fork now that M1 is out. I think we just need Apache to release a 2.0.0 Final release

[dovezp]

Would the mailing list be best to reach out to for that? Trying to see who up the chain I can reach out to.

[melloware]

@dovezp yep use dev@commons.apache.org

[dadza]

Upgraded to BeanUtils 2.0.0-M2 at 2401b3e and removed a transitive dependency on Commons Collections 2 at 9b9ec3d

With these changes JasperReports only depends on Commons Collections 4 (4.5.0 at this moment to be more precise).