Skip to content

Commit 97f68da

Browse files
authored
fix(java-runtime): javax.annotation-api leaks onto consumers' runtime classpath (#5140)
The `jsii-runtime` Maven artifact declared `javax.annotation-api` at the default `compile` scope. Because `compile` dependencies are transitive, the jar was exposed to everything that depends on `jsii-runtime`. It does not belong on the runtime classpath. No hand-written runtime code uses it; it is declared only to supply `@javax.annotation.Generated`, which the generated `JsiiVersion` and `BundledRuntime` classes carry. That annotation has SOURCE retention, so the compiler discards it and it never appears in the bytecode at all — nothing can read it at runtime. This follows the same reasoning as #5136 (the JetBrains annotations) and changes the dependency to `provided` scope so it remains available for the runtime's own compilation but is no longer propagated to anything that depends on the runtime. The full `yarn build` was run: the generated classes compile and all 14 tests pass. --- By submitting this pull request, I confirm that my contribution is made under the terms of the [Apache 2.0 license]. [Apache 2.0 license]: https://www.apache.org/licenses/LICENSE-2.0
1 parent 26b3329 commit 97f68da

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

packages/@jsii/java-runtime/pom.xml.t.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,8 @@ process.stdout.write(`<?xml version="1.0" encoding="UTF-8"?>
135135
<groupId>javax.annotation</groupId>
136136
<artifactId>javax.annotation-api</artifactId>
137137
<version>\${javax-annotations.version}</version>
138+
<!-- Compile-only: only provides @javax.annotation.Generated (SOURCE retention), not present in bytecode -->
139+
<scope>provided</scope>
138140
</dependency>
139141
</dependencies>
140142

0 commit comments

Comments
 (0)