Commit 97f68da
authored
fix(java-runtime): javax.annotation-api leaks onto consumers' runtime classpath (#5140)
The `jsii-runtime` Maven artifact declared `javax.annotation-api` at the default `compile` scope. Because `compile` dependencies are transitive, the jar was exposed to everything that depends on `jsii-runtime`.
It does not belong on the runtime classpath. No hand-written runtime code uses it; it is declared only to supply `@javax.annotation.Generated`, which the generated `JsiiVersion` and `BundledRuntime` classes carry. That annotation has SOURCE retention, so the compiler discards it and it never appears in the bytecode at all — nothing can read it at runtime.
This follows the same reasoning as #5136 (the JetBrains annotations) and changes the dependency to `provided` scope so it remains available for the runtime's own compilation but is no longer propagated to anything that depends on the runtime. The full `yarn build` was run: the generated classes compile and all 14 tests pass.
---
By submitting this pull request, I confirm that my contribution is made under the terms of the [Apache 2.0 license].
[Apache 2.0 license]: https://www.apache.org/licenses/LICENSE-2.01 parent 26b3329 commit 97f68da
1 file changed
Lines changed: 2 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
135 | 135 | | |
136 | 136 | | |
137 | 137 | | |
| 138 | + | |
| 139 | + | |
138 | 140 | | |
139 | 141 | | |
140 | 142 | | |
| |||
0 commit comments