Upgrade library dependencies to recent releases during early OH5.2 milestone phase

[holgerfriedrich]

Follow-up to #4949.

Core has a lot few dependencies which are not up to date.

Basically we have a set of dependencies which get upgraded in a regular frequency: e.g. Karaf, Jetty, PaxWeb, some of the commons libs, asm (typically all of them on every Karaf release); Xtext/Xtend, guava, ecj, etc.

In addition, there are a lot of dependencies which have not seen an upgrade over years. This typically leads to many outdated dependencies still being pulled in or other upgrades being blocked by dependency conflicts.

There is a list of dependencies which still need attention (will post an excerpt from mvn versions:display-dependency-updates below in the comment).
Deprecated javax namespace is still a topic, not all dependencies already support jakarta namespace (e.g. hivemq-mqtt).

We cannot work on most of this close to a release, as sometimes files are missing on jfrog and break plugin installation, etc.

Related PRs:

• Upgrade Karaf to 4.4.9 #5195
• Karaf features: Update supported schema versions #5254
• Upgrade Maven and downgrade karaf-maven-plugin #5261
• Upgrade jmdns to 3.6.3 #5263
• Upgrade commons-pool2 to 2.13.1 #5264
• Upgrade hivemq-mqtt-client to 1.3.12 #5265 (and Netty 4.1.126 to 4.1.130)
• Upgrade Jollyday to 1.8.1 #5266
• Upgrade pdfbox from to 3.0.1 #5267
• Upgrade Swagger to 2.2.41 #5269
• [upgradetool] Bump commons-cli to 1.11 #5270
• Upgrade json-path to 2.10.0 #5271
• Upgrade Gson to 2.13.2 #5275
• Upgrade logback to 1.5.24 #5277
• Upgrade Mockito to 5.21, junit-jupiter to 5.14.2 #5281
• Bump jackson.version from 2.20.1 to 2.21.0 #5294
• Upgrade bndtools to 7.2.1 and re-establish iTests #5279
• Bump ch.qos.logback:logback-core from 1.5.24 to 1.5.25 in /bundles/org.openhab.core.test #5298
• Upgrade to Pax Web 8.0.34 / Jetty 9.4.58.v20250814 #5324
• Upgrade Karaf to 4.4.10 #5353
• Upgrade cxf to 3.6.10 #5380
• [io.monitor] Upgrade dependencies #5381
• Upgrade Swagger to 2.2.43 #5382
• Upgrade Jackson to 2.21.1 #5394
• Bump org.eclipse.jdt:ecj from 3.43.0 to 3.45.0 #5413
• Bump org.apache.groovy:groovy-all from 5.0.4 to 5.0.5 #5461
• Bump org.bouncycastle:bcpkix-jdk18on from 1.83 to 1.84 in /bundles/org.openhab.core.io.jetty.certificate #5494
• Bump org.bouncycastle:bcprov-jdk18on from 1.83 to 1.84 in /bom/runtime #5497
• Upgrade Karaf to 4.4.11 #5510
• Bump xbean.version from 4.29 to 4.30 #5552
• Bump logback to 1.5.32 #5553
• Upgrade hivemq-mqtt-client to 1.3.14 #5554
• Upgrade Eclipse Equinox dependencies #5555
• Upgrade californium to 4.0.0-M6 #5558
• Upgrade commons-net to 3.13.0 #5559
• Upgrade jbbp to 3.0.2 #5560
• Upgrade jdt.annotation to 2.4.100 #5561
• Upgrade Swagger to 2.2.49 #5562
• Upgrade Jollyday to 1.9.3 #5563
• [dependabot] Remove maven-plugin-api from ignore list #5564
• Upgrade jackson to 2.21.3 #5565
• Upgrade Mockito to 5.23.0, junit-jupiter to 5.14.4 #5566
• Bump xtext.version from 2.43.0.M2 to 2.43.0 #5610

TODO

• No update since years:
  • jamod [transport.modbus] -> transition to j2mod [transport.modbus] Transition from jamod to j2mod #5258
  • javazoom/jl mp3 audio library
  • javax.comm, brings in dep on log4j 1
• fix bug with latest Eclipse Eclipse 2025-12 - Oomph installer fails openhab-distro#1856
• revisit bndtools downgrade in distro
• Jackson 2.x to 3.1.0 (maybe easier with Karaf 4.5) (shifted to next release)
• Karaf 4.5 - not yet available (shifted to next release)
• possibly switch from SAT 0.18 to 1.0 (currently only available as -SNAPSHOT)
• possibly revisit SAT rule sets for 1.0 release

TODO - this is an excerpt of

mvn versions:display-dependency-updates -nsu -Dmaven.version.ignore=".*-beta-.*,.*\.BETA[0-9]+,.*-M[0-9]+,.*alpha[0-9]+,.*-b[0-9]+,.*2\.0\.1\.MR,.*\.M[0-9]+" -B -Dversions.outputLineWidth=120 |tee deps
cat deps|grep -v Downl|grep "\.\.\."|grep -v "openHAB Core"|grep -- "->" |grep -v "jetty:jetty-" | grep -v "web:pax-web" |sort -u

Those packages have not been addressed yet, some are transitive deps still:

No upgrade, transitive or blocked:

args4j:args4j ................................................................................... 2.33 -> 2.37 (do not find dep in tree)
de.rototor.pdfbox:graphics2d .................................................................. 3.0.1 -> 3.0.5 (from xchart)

com.fasterxml.woodstox:woodstox-core .......................................................... 6.6.2 -> 7.1.1 (stay with 6.x req. by cxf3, osgi resolves to 6.6.2 during runtime)
com.google.errorprone:error_prone_annotations ............................................... 2.23.0 -> 2.49.0 upgraded to 2.47.0, transitive dep of guava & gson
com.itemis.maven.plugins:unleash-scm-provider-git ............................................. 2.2.0 -> 2.3.0 (handled outside of this repo)
com.jayway.jsonpath:json-path ................................................................ 2.10.0 -> 3.0.0 (3.0.0 brings jackson3 adapter, delay this)
com.neuronrobotics:nrjavaserial .......................................................... 3.14.0 -> 5.2.1.OH1 (intended)

org.apache.cxf:cxf-rt-rs-client ............................................................... 3.6.10 -> 4.2.0 in sync with Karaf, no strict dep to version from Karaf but to other deps
org.apache.cxf:cxf-rt-rs-sse .................................................................. 3.6.10 -> 4.2.0 in sync with Karaf, no strict dep to version from Karaf but to other deps
org.apache.felix:org.apache.felix.configurator .............................................. 1.0.16 -> 1.0.18 in sync with Karaf, 4.5.0 due to jakarta
org.apache.felix:org.apache.felix.http.servlet-api ............................................ 1.2.0 -> 6.1.0 to be done with Karaf 4.5.0
org.apache.felix:org.apache.felix.inventory ................................................... 1.1.0 -> 2.0.0 in sync wit Karaf, 2.0 would be javax
org.apache.felix:org.apache.felix.scr ........................................................ 2.2.6 -> 2.2.14 to be done with Karaf 4.5.0
org.apache.felix:org.apache.felix.webconsole ................................................ 4.8.12 -> 5.0.18 to be done with Karaf 4.5.0
org.apache.felix:org.apache.felix.webconsole.plugins.ds ....................................... 2.2.0 -> 2.3.0 to be done with Karaf 4.5.0
org.apache.pdfbox:pdfbox ..................................................................... 3.0.1 -> 3.0.7 (from xchart)
org.apache.servicemix.bundles:org.apache.servicemix.bundles.saaj-impl ..................... 1.4.0_2 -> 1.5.1_1 same release date, javax -> jakarta, postponed

org.eclipse.emf:org.eclipse.emf.codegen ..................................................... 2.23.0 -> 2.28.0 (xtext generator)
org.eclipse.emf:org.eclipse.emf.codegen.ecore ............................................... 2.37.0 -> 2.45.0 (xtext generator)
org.eclipse.emf:org.eclipse.emf.common ...................................................... 2.30.0 -> 2.45.0 (xtext generator)
org.eclipse.emf:org.eclipse.emf.ecore ....................................................... 2.36.0 -> 2.42.0 (xtext generator)
org.eclipse.emf:org.eclipse.emf.ecore.change ................................................ 2.16.0 -> 2.17.0 (requires ecore 2.37ff)
org.eclipse.emf:org.eclipse.emf.ecore.xmi ................................................... 2.37.0 -> 2.40.0 (xtext generator)
org.eclipse.jdt:ecj ......................................................................... 3.44.0 -> 3.45.0 (transitive dep of jdt.core, we use 3.45.0)
org.eclipse.jdt:org.eclipse.jdt.core ........................................................ 3.44.0 -> 3.45.0 (xtext generator)
org.eclipse.jdt:org.eclipse.jdt.debug ..................................................... 3.25.0 -> 3.25.100 (xtext generator)
org.eclipse.jdt:org.eclipse.jdt.launching ................................................. 3.24.0 -> 3.24.100 (xtext generator)
org.eclipse.platform:org.eclipse.core.resources ......................................... 3.23.100 -> 3.23.200 (xtext generator)
org.eclipse.platform:org.eclipse.core.runtime ............................................. 3.34.100 -> 3.34.200 (xtext generator)
org.eclipse.platform:org.eclipse.equinox.app ................................................ 1.7.500 -> 1.7.600 (xtext generator)
org.eclipse.platform:org.eclipse.text ..................................................... 3.14.500 -> 3.14.600 (xtext generator)

org.glassfish.hk2:* ..................................................................... 3.1.1 -> 4.0.1 (delay, jakarta deps)
org.glassfish.jaxb:jaxb-runtime ............................................................... 2.3.9 -> 4.0.8 (2.3.x is latest without jakarta)

org.hamcrest:hamcrest-core ........................................................................ 1.3 -> 3.0 (do not find dep in tree)

org.javassist:javassist ............................................................... 3.30.2-GA -> 3.31.0-GA (transitive dep of swagger)

org.junit.jupiter:* ....................................................... 5.14.2 -> 6.0.2 see below
org.junit.platform:* ................................................... 1.14.2 -> 6.0.2 conflicts with biz.aQute.tester.junit-platform from 7.2.1 still req. <2.0

Open / In Analysis

com.sun.xml.bind:jaxb-osgi .................................................................... 2.3.9 -> 4.0.8
jakarta.annotation:jakarta.annotation-api ..................................................... 2.1.1 -> 3.0.0
jakarta.xml.bind:jakarta.xml.bind-api ......................................................... 2.3.3 -> 4.0.5
org.antlr:antlr-runtime ......................................................................... 3.2 -> 3.5.3 version 3.2 is transitive dep of xtext, but investigate why we pull in an OH specific version in addition to org.antlr:antlr-runtime

org.eclipse.platform:org.eclipse.osgi ..................................................... 3.24.0 -> 3.24.100

com.google.code.gson:gson ................................................................... 2.13.2 -> 2.14.0 (DateTime and Instant updates, check)
io.micrometer:micrometer-commons ........................................................ 1.16.3 -> 1.16.5 (maybe wait for 1.17.0, already rc1)
io.micrometer:micrometer-core ........................................................... 1.16.3 -> 1.16.5 (maybe wait for 1.17.0, already rc1)

Problems:

jakarta namespace will be used from Karaf 4.5, transition not yet possible

conflicts with hivemq (+dagger)
- still forces us to use mvn:jakarta.inject/jakarta.inject-api/1.0.5 in addons/mqtt.generic, -> 2.x

californium 4.0.0-M2 to later version
- breaking change in API complicating backward-compatible releases of shelly and tradfri binding; severe issues with shelly v1 handler (unresolved)
- upgrade from M2 to M6 was reverted  #5558 

[holgerfriedrich]

I added the last PR of this series to close the last major upgrades before 5.2. 🥳
Now it's time to wait and see if the upgrades caused issues.

main open issues:

• micrometer (waiting for release of current rc0 version),
• gson (might impact Instant/Datetime),
• mapdb (in work),
• modbus (in work, maybe after 5.2)

[BorisFierlings]

It would be nice when the version of netty could be bumed to 4.2.14.Final.

[holgerfriedrich]

@BorisFierlings

It would be nice when the version of netty could be bumed to 4.2.14.Final.

I am afraid we cannot do this. netty is pulled as a transitive dependency of hivemq-mqtt-client. The manifest declares the required version as [4.1,4.2). There is quite a change of dependencies between 4.1 and 4.2, so we will have to wait until hivemq uprades. Their github repo recently switched to 4.1.134, no sign of 4.2 yet.

[holgerfriedrich]

Issue closed as 5.2 has been released. There will be a new one for 5.3 once we have finished the Jetty migration.