api-common using deprecated javax.annotation-api

[sydney-munro]

Google Cloud storage recieved googleapis/java-storage#2176 due to a transient dependency on javax.annotaion-api. This should be updated to the new jakarta namespace.

[suztomo]

javax package is not compliant with Jakarta platform. Please release google-cloud-storage:jar which is Jakarta platform compliant.

Digging further.

Where do we use javax.annotation?

Here are example usages

sdk-platform-java

~/sdk-platform-java$ grep -ir javax.annotation . |awk -F':' '{print $2}' |sort -u gave

• javax.annotation.concurrent.GuardedBy (RetentionPolicy.CLASS). This comes from com.google.code.findbugs:jsr305:jar:3.0.2
• javax.annotation.Generated (RetentionPolicy.SOURCE) This comes from javax.annotation:javax.annotation-api:jar:1.3.2
• javax.annotation.Nonnull (RetentionPolicy.RUNTIME) This comes from com.google.code.findbugs:jsr305:jar:3.0.2
• javax.annotation.Nullable (RetentionPolicy.RUNTIME) This comes from com.google.code.findbugs:jsr305:jar:3.0.2

java-storage

• javax.annotation.concurrent.Immutable (RetentionPolicy.CLASS) This comes from com.google.code.findbugs:jsr305:jar:3.0.2
• javax.annotation.concurrent.ThreadSafe (RetentionPolicy.CLASS) This comes from com.google.code.findbugs:jsr305:jar:3.0.2
• javax.annotation.Generated See above
• javax.annotation.Nullable See above
• javax.annotation.ParametersAreNonnullByDefault (RetentionPolicy.RUNTIME) This comes from com.google.code.findbugs:jsr305:jar:3.0.2

[suztomo]

@abhishekshan03 Would you share details about the noncompliance? Do you get any error message when you use certain tools from Jakarta EE?

I found this article https://jakarta.ee/blogs/javax-jakartaee-namespace-ecosystem-progress/ but it didn't have any specifics about javax.annotation-api.

[abhishekshan03]

Hi @suztomo
Please pardon my limited knowledge. As far as I know packages javax.* are not part of Jakarta EE platform and hence are deprecated and will be replaced by jakarta annotations
As an example please refer to below issue.
jruby/jruby#6514

[MyDogIsMyPersonality]

Hi @suztomo Is there any idea on when this might be released? It is blocking a major upgrade for us.

[suztomo]

@abhishekshan03 @MyDogIsMyPersonality Are you suffering from some errors with certain tools when they're used with GCP Java libraries? I think it's easy to swap but I'd like to ensure to verify the fix.

Thank you for sharing jruby/jruby#6514. I see it's fixed there.

[MyDogIsMyPersonality]

There is more information in issue 2176, but Jakarta won't upgrade due to the transient dependency in javax.

[suztomo]

@MyDogIsMyPersonality googleapis/java-storage#2176 does not have any errors.

Jakarta won't upgrade

Would you elaborate a bit more? Are you referencing a certain version of one of the tools listed in https://jakarta.ee/compatibility/ ?

[abhishekshan03]

@abhishekshan03 @MyDogIsMyPersonality Are you suffering from some errors with certain tools when they're used with GCP Java libraries? I think it's easy to swap but I'd like to ensure to verify the fix.

Thank you for sharing jruby/jruby#6514. I see it's fixed there.

@suztomo
I shared jruby/jruby#6514 as an example for your to refer. I havent not asked any action to be taken on this issue. javax.annotation-api.jar is deprecated and should be replaced by jakarta annotations. This ticket was to illustrate that other projects are replacing deprecated javax.annotation-api.jar with jarkarta annotations.

Can you please give us an ETA for replacing the dependency for javax.annotation-api.jar with jarkarta annotations in google-cloud-storage.jar ?

[abhishekshan03]

https://jakarta.ee/compatibility/

We are not facing any error but since there is dependency on the deprecated javax.annotation-api.jar, we are proactively removing such dependencies.

[suztomo]

Thank you. It's good to hear that there's no one suffering from errors due to the annotations.

we are proactively removing such dependencies

It seems that you're not a normal user of Jakarta EE and Google Cloud. Do you mind sharing who is "we" here (organization name or the name of a team)? Given you're not suffering from this issue, I would like to know the context of why you want this change.

• Do you know any changelog to library users when the library swaps javax.annotation-api to Jakarta Annotations (Does it break something?).
• It seems https://jakarta.ee/specifications/annotations/ has multiple versions: 1.3, 2.0, 2.1, and 3.0. What version are you looking for?

[suztomo]

Got information from the TAM. Thank you. I'll update you about the plan soon. We have the email thread to follow up.

[suztomo]

Continuing investigation.

[suztomo]

We use code generators in Cloud SDK for Java, and they use javax.annotation.Generated:

• autovalue: Use Jakarta's @Generated annotation if available google/auto#1602
• grpc-java: Replace javax.annotation.Generated with custom gRPC annotation grpc/grpc-java#9179

Now each has tracking feature request (but no commitment). So far no one has suffered problems caused by javax namespace.

For GuardedBy, (usage), as long as the purpose is Errorprone's static analysis, Errorprone's com.google.errorprone.annotations.concurrent.GuardedBy is recommended one. I'm working on #2061.

GuardedBy

https://github.com/google/error-prone/blob/master/docs/bugpattern/GuardedBy.md

The GuardedBy analysis checks that fields or methods annotated with @GuardedBy(lock) are only accessed when the specified lock is held.

Would removing the synchronized clause fail the build? => Yes, the Bazel build caught a bug I intentionally introduced in #2060.