[MDEP-774] analyze-only failed: PermittedSubclasses requires ASM9

[jira-importer]

Dan Ziemba opened MDEP-774 and commented

The analyze-only goal does not work with Java 17 bytecode:

Execution dep-analyze of goal org.apache.maven.plugins:maven-dependency-plugin:3.2.0:analyze-only failed: PermittedSubclasses requires ASM9

Running the same build under the same version of Java 17, but with "maven.compiler.release" set to 16 works fine.

---

Affects: 3.2.0

Issue Links:

• MDEP-784 Upgrade maven-dependency-analyzer to 1.12.0
  ("is blocked by")

• MDEP-747 analyze-only failed: Unsupported class file major version 61 (Java 17)

• MDEP-786 Sealed classes not supported

• MSHARED-982 Use OpCodes.ASM9 (ASM 9.2)

9 votes, 15 watchers

[jira-importer]

Mark Raynsford commented

The usual workaround for this kind of problem (add an explicit dependency on a newer version of ASM) doesn't work. This one looks like it needs a code change.

[jira-importer]

Steven Schlansker commented

I see the same problem, only it is:

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-dependency-plugin:3.2.0:analyze-only (basepom.default) on project assisted-inject: Execution basepom.default of goal org.apache.maven.plugins:maven-dependency-plugin:3.2.0:analyze-only failed: Record requires ASM8 

Probably the same fix in both cases... (I already managed asm dependency to latest 9.2)

[jira-importer]

Paul Barton commented

This should work if the maven-dependency-analyzer pushes the 1.12.0 release and the maven-dependency-plugin pom is updated to use this new version, correct?

As from what I can tell is that the maven-dependency-analyzer 1.11.3 uses Opcodes.ASM8 (524288) for the API version when initializing the ClassVisitor.

The latest master of maven-dependency-analyzer (1.12.0-SNAPSHOT) has this updated to use Opcoes.ASM9 (589824), https://github.com/apache/maven-dependency-analyzer/blob/a79910e73809f45c6cba473d87f880012be7146e/src/main/java/org/apache/maven/shared/dependency/analyzer/asm/DefaultClassVisitor.java#L64 

The maven-dependency-plugin 3.2.0 (latest version) uses ASM 9.1 which will fail with this error if the API version when initializing ClassVisitor is less than Opcoes.ASM9 (589824), https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_1/asm/src/main/java/org/objectweb/asm/ClassVisitor.java#L265 

[jira-importer]

Stefan Philippesn commented

Any chance for a new version  of maven-dependency-analyzer?

[jira-importer]

Pino Silvaggio commented

Do we have an ETA? Maybe release a milestone (-MX) version if necessary (like surefire).

[jira-importer]

Jordan Zimmerman commented

Why is this marked as fixed? It's still failing for me with Java 17.0.1

Execution default-cli of goal org.apache.maven.plugins:maven-dependency-plugin:3.3.0:analyze-only failed: PermittedSubclasses requires ASM9

[jira-importer]

Slawomir Jaranowski commented

Jordan Zimmerman - Please provide minimal project which can reproduce it.

[jira-importer]

Jordan Zimmerman commented

Sorry - it was our error. Our parent pom forced the ASM version to work around the earlier issue in the plugin. Sorry for the noise.