tcurdt / jdependency

Provides an API to analyse and modify class dependencies. It provides the core to the maven shade plugin for removing unused classes.

jdependency - explore your classpath

jdependency is small library that helps you analyze class level dependencies, clashes and missing classes.

Check the documentation on how to use it with javadocs and a source xref is also available.

Where to get it

The jars are available on maven central. The source releases you can get in the download section.

If feel adventures or want to help out feel free to get the latest code via git.

git clone git://github.com/tcurdt/jdependency.git

How to use it

final File jar1 = ...
final File jar2 = ...

or

final Path jar1 = ...
final Path jar2 = ...

finding classpath clashes

final Clazzpath cp = new Clazzpath();
cp.addClazzpathUnit(jar1, "jar1.jar");
cp.addClazzpathUnit(jar2, "jar2.jar");

final Set<Clazz> clashed = cp.getClashedClazzes();
for(Clazz clazz : clashed) {
  System.out.println("class " + clazz + " is contained in " + clazz.getClasspathUnits());
}

finding different class versions

final Clazzpath cp = new Clazzpath(true);
cp.addClazzpathUnit(jar1, "jar1.jar");
cp.addClazzpathUnit(jar2, "jar2.jar");

final Set<Clazz> clashed = cp.getClashedClazzes();

final Set<Clazz> uniq = clashed.stream()
  .filter(c -> c.getVersions().size() == 1)
  .collect(Collectors.toSet());

clashed.removeAll(uniq);

for(Clazz clazz : clashed) {
  System.out.println("class " + clazz + " differs accross " + clazz.getClasspathUnits());
}

finding missing classes

final Clazzpath cp = new Clazzpath();
cp.addClazzpathUnit(jar1, "jar1.jar");

final Set<Clazz> missing = cp.getMissingClazzes();
for(Clazz clazz : missing) {
  System.out.println("class " + clazz + " is missing");
}

finding unused classes

final Clazzpath cp = new Clazzpath();
final ClazzpathUnit artifact = cp.addClazzpathUnit(jar1, "artifact.jar");
cp.addClazzpathUnit(jar2, "dependency.jar");

final Set<Clazz> removable = cp.getClazzes();
removable.removeAll(artifact.getClazzes());
removable.removeAll(artifact.getTransitiveDependencies());

for(Clazz clazz : removable) {
  System.out.println("class " + clazz + " is not required");
}

Related projects

provides a report of the dependencies used/unused and provides a debloated version of the pom.xml

Project	Description
maven-shade-plugin	allows to inline and optimize dependencies into a single jar
gradle-lean	gradle version of the maven-shade plugin (stale)
shadow	gradle version of the maven-shade plugin
jarjar	allows to inline and optimize dependencies into a single jar (stale)
proguard	obfuscator, shrinker (GPL)
DepClean	provides a report of the dependencies used/unused and provides a debloated version of the pom.xml

License

All code and data is released under the Apache License 2.0.

jdependency's Issues

Release new version

Hello,

I'm wondering if a new version could be released sometime soonish addressing the incompatibility with records.

Kind regards

commons-io dependency in pom

Hi,

Could you please tweak the commons-io dependency groupId in your pom.xml? It should be commons-io, not org.apache.commons.

I've looked into it and the groupId was changed to org.apache.commons for commons-io 2.0, but it's still commons-io for commons-io 1.x. There are some redirects on repo1 that make it downloadable using both groupIds, but Artifactory (repo proxy) doesn't like it when the groupId doesn't match the deployment path:

2011-02-09 15:55:19,344 [pool-1-thread-6] WARN - IO error while trying to save resource repo1:org/apache/commons/commons-io/1.3.2/commons-io-1.3.2.pom'': The target deployment path 'org/apache/commons/commons-io/1.3.2/commons-io-1.3.2.pom' does not match the POM's expected path prefix 'commons-io/commons-io/1.3.2'. Please verify your POM content for correctness and make sure the source path is a valid Maven 2 repository root path.

In my case jdependency 0.6 is being pulled in by the shade plugin or one of its dependencies.

Thanks,

Mike

Badge about version does not show the recent version

If you change the URL for search in your Maven Central Badge:

http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.vafer%22%20a%3A%22jdependency%22

It will show the most recent version.

Failed test with Java 14

[ERROR] Tests run: 1, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 0.033 s <<< FAILURE! - in org.vafer.jdependency.DependencyUtilsTestCase
[ERROR] org.vafer.jdependency.DependencyUtilsTestCase.testShouldFindDependenciesOfClassObject  Time elapsed: 0.022 s  <<< FAILURE!
java.lang.AssertionError: expected:<[java.lang.Throwable, java.lang.InterruptedException, java.lang.Class, java.lang.Object, java.lang.StringBuilder, java.lang.String, java.lang.IllegalArgumentException, java.lang.Integer, java.lang.CloneNotSupportedException]> but was:<[java.lang.Throwable, java.lang.InterruptedException, java.lang.Deprecated, jdk.internal.HotSpotIntrinsicCandidate, java.lang.Object, java.lang.Class, java.lang.StringBuilder, java.lang.String, java.lang.IllegalArgumentException, java.lang.Integer, java.lang.CloneNotSupportedException]>
        at org.vafer.jdependency.DependencyUtilsTestCase.testShouldFindDependenciesOfClassObject(DependencyUtilsTestCase.java:59)

Upgrade asm to 8.0

https://search.maven.org/search?q=org.ow2.asm

Could you so kind to upgrade asm to 8.0 and make a new release ? Would be great. thanks in advance.

Dependency Dashboard

This issue provides visibility into Renovate updates and their statuses. Learn more

This repository currently has no open or pending branches.

---

• Check this box to trigger a request for Renovate to run again on this repository

ASM 7 reference in DependenciesClassAdapter causing error in ShadowJar with Java 14 preview features

This ASM7 reference:

jdependency/src/main/java/org/vafer/jdependency/asm/DependenciesClassAdapter.java

Line 128 in c2e760c

super(Opcodes.ASM7);

appears to be causing an exception in ShadowJar's task (https://hastebin.com/egemarucaw.txt) in any project using records (and potentially other Java 14 preview features as well). Were the references in this class meant to be changed in the ASM8 update?

New Release Please

Hi,

Would greatly appreciate a release of the latest version to central.
I understand that a beta version of asm is being used, but Java 9 support for maven-shade-plugin is blocked on this, and subsequently so are even further downstream projects.

Thanks

Release 1.5 to maven central

Hi,

Would it be possible to release version 1.5 to Maven Central?
The fix implemented on #17 should unblock maven-shaded-plugin.

Thanks

Upgrade the asm.version from 6.0 to 6.1

By the upgrade you can support JDK 10 which currently fails related to the asm dependency.
It would also very helpful not to use shade plugins an package asm deps cause this prevents it to override existing dependencies to fix issues...

java.lang.UnsupportedOperationException: This feature requires ASM7

Hi,

I'm not familiar with the ins and outs of either jdependency or the asm projects, but I'm trying to find a fix around an issue in a Gradle plugin called GradleUp/shadow#406.

The problem there is that building with OpenJDK 11 does not seem to work due to the following exception:

Caused by: java.lang.UnsupportedOperationException: This feature requires ASM7
        at shadow.org.objectweb.asm.ClassVisitor.visitNestHost(ClassVisitor.java:150)
        at shadow.org.objectweb.asm.ClassVisitor.visitNestHost(ClassVisitor.java:153)
        at shadow.org.objectweb.asm.commons.ClassRemapper.visitNestHost(ClassRemapper.java:185)
        at shadow.org.objectweb.asm.ClassReader.accept(ClassReader.java:541)
        at shadow.org.objectweb.asm.ClassReader.accept(ClassReader.java:391)
        at shadow.org.vafer.jdependency.Clazzpath.addClazzpathUnit(Clazzpath.java:179)
        at shadow.org.vafer.jdependency.Clazzpath.addClazzpathUnit(Clazzpath.java:119)
        at shadow.org.vafer.jdependency.Clazzpath.addClazzpathUnit(Clazzpath.java:95)
        at shadow.org.vafer.jdependency.Clazzpath.addClazzpathUnit(Clazzpath.java:86)
        at shadow.org.vafer.jdependency.Clazzpath$addClazzpathUnit.call(Unknown Source)
        at com.github.jengelman.gradle.plugins.shadow.internal.UnusedTracker$_closure1.doCall(UnusedTracker.groovy:18)

I've tested with jdependency-2.1, which already uses ASM 7.0-beta, but I think this exception comes from an Opcodes.ASM6 definition at DependenciesClassAdapter.java in the 2.1 release.

Does this make sense?

Missing classes from JRE

Hallo,
i just tried the feature with missing classes. When i uses it it shows some classes from JRE missing, for example:
...
com.sun.net.httpserver.Filter referenced by [org.springframework.remoting.support.SimpleHttpServerFactoryBean, org.springframework.remoting.jaxws.SimpleHttpServerJaxWsServiceExporter][[spring-context-5.0.8.RELEASE.jar, spring-web-5.0.8.RELEASE.jar]]
com.sun.net.httpserver.Headers referenced by [org.springframework.remoting.httpinvoker.SimpleHttpInvokerServiceExporter, org.springframework.remoting.caucho.SimpleHessianServiceExporter][[spring-web-5.0.8.RELEASE.jar]]
com.sun.net.httpserver.HttpContext referenced by [org.springframework.remoting.support.SimpleHttpServerFactoryBean, org.springframework.remoting.jaxws.SimpleHttpServerJaxWsServiceExporter][[spring-context-5.0.8.RELEASE.jar, spring-web-5.0.8.RELEASE.jar]]
...
com.sun.net.ssl.KeyManager referenced by [oracle.security.pki.ssl.ClassFileServer, oracle.security.pki.ssl.SSLSocketClient, oracle.security.pki.ssl.OracleSSLX509KeyManagerFactory103][[oraclepki-12.1.0.2.jar]]
com.sun.net.ssl.KeyManagerFactory referenced by [oracle.security.pki.ssl.ClassFileServer, oracle.security.pki.ssl.SSLSocketClient][[oraclepki-12.1.0.2.jar]]
com.sun.net.ssl.KeyManagerFactorySpi referenced by [oracle.security.pki.ssl.OracleSSLX509KeyManagerFactory103][[oraclepki-12.1.0.2.jar]]
...
sun.security.krb5.Checksum referenced by [oracle.net.ano.AuthenticationService][[ojdbc7-12.1.0.2.jar]]
sun.security.krb5.EncryptedData referenced by [oracle.net.ano.AuthenticationService][[ojdbc7-12.1.0.2.jar]]
sun.security.krb5.EncryptionKey referenced by [oracle.net.ano.AuthenticationService][[ojdbc7-12.1.0.2.jar]]
...

Do i need to add the JRE to classpath? This is not trivial with the new jrt-fs. On the other hand, basic java classes are not marked missing.

greetings

Do not create shaded artifact which prevents dependency override.

Currently your project shades the whole depenencies in particular org.ow2.* which means a consuming project can not override the used version by newer ones in cases where errors etc. occur.

jdependency shows wrong class clash

Hello,
There is a bug in the jdependency, where a class is wrongly linked to a wrong jar!

Code to reproduce (it is from a gradle buildscript)

      final Clazzpath cp = new Clazzpath();

      cp.addClazzpathUnit(new File("$jarDir/cxf-core-3.4.0.jar"), 'cxf-core-3.4.0.jar');
      cp.addClazzpathUnit(new File("$jarDir/woodstox-core-6.2.3.jar"), 'woodstox-core-6.2.3.jar');

      cp.getClazzes().stream()
        .filter{ it.getName().contains('W3CSchema')}
        .forEach{println "$it -> ${it.getClazzpathUnits()}"}

output:

> Task :checkClasspath
com.ctc.wstx.msv.W3CSchemaFactory -> [woodstox-core-6.2.3.jar]
com.ctc.wstx.msv.W3CSchema -> [cxf-core-3.4.0.jar, woodstox-core-6.2.3.jar]
com.ctc.wstx.osgi.ValidationSchemaFactoryProviderImpl$W3CSchema -> [woodstox-core-6.2.3.jar]

But this is wrong, cxf-core-3.4.0.jar does not contain W3CSchema nor any 'com'-package.

link to the libs:
https://mvnrepository.com/artifact/org.apache.cxf/cxf-core/3.4.0
https://mvnrepository.com/artifact/com.fasterxml.woodstox/woodstox-core/6.2.3

kind regards

ps. there are many more false results with different classes with this two jars, as well with other jars

Nontrivial assumption in addClazzpathUnit

It seems that addClazzpathUnit expects that all dependencies of the class were already added. A simple test case demonstrating the issue on the jdependency sources:

public class AddCpuTest {
    @Test
    public void testClassThenDependency() throws IOException {
        Clazzpath cp = new Clazzpath();
        ClazzpathUnit cpu = cp.addClazzpathUnit(getLocalClassFile(Clazzpath.class));
        cp.addClazzpathUnit(getLocalClassFile(DependenciesClassAdapter.class));
        assertFalse(cpu.getDependencies().isEmpty());
    }

    @Test
    public void testDependencyThenClass() throws IOException {
        Clazzpath cp = new Clazzpath();
        cp.addClazzpathUnit(getLocalClassFile(DependenciesClassAdapter.class));
        ClazzpathUnit cpu = cp.addClazzpathUnit(getLocalClassFile(Clazzpath.class));
        assertFalse(cpu.getDependencies().isEmpty());
    }

    private File getLocalClassFile(Class<?> clazz) {
        URL url = clazz.getResource('/' + clazz.getName().replace('.', '/') + ".class");
        return new File(url.getFile());
    }
}

Is this the expected behaviour?

Question?

Hi, would it be possible to make a new release ?

jdk21 release

hi. Can we have another release for Java 21?