RANGER-5523: replace jersey-bundle dependency with jersey-client and jersey-core in plugins by mneethiraj · Pull Request #882 · apache/ranger

mneethiraj · 2026-03-21T04:29:13Z

What changes were proposed in this pull request?

(Please fill in changes proposed in this fix. Create an issue in ASF JIRA before opening a pull request and
set the title of the pull request which starts with
the corresponding JIRA issue number. (e.g. RANGER-XXXX: Fix a typo in YYY))

How was this patch tested?

verified all unit tests complete successfully
verified Ranger admin, usersync, kms and tagsync servers startup successfully
verified plugins for HDFS, Hive, HBase, Kafka, Knox, KMS, YARN and Trino initialize successfully, and enforce Ranger policies

…jersey-core in plugins

Copilot

Pull request overview

Updates Ranger plugin packaging to avoid using the monolithic Jersey 1 jersey-bundle by switching to more granular Jersey artifacts, while also making several assembly descriptors pin Jersey coordinates explicitly.

Changes:

Add a new ${jsr311-api.version} property at the root build level.
Replace com.sun.jersey:jersey-bundle with com.sun.jersey:jersey-client + com.sun.jersey:jersey-core in some plugin/module dependency and assembly definitions.
Update multiple distro assembly descriptors to use explicit groupId:artifactId:jar:version coordinates for Jersey artifacts.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
pom.xml	Adds `jsr311-api.version` property for packaging/assembly use.
agents-common/pom.xml	Replaces `jersey-bundle` with `jersey-client` + `jersey-core` in shared plugin common deps.
hbase-agent/pom.xml	Removes `jsr311-api` exclusion from `jersey-client` while keeping it on `jersey-core`.
distro/src/main/assembly/usersync.xml	Pins `jersey-bundle` include to an explicit jar/version coordinate.
distro/src/main/assembly/storm-agent.xml	Switches Storm agent packaging from `jersey-bundle` to `jersey-client` + `jersey-core`.
distro/src/main/assembly/sample-client.xml	Pins `jersey-bundle` include to an explicit jar/version coordinate.
distro/src/main/assembly/ranger-tools.xml	Pins `jersey-bundle` include to an explicit jar/version coordinate.
distro/src/main/assembly/plugin-trino.xml	Removes server-related Jersey includes and adds `jersey-client` + `jersey-core` (+ `jersey-json`).
distro/src/main/assembly/plugin-presto.xml	Removes server-related Jersey includes and adds `jersey-client` + `jersey-core` (+ `jersey-json`).
distro/src/main/assembly/plugin-ozone.xml	Replaces prior Jersey includes with `jersey-client` + `jersey-core` in multiple dependency lists.
distro/src/main/assembly/plugin-kafka.xml	Replaces `jersey-bundle` with `jersey-client` + `jersey-core` in plugin impl packaging.
distro/src/main/assembly/plugin-elasticsearch.xml	Replaces `jersey-bundle` with `jersey-client` + `jersey-core` in plugin impl packaging.
distro/src/main/assembly/plugin-atlas.xml	Replaces `jersey-bundle` with `jersey-client` + `jersey-core` in plugin impl packaging.
distro/src/main/assembly/plugin-solr.xml	Replaces `jersey-bundle` with `jersey-client` + `jersey-core` and explicitly includes `jsr311-api`.
distro/src/main/assembly/kms.xml	Pins `jersey-bundle` include to an explicit jar/version coordinate.
distro/src/main/assembly/admin-web.xml	Adds an explicit `jersey-bundle` include to the embedded webserver lib set.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

distro/src/main/assembly/plugin-presto.xml

Copilot · 2026-03-21T04:36:43Z

distro/src/main/assembly/storm-agent.xml

            <includes>
-              <include>com.sun.jersey:jersey-bundle:jar:${jersey-bundle.version}</include>
+              <include>com.sun.jersey:jersey-client:jar:${jersey-bundle.version}</include>
+              <include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>


This dependencySet includes jersey-client/jersey-core but no explicit JAX-RS API jar. Since the storm plugin depends on ranger-plugins-common (which imports javax.ws.rs.*), add javax.ws.rs:jsr311-api:jar:${jsr311-api.version} here (or ensure an equivalent API jar is included in one of the dependencySets) to prevent runtime CNFEs.

Suggested change

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>javax.ws.rs:jsr311-api:jar:${jsr311-api.version}</include>

Copilot · 2026-03-21T04:36:43Z

distro/src/main/assembly/plugin-kafka.xml

 					<include>commons-collections:commons-collections</include>
-					<include>com.sun.jersey:jersey-bundle</include>
+					<include>com.sun.jersey:jersey-client:jar:${jersey-bundle.version}</include>
+					<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>


After replacing jersey-bundle with jersey-client/jersey-core, this include list no longer guarantees a javax.ws.rs API jar is packaged. Since ranger-plugins-common uses javax.ws.rs.*, consider adding an explicit include for javax.ws.rs:jsr311-api:jar:${jsr311-api.version} (like plugin-solr.xml) to keep the plugin distribution self-contained.

Suggested change

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>javax.ws.rs:jsr311-api:jar:${jsr311-api.version}</include>

Copilot · 2026-03-21T04:36:44Z

distro/src/main/assembly/plugin-ozone.xml

-                    <include>com.sun.jersey:jersey-client</include>
-                    <include>com.sun.jersey:jersey-bundle</include>
+                    <include>com.sun.jersey:jersey-client:jar:${jersey-bundle.version}</include>
+                    <include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>


This plugin-impl dependency list includes jersey-client/jersey-core but does not explicitly include a JAX-RS API jar. Since plugin code depends on javax.ws.rs.*, add javax.ws.rs:jsr311-api:jar:${jsr311-api.version} (as in plugin-solr.xml) or ensure an equivalent API jar is included elsewhere in the assembly.

Suggested change

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>javax.ws.rs:jsr311-api:jar:${jsr311-api.version}</include>

Copilot · 2026-03-21T04:36:44Z

distro/src/main/assembly/plugin-trino.xml

-                    <include>com.sun.jersey:jersey-json</include>
+                    <include>com.sun.jersey:jersey-client:jar:${jersey-bundle.version}</include>
+                    <include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>
+                    <include>com.sun.jersey:jersey-json:jar:${jersey-bundle.version}</include>


This plugin assembly now lists Jersey artifacts individually. To avoid missing JAX-RS API classes at runtime (used by ranger-plugins-common), add an explicit include for javax.ws.rs:jsr311-api:jar:${jsr311-api.version} alongside the Jersey includes (similar to plugin-solr.xml).

Suggested change

<include>com.sun.jersey:jersey-json:jar:${jersey-bundle.version}</include>

<include>com.sun.jersey:jersey-json:jar:${jersey-bundle.version}</include>

<include>javax.ws.rs:jsr311-api:jar:${jsr311-api.version}</include>

Copilot · 2026-03-21T04:36:44Z

agents-common/pom.xml

        <dependency>
            <groupId>com.sun.jersey</groupId>
-            <artifactId>jersey-bundle</artifactId>
+            <artifactId>jersey-client</artifactId>
+            <version>${jersey-bundle.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.sun.jersey</groupId>
+            <artifactId>jersey-core</artifactId>
            <version>${jersey-bundle.version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>javax.ws.rs</groupId>
-                    <artifactId>jsr311-api</artifactId>
-                </exclusion>
-            </exclusions>
        </dependency>


In this module you replaced jersey-bundle with jersey-client/jersey-core, but the prior setup excluded javax.ws.rs:jsr311-api (see other modules like kms/pom.xml). Consider explicitly managing the JAX-RS API instead of inheriting it transitively: either add jsr311-api as a direct dependency (using the new ${jsr311-api.version}) or re-add exclusions on both Jersey dependencies to avoid pulling an unexpected JAX-RS API version into downstream plugins.

hbase-agent/pom.xml

Copilot · 2026-03-21T04:36:45Z

distro/src/main/assembly/plugin-atlas.xml

          <include>commons-collections:commons-collections</include>
-          <include>com.sun.jersey:jersey-bundle</include>
+          <include>com.sun.jersey:jersey-client:jar:${jersey-bundle.version}</include>
+          <include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>


This plugin assembly now includes jersey-client/jersey-core but does not explicitly include a JAX-RS API jar. Since ranger-plugins-common code imports javax.ws.rs.*, ensure javax.ws.rs:jsr311-api is included in this dependency set (similar to plugin-solr.xml) so the plugin package is self-contained.

Suggested change

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>javax.ws.rs:jsr311-api</include>

Copilot · 2026-03-21T04:36:45Z

distro/src/main/assembly/plugin-elasticsearch.xml

          <include>org.eclipse.jetty:jetty-client:jar:${jetty-client.version}</include>
-          <include>com.sun.jersey:jersey-bundle</include>
+          <include>com.sun.jersey:jersey-client:jar:${jersey-bundle.version}</include>
+          <include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>


This assembly switches from jersey-bundle to jersey-client/jersey-core, but there is no explicit include for a JAX-RS API jar. Because plugin code (via ranger-plugins-common) references javax.ws.rs.*, add javax.ws.rs:jsr311-api:jar:${jsr311-api.version} to the includes (as done in plugin-solr.xml) to avoid runtime CNFEs in environments that don't already provide the API.

Suggested change

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>javax.ws.rs:jsr311-api:jar:${jsr311-api.version}</include>

Copilot · 2026-03-21T04:36:45Z

distro/src/main/assembly/plugin-ozone.xml

-                    <include>com.sun.jersey:jersey-core</include>
-                    <include>com.sun.jersey:jersey-client</include>
+                    <include>com.sun.jersey:jersey-client:jar:${jersey-bundle.version}</include>
+                    <include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>


This dependencySet now includes only jersey-client/jersey-core and does not explicitly include a JAX-RS API jar. Given ranger-plugins-common references javax.ws.rs.*, add javax.ws.rs:jsr311-api:jar:${jsr311-api.version} here (or otherwise ensure the API jar is included) to avoid runtime classloading failures.

Suggested change

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>

<include>javax.ws.rs:jsr311-api:jar:${jsr311-api.version}</include>

Copilot

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 9 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tagsync/pom.xml

security-admin/pom.xml

ugsync/pom.xml

plugin-kafka/pom.xml

hive-agent/pom.xml

Copilot · 2026-03-21T06:54:26Z

distro/src/main/assembly/plugin-trino.xml

                    <include>com.fasterxml.jackson.core:jackson-annotations:jar:${fasterxml.jackson.version}</include>
                    <include>com.fasterxml.jackson.core:jackson-core:jar:${fasterxml.jackson.version}</include>
                    <include>com.fasterxml.jackson.core:jackson-databind:jar:${fasterxml.jackson.version}</include>


The Trino plugin assembly now includes jersey-client/jersey-core (and jersey-json) but does not include javax.ws.rs:jsr311-api. Since the assembly uses an explicit <includes> filter, the resulting tarball may not contain the javax.ws.rs.* API classes required by Jersey 1.x. Add an explicit include for jsr311-api using ${jsr311-api.version}.

Suggested change

<include>com.fasterxml.jackson.core:jackson-annotations:jar:${fasterxml.jackson.version}</include>

<include>com.fasterxml.jackson.core:jackson-core:jar:${fasterxml.jackson.version}</include>

<include>com.fasterxml.jackson.core:jackson-databind:jar:${fasterxml.jackson.version}</include>

plugin-kms/pom.xml

hdfs-agent/pom.xml

ugsync/pom.xml

RANGER-5523: replace jersey-bundle dependency with jersey-client and …

37cb2f4

…jersey-core in plugins

mneethiraj requested review from Copilot, dhavalshah9131, kumaab, mehulbparikh, pradeepagrawal8184 and rameeshm March 21, 2026 04:29

Copilot started reviewing on behalf of mneethiraj March 21, 2026 04:29 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

RANGER-5523: updates to address review suggestions

84a6d0a

mneethiraj requested a review from Copilot March 21, 2026 06:47

Copilot started reviewing on behalf of mneethiraj March 21, 2026 06:48 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

	<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>
	<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>
	<include>javax.ws.rs:jsr311-api:jar:${jsr311-api.version}</include>

	<include>com.sun.jersey:jersey-json:jar:${jersey-bundle.version}</include>
	<include>com.sun.jersey:jersey-json:jar:${jersey-bundle.version}</include>
	<include>javax.ws.rs:jsr311-api:jar:${jsr311-api.version}</include>

	<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>
	<include>com.sun.jersey:jersey-core:jar:${jersey-bundle.version}</include>
	<include>javax.ws.rs:jsr311-api</include>

	<include>com.fasterxml.jackson.core:jackson-annotations:jar:${fasterxml.jackson.version}</include>
	<include>com.fasterxml.jackson.core:jackson-core:jar:${fasterxml.jackson.version}</include>
	<include>com.fasterxml.jackson.core:jackson-databind:jar:${fasterxml.jackson.version}</include>

Conversation

mneethiraj commented Mar 21, 2026

What changes were proposed in this pull request?

How was this patch tested?

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants