[jakartaee-platform-dev] Dependency Analysis with jQA - Cyclic Dependenc

[Jan Westerkamp <jan.westerkamp@xxxxxxx>]

Hello together,

I updated the jQA repo and let fixed the issue with an outdated index at 
Sonatype for the staging repo (again) - now we have new results for the 
upcoming Jakarta EE 10.0.0 release!

I uploaded the report results in a zip file to 
https://github.com/eclipse-ee4j/jakartaee-api/issues/125.

The good news: We are making progress solving issues with dependencies!

The bad news: We have a cyclic dependency in all the Platform Profiles 
(Core, Web and "Full"/Platform):

CDI has a required dependency to Jakarta Transactions, which in turn has 
has required dependency to an older CDI version!
I think, besides Jakarta Transactions referencing an old version of CDI, 
the last must not have a dependency to Transactions at all (or at least 
not a required one using: <optional>true</optional> <!-- value will be 
true or false only -->).

Regarding the comment in CDI, this reference is only used in Javadoc 
references:
            <!-- Only for javadoc references -->
            <dependency>
                <groupId>jakarta.transaction</groupId>
<artifactId>jakarta.transaction-api</artifactId>
<version>${transaction.api.version}</version>
            </dependency>

There are notes in the POM at property level like that too:
        <!-- These are only used in javadoc links -->
        <ejb.api.version>4.0.0</ejb.api.version>
<transaction.api.version>2.0.0</transaction.api.version>

But Transactions will need a updated version to be released and part of 
the referencing spec configurations too!

It would be even better to get rid of that cyclic dependency at all, if 
possible to prevent future issues like that.

You can see this issue at best in the simpler Core Profile graph 
(jakarta.jakartaee-core-api/plantuml/jakarta-ee-dependencies_PlatformDependencyDiagram.svg 
and the version list 
(jakarta.jakartaee-core-api/plantuml/jakarta-ee-dependencies_PlatformDependencyVersionsByArtifact.csv) 
in the zip file mentioned above. The Core Profile should not depend on 
Transactions (and my be others required by CDI directly), but the 
dependency problem with resulting versioning issues can be seen in all 
Profiles, sometimes even worse regarding the use of API versions.

How do we proceed with that issue? Creating on in the relevant spec 
projects (CDI, Transactions and Platform) and discuss this first here in 
the mailing list or in the Jakarta Platform call (that might cause delay)?

Best,

Jan

PS: This might not be the only finding in the jQA analysis, but my first 
severe one - it might be helpful to spend some additional time into it.