chore(java): arrow 18.3.0

[stevenschlansker]

arrow 15.0.0 is marked as vulnerable to CVE-2024-52338 Despite this CVE only affecting the R implementation, the CPE is not scoped to R so Java checkers will report as vulnerable:

13:25:42  [ERROR] One or more dependencies were identified with vulnerabilities:
13:25:42  [ERROR] arrow-memory-core-15.0.0.jar (pkg:maven/org.apache.arrow/[email protected], cpe:2.3:a:apache:arrow:15.0.0:*:*:*:*:*:*:*): CVE-2024-52338(9.8)

while this is really a problem with the CPE, the easiest fix by far is to simply update arrow

[stevenschlansker]

Well, this did not work as well as I had hoped, it seems Arrow has ended support for Java 8:

Error:    bad class file: /home/runner/.m2/repository/org/apache/arrow/arrow-vector/18.3.0/arrow-vector-18.3.0.jar(org/apache/arrow/vector/types/pojo/Field.class)
Error:      class file has wrong version 55.0, should be 52.0

[stevenschlansker]

I guess we cannot upgrade Arrow anymore. No new bugfixes and no new features, to stay on ancient and unsupported Java 8 😞

[chaokunyang]

we could make fory-format to use java11+ or java17, but still needs to let fory-core use java8. Serialization is so foundamental, that lots of online system still use java8. But for fory-format,, since it's nto fory online system, we could just upgrade to java11+

[stevenschlansker]

That would be nice, but I worry it would complicated the build and release process and ci pipelines a fair bit...

[chaokunyang]

Maven support use different java version for different module::

<build>
    <plugins>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-compiler-plugin</artifactId>
            <version>3.10.1</version>
            <configuration>
                <release>${maven.compiler.release}</release>
            </configuration>
        </plugin>
    </plugins>
</build>

but it needs an extra toolchains.xml file to specify different jdk install location.

mvn clean install --toolchains toolchains.xml

<?xml version="1.0" encoding="UTF8"?>
<toolchains>
  <toolchain>
    <type>jdk</type>
    <provides>
      <version>11</version>
    </provides>
    <configuration>
      <jdkHome>/path/to/jdk-11</jdkHome>
    </configuration>
  </toolchain>
  <toolchain>
    <type>jdk</type>
    <provides>
      <version>17</version>
    </provides>
    <configuration>
      <jdkHome>/path/to/jdk-17</jdkHome>
    </configuration>
  </toolchain>
</toolchains>

I can configure all modules to java 11 to skip this, but when running on ci and making release, we use a scipt to automatically switched to use this "polyglot" Maven builds. This won't introduce too much burden to users and contributors

I think we can do it after #2406 is merged

[stevenschlansker]

Sounds good to me, thank you for considering this.