Add Graal SDK 25.0.2 bundle#1323
Conversation
WalkthroughAdds a new Maven POM at graal-sdk/25.0.2.wso2v1/pom.xml that builds an OSGi bundle for GraalVM SDK, pins GraalVM dependency versions to 25.0.2, configures maven-bundle-plugin (exports, embeds, imports, DynamicImport-Package), and adds WSO2 Nexus repository and distributionManagement entries. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@graal-sdk/25.0.5.wso2v1/pom.xml`:
- Around line 63-66: Update the version values so they are consistent with the
module directory/version; set the pom properties graalvm.version and
graalvm.export.version to match the module version (e.g., 25.0.5 and
25.0.5.wso2v1 if the module is 25.0.5.wso2v1 or to 25.0.4/25.0.4.wso2v1 if
you're targeting 25.0.4) ensuring both graalvm.version and
graalvm.export.version are changed together to the same target version as the
package directory name.
- Around line 117-121: The <snapshotRepository> entry contains a mismatched
<name> ("Apache Snapshot Repository") for the WSO2 URL; update the <name> value
inside the snapshotRepository block (the <name> element associated with
snapshotRepository) to accurately reflect the WSO2 repository (e.g., "WSO2
Snapshot Repository" or similar) so the repository name matches the <url> and
<id>.
- Around line 95-107: Update the repository declaration for the "wso2-nexus"
repository: change the <url> value from http://maven.wso2.org/... to the HTTPS
equivalent (https://maven.wso2.org/...) and remove or change the
<checksumPolicy> from "ignore" to a stricter policy such as "fail" (or remove
the tag to use the default) so artifact integrity is enforced; modify the
<repository> block containing <id>wso2-nexus</id>, <url> and <checksumPolicy>
accordingly.
- Around line 68-93: The pom.xml uses an outdated maven-bundle-plugin version
(5.1.8); update the plugin declaration for org.apache.felix:maven-bundle-plugin
in the build->plugins block to use version 6.0.0 by changing the <version>
element for the maven-bundle-plugin entry so the plugin declaration (groupId
org.apache.felix, artifactId maven-bundle-plugin) uses 6.0.0 instead of 5.1.8.
| <properties> | ||
| <graalvm.version>25.0.2</graalvm.version> | ||
| <graalvm.export.version>25.0.2.wso2v1</graalvm.export.version> | ||
| </properties> |
There was a problem hiding this comment.
Version mismatch between file path, PR title, and properties.
The file is located at graal-sdk/25.0.5.wso2v1/pom.xml and the PR title mentions "Graal SDK 25.0.4", but the properties define graalvm.version as 25.0.2. This inconsistency will cause confusion and the bundle version won't match the directory structure.
Please align the version across:
- Directory name
graalvm.versionpropertygraalvm.export.versionproperty
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@graal-sdk/25.0.5.wso2v1/pom.xml` around lines 63 - 66, Update the version
values so they are consistent with the module directory/version; set the pom
properties graalvm.version and graalvm.export.version to match the module
version (e.g., 25.0.5 and 25.0.5.wso2v1 if the module is 25.0.5.wso2v1 or to
25.0.4/25.0.4.wso2v1 if you're targeting 25.0.4) ensuring both graalvm.version
and graalvm.export.version are changed together to the same target version as
the package directory name.
| <build> | ||
| <plugins> | ||
| <plugin> | ||
| <groupId>org.apache.felix</groupId> | ||
| <artifactId>maven-bundle-plugin</artifactId> | ||
| <version>5.1.8</version> | ||
| <extensions>true</extensions> | ||
| <configuration> | ||
| <instructions> | ||
| <Bundle-SymbolicName>${project.artifactId}</Bundle-SymbolicName> | ||
| <Bundle-Name>${project.artifactId}</Bundle-Name> | ||
| <Export-Package> | ||
| org.graalvm.polyglot.*;version="${graalvm.export.version}" | ||
| </Export-Package> | ||
| <Embed-Dependency> | ||
| graal-sdk|js|truffle-api|regex|icu4j; | ||
| </Embed-Dependency> | ||
| <Import-Package> | ||
| *;resolution:=optional | ||
| </Import-Package> | ||
| <DynamicImport-Package>*</DynamicImport-Package> | ||
| </instructions> | ||
| </configuration> | ||
| </plugin> | ||
| </plugins> | ||
| </build> |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
latest version maven-bundle-plugin 2024 2025
💡 Result:
Apache Felix maven-bundle-plugin latest release in 2024/2025 is 6.0.0 (released Nov 28, 2024). [1] It was published to Maven Central on Nov 25, 2024. [2][3] The Apache Felix downloads page still lists 6.0.0 as the current version (i.e., no newer 2025 release listed). [4]
Maven coordinates: org.apache.felix:maven-bundle-plugin:6.0.0 [4]
Update maven-bundle-plugin to the latest version.
The maven-bundle-plugin version 5.1.8 is outdated. Version 6.0.0 was released in November 2024 and is the current stable release. Update to 5.1.8 → 6.0.0 to receive the latest bug fixes, security updates, and improvements.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@graal-sdk/25.0.5.wso2v1/pom.xml` around lines 68 - 93, The pom.xml uses an
outdated maven-bundle-plugin version (5.1.8); update the plugin declaration for
org.apache.felix:maven-bundle-plugin in the build->plugins block to use version
6.0.0 by changing the <version> element for the maven-bundle-plugin entry so the
plugin declaration (groupId org.apache.felix, artifactId maven-bundle-plugin)
uses 6.0.0 instead of 5.1.8.
| <repositories> | ||
| <repository> | ||
| <id>wso2-nexus</id> | ||
| <name>WSO2 internal Repository</name> | ||
| <url> | ||
| http://maven.wso2.org/nexus/content/groups/wso2-public/ | ||
| </url> | ||
| <releases> | ||
| <enabled>true</enabled> | ||
| <updatePolicy>daily</updatePolicy> | ||
| <checksumPolicy>ignore</checksumPolicy> | ||
| </releases> | ||
| </repository> |
There was a problem hiding this comment.
Use HTTPS for repository URL and avoid ignoring checksums.
Two security concerns:
-
Line 100 uses HTTP (
http://maven.wso2.org/...) whiledistributionManagementcorrectly uses HTTPS. HTTP repositories are vulnerable to man-in-the-middle attacks. -
Line 105 sets
checksumPolicytoignore, which bypasses integrity verification of downloaded artifacts.
🔒 Proposed fix
<repository>
<id>wso2-nexus</id>
<name>WSO2 internal Repository</name>
<url>
- http://maven.wso2.org/nexus/content/groups/wso2-public/
+ https://maven.wso2.org/nexus/content/groups/wso2-public/
</url>
<releases>
<enabled>true</enabled>
<updatePolicy>daily</updatePolicy>
- <checksumPolicy>ignore</checksumPolicy>
+ <checksumPolicy>fail</checksumPolicy>
</releases>
</repository>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| <repositories> | |
| <repository> | |
| <id>wso2-nexus</id> | |
| <name>WSO2 internal Repository</name> | |
| <url> | |
| http://maven.wso2.org/nexus/content/groups/wso2-public/ | |
| </url> | |
| <releases> | |
| <enabled>true</enabled> | |
| <updatePolicy>daily</updatePolicy> | |
| <checksumPolicy>ignore</checksumPolicy> | |
| </releases> | |
| </repository> | |
| <repositories> | |
| <repository> | |
| <id>wso2-nexus</id> | |
| <name>WSO2 internal Repository</name> | |
| <url> | |
| https://maven.wso2.org/nexus/content/groups/wso2-public/ | |
| </url> | |
| <releases> | |
| <enabled>true</enabled> | |
| <updatePolicy>daily</updatePolicy> | |
| <checksumPolicy>fail</checksumPolicy> | |
| </releases> | |
| </repository> |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@graal-sdk/25.0.5.wso2v1/pom.xml` around lines 95 - 107, Update the repository
declaration for the "wso2-nexus" repository: change the <url> value from
http://maven.wso2.org/... to the HTTPS equivalent (https://maven.wso2.org/...)
and remove or change the <checksumPolicy> from "ignore" to a stricter policy
such as "fail" (or remove the tag to use the default) so artifact integrity is
enforced; modify the <repository> block containing <id>wso2-nexus</id>, <url>
and <checksumPolicy> accordingly.
| <snapshotRepository> | ||
| <id>wso2.snapshots</id> | ||
| <name>Apache Snapshot Repository</name> | ||
| <url>https://maven.wso2.org/nexus/content/repositories/snapshots/</url> | ||
| </snapshotRepository> |
There was a problem hiding this comment.
Incorrect repository name.
The snapshotRepository name says "Apache Snapshot Repository" but it points to a WSO2 repository URL.
📝 Proposed fix
<snapshotRepository>
<id>wso2.snapshots</id>
- <name>Apache Snapshot Repository</name>
+ <name>WSO2 Snapshot Repository</name>
<url>https://maven.wso2.org/nexus/content/repositories/snapshots/</url>
</snapshotRepository>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| <snapshotRepository> | |
| <id>wso2.snapshots</id> | |
| <name>Apache Snapshot Repository</name> | |
| <url>https://maven.wso2.org/nexus/content/repositories/snapshots/</url> | |
| </snapshotRepository> | |
| <snapshotRepository> | |
| <id>wso2.snapshots</id> | |
| <name>WSO2 Snapshot Repository</name> | |
| <url>https://maven.wso2.org/nexus/content/repositories/snapshots/</url> | |
| </snapshotRepository> |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@graal-sdk/25.0.5.wso2v1/pom.xml` around lines 117 - 121, The
<snapshotRepository> entry contains a mismatched <name> ("Apache Snapshot
Repository") for the WSO2 URL; update the <name> value inside the
snapshotRepository block (the <name> element associated with snapshotRepository)
to accurately reflect the WSO2 repository (e.g., "WSO2 Snapshot Repository" or
similar) so the repository name matches the <url> and <id>.
madurangasiriwardena
changed the title
There was a problem hiding this comment.
🧹 Nitpick comments (1)
graal-sdk/25.0.2.wso2v1/pom.xml (1)
85-88: Overly permissive import configuration may mask dependency issues.Setting
Import-Packageto*;resolution:=optionalcombined withDynamicImport-Package:*makes all imports optional and dynamic. This can hide missing dependencies at build time, causingClassNotFoundExceptionorNoClassDefFoundErrorat runtime.Consider explicitly listing required packages without optional resolution, and only marking truly optional packages as such.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@graal-sdk/25.0.2.wso2v1/pom.xml` around lines 85 - 88, The OSGi bundle manifest in the pom uses overly permissive Import-Package and DynamicImport-Package entries; replace the blanket Import-Package="*;resolution:=optional" and DynamicImport-Package="*" by enumerating the actual package names your module needs in the Import-Package element (omit ;resolution:=optional for required packages) and only add ;resolution:=optional for truly optional packages, removing or narrowing DynamicImport-Package to specific packages if dynamic loading is required; inspect code references to determine required packages and list them explicitly in the Import-Package element instead of using wildcards.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@graal-sdk/25.0.2.wso2v1/pom.xml`:
- Around line 85-88: The OSGi bundle manifest in the pom uses overly permissive
Import-Package and DynamicImport-Package entries; replace the blanket
Import-Package="*;resolution:=optional" and DynamicImport-Package="*" by
enumerating the actual package names your module needs in the Import-Package
element (omit ;resolution:=optional for required packages) and only add
;resolution:=optional for truly optional packages, removing or narrowing
DynamicImport-Package to specific packages if dynamic loading is required;
inspect code references to determine required packages and list them explicitly
in the Import-Package element instead of using wildcards.
There was a problem hiding this comment.
♻️ Duplicate comments (3)
graal-sdk/25.0.2.wso2v1/pom.xml (3)
124-124:⚠️ Potential issue | 🟡 MinorRepository name is misleading for the configured snapshot URL.
Line 124 says
Apache Snapshot Repositorywhile the ID/URL clearly point to WSO2 snapshots.Suggested fix
- <name>Apache Snapshot Repository</name> + <name>WSO2 Snapshot Repository</name>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@graal-sdk/25.0.2.wso2v1/pom.xml` at line 124, The repository <name> element is misleading: change the <name>Apache Snapshot Repository</name> entry in the POM to match the configured repository ID/URL for WSO2 (e.g., "WSO2 Snapshot Repository" or another name reflecting the WSO2 snapshot URL) so the <name> value aligns with the repository ID/URL used in the pom.xml.
78-78:⚠️ Potential issue | 🟠 MajorVerify and bump
maven-bundle-pluginfrom5.1.8.Line 78 is pinned to an older plugin release; please verify the latest stable release on Maven Central and upgrade accordingly.
#!/bin/bash set -euo pipefail curl -fsSL "https://repo1.maven.org/maven2/org/apache/felix/maven-bundle-plugin/maven-metadata.xml" \ | sed -n '1,220p' \ | rg -n "<latest>|<release>|<version>"Suggested change (after verification)
- <version>5.1.8</version> + <version>6.0.0</version>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@graal-sdk/25.0.2.wso2v1/pom.xml` at line 78, The pom.xml pins the maven-bundle-plugin to version 5.1.8; verify the latest stable release on Maven Central and update the <version> element for org.apache.felix:maven-bundle-plugin from 5.1.8 to that verified latest version. Use the Maven metadata (org.apache.felix:maven-bundle-plugin:maven-metadata.xml) or Maven Central search to confirm the correct release, then replace the existing <version> value in the pom.xml so the plugin declaration (maven-bundle-plugin) references the newer verified version.
104-110:⚠️ Potential issue | 🟠 MajorUse HTTPS and enforce checksum validation for repository downloads.
Line 105 uses HTTP and Line 110 sets checksum policy to
ignore, which weakens artifact integrity guarantees.Suggested fix
<url> - http://maven.wso2.org/nexus/content/groups/wso2-public/ + https://maven.wso2.org/nexus/content/groups/wso2-public/ </url> @@ - <checksumPolicy>ignore</checksumPolicy> + <checksumPolicy>fail</checksumPolicy>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@graal-sdk/25.0.2.wso2v1/pom.xml` around lines 104 - 110, Update the repository declaration to use HTTPS and enforce checksum validation: change the <url> value from "http://maven.wso2.org/nexus/content/groups/wso2-public/" to use "https://", and replace the <checksumPolicy> value "ignore" with a stricter policy such as "fail" (inside the same repository element that contains the <url> and <releases> blocks) so downloads use HTTPS and invalid checksums will fail.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@graal-sdk/25.0.2.wso2v1/pom.xml`:
- Line 124: The repository <name> element is misleading: change the <name>Apache
Snapshot Repository</name> entry in the POM to match the configured repository
ID/URL for WSO2 (e.g., "WSO2 Snapshot Repository" or another name reflecting the
WSO2 snapshot URL) so the <name> value aligns with the repository ID/URL used in
the pom.xml.
- Line 78: The pom.xml pins the maven-bundle-plugin to version 5.1.8; verify the
latest stable release on Maven Central and update the <version> element for
org.apache.felix:maven-bundle-plugin from 5.1.8 to that verified latest version.
Use the Maven metadata (org.apache.felix:maven-bundle-plugin:maven-metadata.xml)
or Maven Central search to confirm the correct release, then replace the
existing <version> value in the pom.xml so the plugin declaration
(maven-bundle-plugin) references the newer verified version.
- Around line 104-110: Update the repository declaration to use HTTPS and
enforce checksum validation: change the <url> value from
"http://maven.wso2.org/nexus/content/groups/wso2-public/" to use "https://", and
replace the <checksumPolicy> value "ignore" with a stricter policy such as
"fail" (inside the same repository element that contains the <url> and
<releases> blocks) so downloads use HTTPS and invalid checksums will fail.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@graal-sdk/25.0.2.wso2v1/pom.xml`:
- Around line 105-108: The Import-Package manifest header in the POM is
malformed because entries are not comma-separated; update the Import-Package
value so the two entries are separated by a comma (i.e., between
"!org.graalvm.*" and "*;resolution:=optional") to produce a valid OSGi header;
edit the Import-Package element where "!org.graalvm.*" and
"*;resolution:=optional" appear to insert the missing comma.
| <Import-Package> | ||
| !org.graalvm.* | ||
| *;resolution:=optional | ||
| </Import-Package> |
There was a problem hiding this comment.
Missing comma separator in Import-Package header - will cause bundle resolution issues.
The OSGi Import-Package header requires comma-separated entries. The current configuration is missing a comma between !org.graalvm.* and *;resolution:=optional, which will cause the bundle manifest to be malformed.
🐛 Proposed fix
<Import-Package>
- !org.graalvm.*
+ !org.graalvm.*,
*;resolution:=optional
</Import-Package>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| <Import-Package> | |
| !org.graalvm.* | |
| *;resolution:=optional | |
| </Import-Package> | |
| <Import-Package> | |
| !org.graalvm.*, | |
| *;resolution:=optional | |
| </Import-Package> |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@graal-sdk/25.0.2.wso2v1/pom.xml` around lines 105 - 108, The Import-Package
manifest header in the POM is malformed because entries are not comma-separated;
update the Import-Package value so the two entries are separated by a comma
(i.e., between "!org.graalvm.*" and "*;resolution:=optional") to produce a valid
OSGi header; edit the Import-Package element where "!org.graalvm.*" and
"*;resolution:=optional" appear to insert the missing comma.
2 participants
Summary by CodeRabbit