4

Clearly the com.sun.xml.bind:jaxb-impl artifact is labelled "Old JAXB Runtime module" in the maven repository (see link below), and yet both of these artifacts are still getting new releases:

https://mvnrepository.com/artifact/org.glassfish.jaxb/jaxb-runtime https://mvnrepository.com/artifact/com.sun.xml.bind/jaxb-impl

This answer Which artifacts should I use for JAXB RI in my Maven project? does not clarify the difference.

The accepted answer to both the above question and this one How to resolve java.lang.NoClassDefFoundError: javax/xml/bind/JAXBException conclude that for Java 9+ you should use: org.glassfish.jaxb:jaxb-runtime

But I have code using com.sun.xml.bind:jaxb-impl and it appears to be working fine. So what do I lose or gain by moving to jaxb-runtime?

Even the latest (3.0.2 at the time I write this) version is available for the "OLD" jaxb-impl module. If Oracle isn't doing this anymore, who makes the com.sun.xml.bind:jaxb-impl artifact? What is it for? Why doesn't it share the Maven group coordinates with jaxb-runtime?

Is there any central location that clearly documents what the current state of affairs is with JAXB?

There is just so much confusion with JAXB now.

P.S. I need to remain compatible with Java 8 for the time being - so I can't go to 3.x yet, and 2.4.x appears to be an abandoned attempt at fixing the modularity that they foolishly broke when it was split out of the JDK.

swpalmer
  • 3,230
  • 1
  • 20
  • 28
  • 2
    I think confusion like this is a big contributor to why so many developers are still using Java 8. Upgrading to a new JDK was mostly trivial up to Java 8. If you start with 11 or later you are fine, but 11 represents a significant barrier when migrating from earlier versions. – swpalmer Feb 12 '22 at 21:13

1 Answers1

4

I've been trying to make sense of this for the last day, and it's incredibly confusing. Particularly when you're trying to avoid the java.xml.bind to jakarta.xml.bind migration. There's out of date information everywhere and some broken releases in the jaxb-impl 2.3.x release line.

Best I can tell, GlassFish was providing the JAXB reference implementation. It's since moved to EE4J, but releases continue from that project against both sets of coordinates. Appears that com.sun.xml.bind:jaxb-ri is where the latest full bundles are released:

https://github.com/eclipse-ee4j/jaxb-ri/

The only difference between jaxb-impl and jaxb-runtime at version 2.3.6 is packaging: jaxb-impl bundles istack/txw2 inside the jar, whereas jaxb-runtime provides them via separate dependencies.

Having figured out that piece of history, the real mess is that none of the artifacts reflect the javax.xml.bind to jakarta.xml.bind move in their artifact coordinates, only in the versions. This means if you're in ecosystem where you need both to exist, you're going to have a bad time.

For instance, the 2.3.3 release changed from depending on javax.xml.bind:jaxb-api to jakarta.xml.bind:jakarta.xml.bind-api because at 2.x, the jakarta artifacts provide the javax.xml.bind packages. At version 3.0.0 it provides jakarta.xml.bind.

The implementations are the same at 3.0.0 which means while the earlier versions could happily exist at runtime (the module system aside I guess) you have no way of resolving them both in build tools.

So that leaves a mixed coordinate/package mess to deal with. The best I've come up with is:

  • For javax.xml.bind use com.sun.xml.bind:jaxb-impl:2.3.6. Ignore the 3.0.0 and later releases. Add an explicit dependency on javax.xml.bind:jaxb-api:2.3.1 in the event something needs to upgrade jakarta.xml.bind-api beyond 3.0.0 (i.e. you have both javax.xml.bind and jakarta.xml.bind package dependencies)
  • For jakarta.xml.bind use the latest org.glassfish.jaxb:jaxb-runtime. Ignore the releases earlier than 3.0.0
Danny Thomas
  • 1,545
  • 1
  • 13
  • 30
  • 1
    There is no question that the process of handing over JAXB was a complete disaster. It's till next to impossible to find the latest implementation jar - only the API jar is linked from any pages I could find. They've changed the implementation project and they have no useful links to anything. – swpalmer May 08 '22 at 18:30
  • Agreed, I haven't come across a bigger mess than this in the Java world off late. – Swapnil May 27 '22 at 18:07