Bump build requirement to JDK 17

[ppkarwasz]

This change:

• Bumps the build requirement for the project to JDK 17.
• Adds a java8-tests profile that runs tests using JRE 8. The profile activates if a Maven Toolchains configuration file is present, i.e., the user knows about Maven Toolchains. Toolchains are automatically configured by actions/setup-java.
• Bumps the version of Error Prone to a version compatible with JDK 17 (i.e., latest).
• Bumps the version of Maven Surefire to a version that supports the jdkToolchain property.
• Locks the version of the remaining plugins to the currently used versions.

[jeremylong]

Thanks! However, for the the CI to work we also need to update

packageurl-java/.github/workflows/maven.yml

Lines 10 to 11 in dd8309b

	java-version: [ 8 ]
	distro: [ 'zulu', 'temurin' ]

[jeremylong]

Any chance you could add a .java-version as well?

[ppkarwasz]

Thanks! However, for the the CI to work we also need to update

Fixed in 5dd8b8f . Since tests run using JRE 8, two JDKs must be installed (or JRE 8 and JDK 17 if your prefer).

Any chance you could add a .java-version as well?

Fixed in 91d8d04

[dwalluck]

Just a note that the spotbugs plugin would have to be bumped to 4.9.0 to support JDK 23.

[ppkarwasz]

Just a note that the spotbugs plugin would have to be bumped to 4.9.0 to support JDK 23.

I would bump all Maven plugins. Previously many plugin versions were not specified, so their versions were determined by the Maven Lifecycle Bindings and were different for each version of Maven.

In this PR I fixed all the unspecified plugin versions to those of the Maven 3.8.7 Lifecycle Bindings (Debian 12 ships with Maven 3.8.7), but these are really old versions.

[dwalluck]

I created #180 to try to prevent this, but I am not sure if your editor supports it https://editorconfig.org/#pre-installed.

A missing newline in a text file actually violates the POSIX standard as far as I know.

[ppkarwasz]

I created #180 to try to prevent this, but I am not sure if your editor supports it https://editorconfig.org/#pre-installed.

Sure, I'll enable the EditorConfig plugin. For Java code, however, I would enforce a more precise formatting (see #183 ).

A missing newline in a text file actually violates the POSIX standard as far as I know.

Yes it does.

[jeremylong]

I do not understand this profile. If the build requires Java 17, how could this be activated and work? What am I missing?

[ppkarwasz]

The purpose of this profile is to run tests using JRE 8 in forked JVMs.
Since this can be only done through Maven Toolchains, which might be hard to configure for single-time contributors, the profile only activates if a toolchains configuration is present.

Note that the CI always has a toolchains configuration.

[jeremylong]

Got it - I've never set the Maven Toolchain up. Thanks for the explanation.

[dwalluck]

I hadn't really used it either, but since GitHub automatically sets up the file, it's pretty painless.

I think this pull request makes it so that it's not required (presumably, the CI will test Java 8 if the developer does not), but if you're interested, it has a mojo to automatically try to generate the config file mvn toolchains:generate-jdk-toolchains-xml.

[ppkarwasz]

Cool! 💯
It discovered all 8 JDKs installed on my system.