能否覆盖Maven依赖包路径？rngom迁移致构建失败求解决

问题背景 #

• Maven项目使用jaxb2-maven-plugin，该插件依赖com.sun.xml.bind.external:rngom
• rngom 2.2.11存在安全漏洞无法继续使用，但升级至2.2.11以上版本后，原org.kohsuke.rngom包下的类全部迁移到com.sun.tools.rngom，导致构建时抛出ClassNotFoundException，无法找到旧路径下的类。

报错信息 #

Exception in thread "main" java.lang.Error:
  java.lang.reflect.InvocationTargetException at
  com.sun.tools.xjc.reader.Ring.get(Ring.java:113) at
  com.sun.tools.xjc.reader.xmlschema.BGMBuilder.(BGMBuilder.java:147) at
  com.sun.tools.xjc.reader.xmlschema.BGMBuilder.build(BGMBuilder.java:117)
  at
  com.sun.tools.xjc.ModelLoader.annotateXMLSchema(ModelLoader.java:407)
  at com.sun.tools.xjc.ModelLoader.load(ModelLoader.java:162) at
  com.sun.tools.xjc.ModelLoader.load(ModelLoader.java:117) at
  com.sun.tools.xjc.Driver.run(Driver.java:354) at
  org.codehaus.mojo.jaxb2.javageneration.AbstractJavaGeneratorMojo.performExecution(AbstractJavaGeneratorMojo.java:468)
  at
  org.codehaus.mojo.jaxb2.AbstractJaxbMojo.execute(AbstractJaxbMojo.java:315)
  at
  org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:137)
  at
  org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:210)
  at
  org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:156)
  at
  org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:148)
  at
  org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:117)
  at
  org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:81)
  at
  org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build(SingleThreadedBuilder.java:56)
  at
  org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:128)
  at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:305) at
  org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:192) at
  org.apache.maven.DefaultMaven.execute(DefaultMaven.java:105) at
  org.apache.maven.cli.MavenCli.execute(MavenCli.java:972) at
  org.apache.maven.cli.MavenCli.doMain(MavenCli.java:293) at
  org.apache.maven.cli.MavenCli.main(MavenCli.java:196) at
  sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at
  sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  at
  sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:498) at
  org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:282)
  at
  org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:225)
  at
  org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:406)
  at
  org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:347)
  Caused by: java.lang.reflect.InvocationTargetException at
  sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
  at
  sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
  at
  sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
  at java.lang.reflect.Constructor.newInstance(Constructor.java:423) at
  com.sun.tools.xjc.reader.Ring.get(Ring.java:102) ... 30 more Caused
  by: java.lang.Error: java.lang.reflect.InvocationTargetException at
  com.sun.tools.xjc.reader.Ring.get(Ring.java:113) at
  com.sun.tools.xjc.reader.xmlschema.BindGreen.(BindGreen.java:65) ...
  35 more Caused by: java.lang.reflect.InvocationTargetException at
  sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
  at
  sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
  at
  sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
  at java.lang.reflect.Constructor.newInstance(Constructor.java:423) at
  com.sun.tools.xjc.reader.Ring.get(Ring.java:102) ... 36 more Caused
  by: java.lang.NoClassDefFoundError: org/kohsuke/rngom/nc/NameClass at
  com.sun.tools.xjc.reader.xmlschema.ct.ComplexTypeFieldBuilder.(ComplexTypeFieldBuilder.java:66)
  ... 41 more Caused by: java.lang.ClassNotFoundException:
  org/kohsuke/rngom/nc/NameClass at
  org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy.loadClass(SelfFirstStrategy.java:50)
  at
  org.codehaus.plexus.classworlds.realm.ClassRealm.unsynchronizedLoadClass(ClassRealm.java:271)
  at
  org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass(ClassRealm.java:247)
  at
  org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass(ClassRealm.java:239)
  ... 42 more

解决方案 #

方案1：升级jaxb2-maven-plugin到兼容版本 #

jaxb2-maven-plugin 3.0.0及以上版本已经适配了rngom包路径的变更，直接升级插件即可，无需手动调整rngom依赖：

<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>jaxb2-maven-plugin</artifactId>
    <version>3.1.0</version> <!-- 选择最新稳定版 -->
    <executions>
        <execution>
            <goals>
                <goal>xjc</goal>
            </goals>
        </execution>
    </executions>
</plugin>

方案2：无法升级插件时，引入兼容桥接包 #

如果因项目限制无法升级插件，可以通过排除旧依赖、引入高版本rngom和原路径兼容包解决：

<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>jaxb2-maven-plugin</artifactId>
    <version>你的当前插件版本</version>
    <dependencies>
        <!-- 排除插件自带的旧版本rngom -->
        <dependency>
            <groupId>com.sun.xml.bind.external</groupId>
            <artifactId>rngom</artifactId>
            <version>2.2.11</version>
            <scope>provided</scope>
            <exclusions>
                <exclusion>
                    <groupId>*</groupId>
                    <artifactId>*</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <!-- 添加无安全漏洞的高版本rngom -->
        <dependency>
            <groupId>com.sun.xml.bind.external</groupId>
            <artifactId>rngom</artifactId>
            <version>2.3.7</version> <!-- 替换为最新无漏洞版本 -->
        </dependency>
        <!-- 添加原org.kohsuke.rngom路径的兼容桥接包 -->
        <dependency>
            <groupId>org.kohsuke.rngom</groupId>
            <artifactId>rngom</artifactId>
            <version>2.3.0</version>
        </dependency>
    </dependencies>
</plugin>

方案3：清理依赖树，排除旧版本rngom #

执行Maven命令查看依赖传递情况：

mvn dependency:tree

找到所有引入旧版本rngom的依赖，在对应依赖中添加排除规则，确保只有高版本rngom和兼容桥接包存在于项目依赖中。

内容的提问来源于stack exchange，提问作者Ernestas Cernys