JabLib broken

[koppor]

As far as I can see, dependencies of our JabLib on maven central (https://central.sonatype.com/service/rest/repository/browse/maven-snapshots/org/jabref/jablib/) does not have the right dependencies declared.

https://github.com/JabRef/jabref/blob/main/.jbang/JabSrvLauncher.java does NOT have jspecify declared as depdency, but the build says:

Error:  [ERROR] Could not resolve dependencies: The following artifacts could not be resolved: org.jspecify:jspecify:jar:${jspecify.version} (absent): 
Could not find artifact org.jspecify:jspecify:jar:${jspecify.version} in mavencentral (https://repo1.maven.org/maven2/)

https://github.com/JabRef/jabref/actions/runs/15724763741/job/44312348122?pr=13309

[jjohannes]

I have no experience wit JBang. The Gradle side looks correct. The dependency on JSpecify is defined here:
https://github.com/JabRef/jabref/blob/main/jablib/build.gradle.kts#L145

(Maybe it can be removed and that magically fixes the problem (?) but it was there before #13319.)

The published POM metadata - if that is used by JBang (?) - looks like this:

<dependency>
  <groupId>org.jspecify</groupId>
  <artifactId>jspecify</artifactId>
  <version>1.0.0</version>
  <scope>runtime</scope>
</dependency>

https://central.sonatype.com/repository/maven-snapshots/org/jabref/jablib/6.0.30303-SNAPSHOT/jablib-6.0.30303-20250616.174644-1.pom

It's also near to impossible to publish something like variables into metadata with Gradle - even by mistake. That's a Maven thing...

---

The error looks like this is picked up from some other Metadata (published with Maven), where such variables are used and "filled" by values from a parent POM. I can't see how it is related to the Gradle changes. But then I don't know what JBang is doing.

[jjohannes]

Can you check if this may have broken it: #13353

Log4J uses jspecify now and I also know that there have been changes to the metadata recently.

[jjohannes]

Yes, Log4J looks suspicious here.

There is now an entry

• in https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j/2.25.0/log4j-2.25.0.pom
• that did not exist https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j/2.24.3/log4j-2.24.3.pom

<dependency>
<groupId>org.jspecify</groupId>
<artifactId>jspecify</artifactId>
<version>${jspecify.version}</version>
</dependency>

But there is no value for jspecify.version as the dependency is not intended to be published. And it effectively isn't.
This is in the <dependencyManagement> block, which means it is a version could be pick up, if someone would use that POM file as a "BOM" (which it is not intended to be used for I believe). So strictly, what they do should not cause problems (with Maven or Gradle) although it is a bit "unclean". That's why I suspect that JBang is also doing something unexpected.

[koppor]

@jjohannes I didn't expect that! Thank you so much for digging so fast into this!