Issue #1834 - Publish Non-Shaded JAR For karate-core

[packleader]

Description

• Relevant Issues : Issue #1834 - Fix for High Severity CVE's in karate-core #1869
• Relevant PRs : (optional)
• Type of change :
  • New feature
  • Bug fix for existing feature
  • Code quality improvement
  • Addition or Improvement of tests
  • Addition or Improvement of documentation

Publishing a non-shaded JAR will enable clients to upgrade and/or exclude dependencies based on their specific use cases. For example, if the version of Netty used by Karate is discovered to have a severe security flaw, our users can specify a newer version of Netty in their pom to override the dependency inherited from Karate. This is currently not possible with the shaded JAR.

Both JARs will be published to Maven Central under com/intuit/karate/karate-core/1.2.0, and the filenames will be karate-core-1.2.0.jar and karate-core-1.2.0-all.jar.

Clients will reference the non-shaded JAR using

<dependency>
    <groupId>com.intuit.karate</groupId>
    <artifactId>karate-core</artifactId>
    <version>1.2.0</version>
</dependency>

And they can reference the shaded JAR with

<dependency>
    <groupId>com.intuit.karate</groupId>
    <artifactId>karate-core</artifactId>
    <version>1.2.0</version>
    <classifier>all</classifier>
</dependency>

[packleader]

Let me know if y'all want to use a different name for the shaded JAR...

[packleader]

@ptrthomas Any thoughts on this one?

[ptrthomas]

@packleader 1.2.0.RC5 has been released. please let me know at the earliest if it works. it would be great if you can validate the release notes here: https://github.com/karatelabs/karate/wiki/1.2.0-Upgrade-Guide

[packleader]

@ptrthomas I've tested out 1.2.0.RC25, and it looks great! The upgrade guide looks good, too. I've been able to validate that all the issues I've submitted have been resolved. I'm looking forward to the final release of 1.2.0.