Hibernate has xml-apis dependency which can break apps using modern JDK

[dsyer]

Hibernate includes xml-apis.jar in its transitive dependencies. Presumably so it can run on Java 5 or something?

If you shade the petclinic and run the jar it works, but if you explode the jar (like it would be on Cloudfoundry) it blows up because xml-apis.jar has a version of javax.xml.parsers.SAXParserFactory that is different from the one in JDK8. And randomly it has jumped onto the classpath ahead of it (apparently). It’s very weird because exploded vs shaded shouldn’t make any difference to which ClassLoader can see the bogus SAXParserFActory.

Anyway Hibernate is fubar, so can we exclude that xml-apis jar in our starter? Who would that break?

[philwebb]

We'll try the exclude option in 1.5 and see if anything breaks.

[snicoll]

I haven't removed dependency management for this as HtmlUnit still uses it (via xerces). Maybe we should also exclude it at a latter stage as well.