Skip to content

Decouple CLI optionality from runtime JetBrains annotation fork #616

Description

@bbottema

Context

Issue #610 reports a Dependency-Check finding for com.github.bbottema:jetbrains-runtime-annotations:1.0.2 being mapped to JetBrains Runtime / CVE-2025-29903. The artifact used here is not JetBrains Runtime; it is a republished copy of JetBrains @NotNull / @Nullable with RUNTIME retention so the CLI generator can inspect @Nullable through reflection.

That design made the CLI clever but brittle: Java/API nullability and CLI argument optionality are currently coupled through the same annotation.

Goal

Separate those meanings explicitly:

  • Keep official org.jetbrains:annotations for API nullability and standard IDE/static-analysis tooling.
  • Remove com.github.bbottema:jetbrains-runtime-annotations from Simple Java Mail.
  • Add explicit runtime-retained CLI metadata, probably @Cli.Optional or @Cli.OptionalParameter, for builder parameters that are optional in the CLI.
  • Update CLI generation and command-line consumption to inspect that CLI annotation instead of org.jetbrains.annotations.Nullable.
  • Preserve Java 8 compatibility.
  • Document the builder/Javadoc/reflection/serialized-metadata CLI mechanism in PROJECT_MECHANISMS_CATALOGUE.md, including why the organization is brittle and how future API changes should keep CLI parity.

Notes

This should address the practical scanner/tooling concern from #610 without renaming the runtime fork or continuing to depend on the fork in Simple Java Mail.

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions