Context
Issue #610 reports a Dependency-Check finding for com.github.bbottema:jetbrains-runtime-annotations:1.0.2 being mapped to JetBrains Runtime / CVE-2025-29903. The artifact used here is not JetBrains Runtime; it is a republished copy of JetBrains @NotNull / @Nullable with RUNTIME retention so the CLI generator can inspect @Nullable through reflection.
That design made the CLI clever but brittle: Java/API nullability and CLI argument optionality are currently coupled through the same annotation.
Goal
Separate those meanings explicitly:
- Keep official
org.jetbrains:annotations for API nullability and standard IDE/static-analysis tooling.
- Remove
com.github.bbottema:jetbrains-runtime-annotations from Simple Java Mail.
- Add explicit runtime-retained CLI metadata, probably
@Cli.Optional or @Cli.OptionalParameter, for builder parameters that are optional in the CLI.
- Update CLI generation and command-line consumption to inspect that CLI annotation instead of
org.jetbrains.annotations.Nullable.
- Preserve Java 8 compatibility.
- Document the builder/Javadoc/reflection/serialized-metadata CLI mechanism in
PROJECT_MECHANISMS_CATALOGUE.md, including why the organization is brittle and how future API changes should keep CLI parity.
Notes
This should address the practical scanner/tooling concern from #610 without renaming the runtime fork or continuing to depend on the fork in Simple Java Mail.
Context
Issue #610 reports a Dependency-Check finding for
com.github.bbottema:jetbrains-runtime-annotations:1.0.2being mapped to JetBrains Runtime / CVE-2025-29903. The artifact used here is not JetBrains Runtime; it is a republished copy of JetBrains@NotNull/@NullablewithRUNTIMEretention so the CLI generator can inspect@Nullablethrough reflection.That design made the CLI clever but brittle: Java/API nullability and CLI argument optionality are currently coupled through the same annotation.
Goal
Separate those meanings explicitly:
org.jetbrains:annotationsfor API nullability and standard IDE/static-analysis tooling.com.github.bbottema:jetbrains-runtime-annotationsfrom Simple Java Mail.@Cli.Optionalor@Cli.OptionalParameter, for builder parameters that are optional in the CLI.org.jetbrains.annotations.Nullable.PROJECT_MECHANISMS_CATALOGUE.md, including why the organization is brittle and how future API changes should keep CLI parity.Notes
This should address the practical scanner/tooling concern from #610 without renaming the runtime fork or continuing to depend on the fork in Simple Java Mail.