THRIFT-5671: return dependencies to POM

[artemy-osipov]

The libthrift-0.17.0.pom file downloaded from Maven Central does not have any <dependencies> section.

That happened due to the explicit listing of the artifacts in the publishing block

publishing {
    publications {
        mavenJava(MavenPublication) {
            artifactId = "libthrift"
            // explicitly set 3 jars because calling "from components.java" will include shadow jar which isn't what we want
            artifact jar
            artifact sourcesJar
            artifact javadocJar

Newer versions of com.github.johnrengelman.shadow include shadow jar in publishing so I used workaround from GradleUp/shadow#651 to skip it

extra info https://docs.gradle.org/current/userguide/publishing_customization.html

new POM

<?xml version="1.0" encoding="UTF-8"?>
<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <!-- This module was also published with a richer model, Gradle metadata,  -->
  <!-- which should be used instead. Do not delete the following line which  -->
  <!-- is to indicate to Gradle or any Gradle module metadata file consumer  -->
  <!-- that they should prefer consuming it instead. -->
  <!-- do_not_remove: published-with-gradle-metadata -->
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.apache.thrift</groupId>
  <artifactId>libthrift</artifactId>
  <version>0.19.0-SNAPSHOT</version>
  <name>Apache Thrift</name>
  <description>Thrift is a software framework for scalable cross-language services development.</description>
  <url>http://thrift.apache.org</url>
  <licenses>
    <license>
      <name>The Apache Software License, Version 2.0</name>
      <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
      <distribution>repo</distribution>
    </license>
  </licenses>
  <developers>
    <developer>
      <id>dev</id>
      <name>Apache Thrift Developers</name>
      <email>dev@thrift.apache.org</email>
    </developer>
  </developers>
  <scm>
    <connection>scm:git:https://github.com/apache/thrift.git</connection>
    <developerConnection>scm:git:git@github.com:apache/thrift.git</developerConnection>
    <url>https://github.com/apache/thrift</url>
  </scm>
  <dependencies>
    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>slf4j-api</artifactId>
      <version>1.7.36</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.apache.httpcomponents</groupId>
      <artifactId>httpclient</artifactId>
      <version>4.5.13</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.apache.httpcomponents</groupId>
      <artifactId>httpcore</artifactId>
      <version>4.4.15</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>javax.servlet-api</artifactId>
      <version>4.0.1</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>javax.annotation</groupId>
      <artifactId>javax.annotation-api</artifactId>
      <version>1.3.2</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.apache.commons</groupId>
      <artifactId>commons-lang3</artifactId>
      <version>3.12.0</version>
      <scope>runtime</scope>
    </dependency>
  </dependencies>
</project>

• Did you create an Apache Jira ticket? (Request account here, not required for trivial changes)
• If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"?
• Did you squash your changes to a single commit? (not required, but preferred)
• Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"?
• If your change does not involve any code, include [skip ci] anywhere in the commit message to free up build resources.

[jimexist]

• should this be merged after THRIFT-5699: java lib and build tool chain: gradle 8.0.2 #2779 ?

[artemy-osipov]

I don't think these PRs are related. This PR can be merged before or after #2779
I've check it and the same problem is reproduced in #2779 for plugin com.github.johnrengelman.shadow:8.1.1 and the same solution fixes this

[jimexist]

• let's aim to merge this after THRIFT-5699: java lib and build tool chain: gradle 8.0.2 #2779

[artemy-osipov]

I've rebased