commons-io dependency not included in ivy.xml

[sebastic]

The josm Debian package failed to build for bookworm with libcommons-io-java 2.11.0 unlike in unstable with 2.16.1.

The sources are not included in the JAR because the dependency is not included in ivy.xml despite being required for OsmPbfReader.java, ValidatorCLI.java, and WMTSTileSourceTest.java.

This patch should fix that:

--- a/ivy.xml
+++ b/ivy.xml
@@ -27,6 +27,7 @@
         <dependency conf="api->default" org="jakarta.json" name="jakarta.json-api" rev="2.1.3"/>
         <!-- parsson is an implementation for jakarta.json -->
         <dependency conf="runtimeOnly->default" org="org.eclipse.parsson" name="parsson" rev="1.1.6"/>
+        <dependency conf="api->default" org="commons-io" name="commons-io" rev="2.16.1"/>
         <dependency conf="api->default" org="org.apache.commons" name="commons-jcs3-core" rev="3.2"/>
         <dependency conf="api->default" org="org.apache.commons" name="commons-compress" rev="1.26.1"/>
         <dependency conf="api->default" org="jakarta.annotation" name="jakarta.annotation-api" rev="2.1.1" />
@@ -45,6 +46,7 @@
         <dependency conf="sources->sources" org="org.glassfish" name="javax.json" rev="1.1.4"/>
         <dependency conf="sources->sources" org="jakarta.json" name="jakarta.json-api" rev="2.1.3"/>
         <dependency conf="sources->sources" org="org.eclipse.parsson" name="parsson" rev="1.1.6"/>
+        <dependency conf="sources->sources" org="commons-io" name="commons-io" rev="2.16.1"/>
         <dependency conf="sources->sources" org="org.apache.commons" name="commons-jcs3-core" rev="3.2"/>
         <dependency conf="sources->sources" org="org.apache.commons" name="commons-compress" rev="1.26.1"/>
         <dependency conf="sources->sources" org="jakarta.annotation" name="jakarta.annotation-api" rev="2.1.1" />

[taylor.smock]

I'm going to check and see why it is available as part of the current build. It is probably brought in as a transitive dependency or something. If so, the originating dependency might have a subclass I can use.

[sebastic]

commons-io 2.15.1 is a dependency of commons-compress 1.26.1 (​pom.xml), Debian unstable still has 1.25.0 which only requires it for the test scope (​pom.xml). It is now an optional dependency, see:

​https://github.com/apache/commons-compress/commit/856a540d3eeb463527c509853f4d205f4adc272f
​https://github.com/apache/commons-compress/commit/d0fd2bc59bfa90aee4bb5f46b22b860bbe9edfd2
​https://github.com/apache/commons-compress/commit/a642762a6d11c7ce020f1e50d9170d5018539585

[taylor.smock]

I noticed when I was looking into it. I'm more inclined to move away from using commons-io -- the primary reason why most of those classes are using commons-io is that commons-compress deprecated stuff in the last dependency update, and the recommended replacements were in commons-io. I'd rather not add an additional dependency to JOSM and the coding replacements for the used classes shouldn't be too difficult.

[taylor.smock]

In 19077/josm:

Fix #23666: commons-io dependency not included in ivy.xml

This removes all imports of org.apache.commons.io classes and replaces them with
similar functionality.