Bump org.apache.rat:apache-rat-plugin from 0.16.1 to 0.18

[dependabot]

Bumps org.apache.rat:apache-rat-plugin from 0.16.1 to 0.18.

[slawekjaranowski]

To check .... 0.18 requires JDK 17+

https://issues.apache.org/jira/browse/RAT-478
https://creadur.apache.org/rat/changes.html#a0.18

[ottlinger]

@slawekjaranowski if I'm not too mistaken you may run with older JDKs, but any animal-sniffer-runs will fail as we rely on dependencies requiring >=JDK17.

As a compromise Creadur 0.17 could be used within the ASF parent.

[slawekjaranowski]

Last time we revert updates to 0.17

• #561

[slawekjaranowski]

I would like to update to 0.18, in ASF parent we don't have any execution neither configuration, we only manage a version.

Child projects should manage executing in proper JDK, eg by profiles if needed.

[slachiewicz]

Agree, better to use latest version

[slachiewicz]

[INFO] --- apache-rat:0.18:check (rat-check) @ mvnd-build-maven-plugin ---
[WARNING] Use of deprecated option 'exclude'. Deprecated for removal since 0.17: Use <inputExclude> instead.

[WARNING]  * org.apache.rat:apache-rat-plugin:0.18
[WARNING]   Declared at location(s):
[WARNING]    * org.apache.maven:maven-parent:49 (/Users/xxx/.m2/repository/org/apache/maven/maven-parent/49/maven-parent-49.pom) @ line 1328
[WARNING]   Mojo INTERNAL issue(s):
[WARNING]    * Mojo apache-rat:check (org.apache.rat.mp.RatCheckMojo)
[WARNING]      - Parameter 'excludes' is deprecated: Deprecated for removal since 0.17: Use <inputExclude> instead.

[ctubbsii]

If I'm understanding this correctly, executing this plugin requires JDK 17, but the POM specifies a minimalJavaBuildVersion using the javaVersion property, which defaults to 8.

You can't use rat 0.18 with the default settings.

I think upstream creadur/rat needs to fix this before it is updated in the Apache parent POM. They should set a minimalJavaBuildVersion to 17, and set maven.compiler.release to 8 instead of setting maven.compiler.source and maven.compiler.target to 17. It seems that was the intent with their use of the animal sniffer plugin to enforce that it works with Java 8, but they couldn't figure out how to get that to work when building with newer java versions, or something, so they opened mojohaus/animal-sniffer#316 about it and built 0.18 in a way that requires Java 17. I commented on that issue explaining how it needs to be fixed.

I recommend rat remove the animal sniffer plugin, fix their build to target Java 8 release while using a build JDK of 17 and the release flag, and then re-release as 0.19, and then update the Apache parent POM to 0.19 with the fixed rat plugin.

Also, there was another PR against this project that tried to bump to 0.18 (and a redundant issue), which also removed the commons-lang3 dependency override, which this PR does not do.