graal-sdk in 23.1.x brings in `org.graalvm.polyglot` which causes a couple of issues (wrap up)

[zakkak]

Description

Starting with 23.1 org.graalvm.sdk:graal-sdk (which was first introduced in 22.3) is just a wrapper (for backwards compatibility) that depends on the new (in 23.1) artifacts:

• org.graalvm.sdk:collections
• org.graalvm.sdk:nativeimage
• org.graalvm.sdk:word
• org.graalvm.polyglot:polyglot

The APIs that Quarkus depends on (for substitutions, Features etc.) used to come from org.graalvm.sdk:graal-sdk (<23.1) and are now (>= 23.1) all packaged in org.graalvm.sdk:nativeimage so there is no need to depend on the rest.

While this would normally not be a big issue, specifically bringing org.graalvm.polyglot:polyglot in the dependency tree causes the following issues:

1. The heuristic used to see if Truffle is being used becomes always true
2. Native builds with Mandrel 23.0 break

Both issues are now fixed for Quarkus (to be backported to 3.8 as well) by #39372 (depend on nativeimage instead of graal-sdk). Although the first one may still manifest if a user explicitly depends on org.graalvm.polyglot:polyglot, this is tracked in #39387.

However, since quarkus-extensions may depend on graal-sdk, removing it from the Quarkus BOM would break them (at a quiet late stage for 3.8) and that is too aggressive. As a result, we decided to keep graal-sdk in the Quarkus BOM for 3.8 and 3.9, and remove it in 3.10.

That means that if a quarkus-extension depends on graal-sdk they will still be able to trigger both issues mentioned above.

Implementation ideas

As discussed in a call, one option proposed to resolve the issue was to add an exclusion in the Quarkus BOM so that org.graalvm.polyglot:polyglot is excluded from the graal-sdk dependency.
Since we expect most quarkus-extensions to rely on graal-sdk just for substitutions and GraalVM Features, we expect that the impact of this would be minimal, i.e. it would only affect extensions actually using the polyglot API.

Another option to resolve the issue regarding building with Mandrel 23.0 is to explicitly and unconditionally remove the polyglot dependency from the classpath when building with Mandrel 23.0. The risk with this approach is that the polyglot implementation the user expect (by using the 23.1.x version from the Quarkus POM file) might be different than the provided by Mandrel 23.0.x implementation and the user won't know about it. The first option is probably better, since users depending on the polyglot API and are willing to build with Mandrel 23.0.x will have to manually add the dependency (with provided scope) and they should use the right version of it instead of the one from the Quarkus BOM.

cc @ppalaga @gsmet @maxandersen @galderz @geoand @aloubyansky @gemmellr @jerboaa

[quarkus-bot]

/cc @Karm (mandrel), @galderz (mandrel)

[gemmellr]

Excluding org.graalvm.polyglot:polyglot from from graal-sdk would be fine for me, I actually worked up a change locally yesterday to doing exactly that in my extension in case I needed to publish it before a new quarkus core becomes available that has the new nativeimage dep declared in it. So makes sense to me :)

[zakkak]

@galderz also suggested printing a warning when someone uses graal-sdk, can we do that? I believe it would make sense at least for 3.9 (if we don't want users to get warnings in 3.8)

[gsmet]

Yeah, I think we should go the exclusion route. It's less intrusive and I'm less worried about corner cases.
I will prepare a PR for that.

As for the warning, I think it's a good idea to have it. I will see if I can add it too.

[jerboaa]

As discussed in a call, one option proposed to resolve the issue was to add an exclusion in the Quarkus BOM so that org.graalvm.polyglot:polyglot is excluded from the graal-sdk dependency.

+1