Eliminating a Joda Time Dependency

 A short time ago, I started work on a new project, which would be based on the Scala Play framework.

Part of this project required some authentication logic, and I stumbled upon the Play Silhouette library. Unfrotunately, this depends on Joda Time, which in 2022 (and, particularly, post the introduction of the Java Time API in Java 8) seems old-hat.

I therefore set about creating a PR to remove Joda Time from this library.  It seemed simple... replace all the uses of Joda's DateTime with a ZonedDateTime from Java Time, remove the dependency on Joda Time, and we're done... right?

Wrong.

For some reason, even after removing the direct dependency on Joda Time, the Joda Time classes remained available in the project's classpath.  Clearly, there's some transitive dependency that causes this library to be added unexpectedly.

A quick check online, and I've added addDependencyTreePlugin to my plugins.sbt, and run sbt dependencyBrowseTree to find where Joda is being added.

•  Various places...
  
• com.typesafe.play:play_2.13:2.8.16
• com.typesafe.play:play-json_2.13:2.8.2 
• joda-time:joda-time:2.10.5

 Looking at the Play framework itself, the default support for Joda Time was removed in v2.6, and we're using the very latest (at time of writing) 2.8.16, so I wouldn't have expected to see Joda Time here.

However - the play-json project didn't actually remove Joda Time until v2.9.x - checking out the 2.8.2 branch used by Play 2.8.16, it seems that removing Joda is still a TODO item: https://github.com/playframework/play-json/blob/b82966d7b523410f55e52b62811609765ceccb25/build.sbt#L246

Now, Play-Silhouette itself doens't directly add a dependency on Play-JSON - it's added by the dependency on the main Play framework - so we'll have to override that dependency so that we get the newer Play-JSON library that no longer depends on Joda Time.

A quick tweak of build.sbt later to add the explicit dependency on Play-JSON:2.9.2 and... oh, we're not done.

Unfortunately, Play-Silhouette is composed of many sub-modules, and each of these has a separate dependency on the Play framework.  So, instead of just adding the dependency in one place, we have to add it in all the places the Play framework itself is added.

Checking using the Dependency Browse Tree command, we no longer see Joda Time, and we also no longer see Play-JSON 2.8.2 - instead, we see Play-JSON 2.9.2

• Various places...
• com.typesafe.play:play_2.13:2.8.16
• com.typesafe.play:play-json_2.13:2.8.2 (evicted by 2.9.2)
• com.typesafe.play:play-json_2.13:2.9.2
  

 Unfortunately, one sub-module still has a dependency on Joda Time - that's the Silhouette-CAS module, which in turn depends on Java-Jas-Client

• io.github.honeycomb-cheesecake:play-silhouette-cas_2.13:8.0.3-SNAPSHOT
• org.jasig.cas.client:cas-client-support-saml:3.6.4 
• joda-time:joda-time:2.10.13

So, the next step will be to submit a PR on that repo to migrate that to Java 8 Time as well. Hopefully, that will be a really easy sell, as they only seem to use the Joda time API internally for date parsing and date arithmatic, and all their public API is standard java.util.Date.  Watch this space for an update on that...

For now... have a look at the commit that removes the transitive dependencies here: https://github.com/Rocketeer007/play-silhouette/commit/021b2591f2db0bbc78437438c3da66f9d3d71cf8

PR on Play-Silhouette: https://github.com/honeycomb-cheesecake/play-silhouette/pull/28

PR on Java-Jas-Client: https://github.com/apereo/java-cas-client/pull/711