38

From yesterday I have problems compiling with maven because of iText jar. My project has a dependency of jasperreports-2.0.1 that depends on itext-1.02b or higher.

<dependency>
    <groupId>com.lowagie</groupId>
    <artifactId>itext</artifactId>
    <version>[1.02b,)</version>
    <scope>compile</scope>
</dependency>

That is the log error in maven:

Failed to collect dependencies for [jasperreports:jasperreports:jar:2.0.1 (compile)]: Failed to read artifact descriptor for com.lowagie:itext:jar:4.2.2: Could not transfer artifact com.itextpdf:itextpdf:pom:4.2.2 from/to jaspersoft (http://www.jasperforge.org/maven2): Access denied to http://www.jasperforge.org/maven2/com/itextpdf/itextpdf/4.2.2/itextpdf-4.2.2.pom. Error code 403, Forbidden -> [Help 1] 

I see here a comment from Amedee Van Gasse that says something about a 4.2.2 version with no jar.

Why does the 1.02b version attach to 4.2.2?

Edit: Jasper-reports uses an open version range:

[1.02b,)

This range says to maven to take the library latest version.

With the update from iText adding new version Pom with no jar and editting the maven-metadata of maven-central to that no-jar version crashes the compilation to all jar depending form latest com.lowagie library.

Updating locally your maven-metadata-central.xml (and other metadata if your company has it's own nexus.public) from ...m2\repository\com\lowagie\itext to that works. Temporally solucion until iText updates the metadata or ALL companies that has dependencies for it's latest version updates it's pom

<metadata modelVersion="1.1.0">
  <groupId>com.lowagie</groupId>
  <artifactId>itext</artifactId>
  <versioning>
    <latest>4.2.1</latest>
    <release>4.2.1</release>
    <versions>
      <version>0.99</version>
      <version>1.1.4</version>
      <version>1.02b</version>
      <version>1.2.3</version>
      <version>1.3</version>
      <version>1.3.1</version>
      <version>1.4</version>
      <version>1.4.8</version>
      <version>2.0.1</version>
      <version>2.0.6</version>
      <version>2.0.7</version>
      <version>2.0.8</version>
      <version>2.1.0</version>
      <version>2.1.2</version>
      <version>2.1.3</version>
      <version>2.1.4</version>
      <version>2.1.5</version>
      <version>2.1.7</version>
      <version>4.2.0</version>
      <version>4.2.1</version>
    </versions>
    <lastUpdated>20150709153501</lastUpdated>
  </versioning>
</metadata>
16
  • The iText version you are using dates from February 2004. That's 11 and a half years ago. It's a miracle you were able to use it for so long without an upgrade... Commented Jul 9, 2015 at 10:25
  • Yes, the project is really old, but I can't update because is a commercial one, but I say you that it still works, after yesterday. Now we can't compile any release from any environment and is imposible to do deployments. Big issue. Commented Jul 9, 2015 at 10:29
  • Why don't you fix the dependency so that it sticks to a single version? If you decide you never want to upgrade, you should also tell Maven that you never want to upgrade. Commented Jul 9, 2015 at 10:35
  • 1
    Agree that I don't understand totally what I'm down-voting because I don't know your life, I only know your product from 2 days ago (even now I'm not totally sure what is for) and I see a (in my opinion) good question and an (in my unknowledge) egocentric answer. I apologyze. Now that we know the problem (2 answers down) can Itext Group update maven-metadata again to a latest release that has .jar? Please Commented Jul 9, 2015 at 12:29
  • 3
    Who has permission to update the metadata in Maven Central for com.lowagie and com.itextpdf: members of the development team at iText Group NV. Commented Jul 9, 2015 at 13:57

13 Answers 13

25

A much simpler solution may be to upgrade to a newer version of jasperreports. Version 6.1.0 has this dependency on iText:

<dependency>
    <groupId>com.lowagie</groupId>
    <artifactId>itext</artifactId>
    <version>2.1.7.js2</version>
    <scope>compile</scope>
</dependency>

No more "floating" dependency on iText, and it's a version that's custom made for jasperreports!

See http://mvnrepository.com/artifact/net.sf.jasperreports/jasperreports/6.1.0 for the complete pom.xml.

7
  • 4
    The patched iText version is not available from Maven repository anymore...
    – user319799
    Commented Oct 12, 2016 at 10:57
  • You should contact Jasper Reports, it is their responsibility to have a correct dependency in their POM. Keep in mind that only iText Software is allowed to put com.lowagie artifacts on Maven, and we never uploaded anything with a .js extension. I don't know who put it there in the first place and I don't know why it's not there any more. As a workaround, you can try with iText 2.1.7. Commented Oct 12, 2016 at 11:06
  • you can review the maven repo mvnrepository.com/artifact/com.lowagie/itext/2.1.7 The version is 2.1.7 now, not 2.1.7.js2
    – yecid
    Commented Nov 16, 2016 at 15:56
  • 1
    @yecid The version of com.lowagie iText on Maven Central has always been 2.1.7, I don't understand your comment. It's Jasper Reports that is responsible for their own dependency management, or not? Commented Dec 15, 2016 at 8:43
  • 2
    That is unfortunate. Take it up with Jasper Reports or use one of the other solutions. Commented Jan 13, 2017 at 5:55
22

I'm using gradle and for the current version 6.8.2 I got the following build error:
> Could not find com.lowagie:itext:2.1.7.js6

So I added http://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/ as repository and now it works.

repositories {
    mavenCentral()
    maven { url "https://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/" }
}

dependencies {
    compile 'net.sf.jasperreports:jasperreports:6.8.0'
}

EDIT: If you used this solution and suddenly get an error like

> Could not resolve com.lowagie:itext:2.1.7.js6.
    > Could not parse POM http://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/com/lowagie/itext/2.1.7.js6/itext-2.1.7.js6.pom
       > The element type "hr" must be terminated by the matching end-tag "</hr>".

This is because the jfrog repository disabled http and only allows https now. For some reason this creates a broken pom with the following content

<html>
<head><title>308 Permanent Redirect</title></head>
<body>
<center><h1>308 Permanent Redirect</h1></center>
<hr><center>nginx</center>
</body>
</html>

Solution: Replace the http in the repository url with https.

4
  • Is the jaspersoft.jfrog.io listed as an official repo from JasperSoft or somehow vetted by jfrog?
    – Freiheit
    Commented Jul 30, 2019 at 22:03
  • JFrog is listed as a sponsor on the official Jaspersoft homepage. community.jaspersoft.com/wiki/sponsors I think it's trustworthy.
    – das Keks
    Commented Nov 3, 2019 at 18:34
  • Also see community.jaspersoft.com/questions/1071031/… Commented Apr 28, 2020 at 10:35
  • Adding the JFrog repository (http://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/) to my build.gradle solved the problem! Thanks
    – dk7
    Commented Sep 5, 2020 at 21:33
14

We decide to maintain same jasperreport version and made this changes in conflicteds pom:

<dependencies>
    <dependency>
            <groupId>jasperreports</groupId>
            <artifactId>jasperreports</artifactId>
            <version>2.0.1</version>
            <exclusions>
                <exclusion>
                    <groupId>com.lowagie</groupId>
                    <artifactId>itext</artifactId>
                </exclusion>
            </exclusions>           
    </dependency>
    <dependency>
        <groupId>com.lowagie</groupId>
        <artifactId>itext</artifactId>
        <version>2.1.7</version>
    </dependency>
...
</dependencies>

Edit: Change dependecy to 2.1.7 to be certain it will compile in future

0
14

The problem is indeed in the POM of jasper-reports:

<dependency>
  <groupId>com.lowagie</groupId>
  <artifactId>itext</artifactId>
  <version>[1.02b,)</version>
  <scope>compile</scope>
</dependency>

Jasper-reports distributes a (modified) build of iText 2.1.7 since at least November 2012 (if memory serves me well), so if your version of jasper-reports still has a dependency on 1.02b and up, it must be a very old version.

The jasper-reports dependency on iText should be changed to:

<dependency>
  <groupId>com.lowagie</groupId>
  <artifactId>itext</artifactId>
  <version>[1.02b,2.1.7]</version>
  <scope>compile</scope>
</dependency>

Or just:

<dependency>
  <groupId>com.lowagie</groupId>
  <artifactId>itext</artifactId>
  <version>2.1.7</version>
  <scope>compile</scope>
</dependency>

This relates to this question: How do I tell Maven to use the latest version of a dependency? That page is riddled with cautions about always using the latest version for your dependencies. It reduces reproducibility of your builds.

2.1.7 was the last version of iText released by the company iText Group NV (or its legal predecessor), with the com.lowagie groupId. The next version of iText, released by the company iText Group NV, was version 5.0.0, with the com.itextpdf groupId, which means it's binary incompatible with your current code. There's also the matter of a license change to AGPL, but that is outside the scope of StackOverflow, I want to restrict my answer to the technical matters.

Any other versions of iText between 2.1.7 and 5.0.0, like 4.2.0 and 4.2.1, are forks by other companies. According to Apache's Guide to uploading artifacts to the Central Repository (https://maven.apache.org/guides/mini/guide-central-repository-upload.html), those companies should have used a different groupId, as the page clearly states in their FAQ:

I have a patched version of the foo project developed at foo.com, what groupId should I use? When you patch / modify a third party project, that patched version becomes your project and therefore should be distributed under a groupId you control as any project you would have developed, never under com.foo. See above considerations about groupId.

TL;DR If you don't want to change your code, tell your Maven to only get iText 2.1.7.

5
  • Hi, if the latest iText version from iText is 2.1.7. Why you update the maven-metadata to 4.2.2? I'm agree with you if you like to say that 2.1.7 is the latest version of com.lowagie and update to that because you have all rights about that. In fact, updating the latest version to 4.2.2 crashes all malformed dependencies from other .jar (like jasperreports) and is not necessary because you say iText Group legal jar for com.lowagie goes to 2.1.7. Do your company that error only for free publicity? Commented Jul 10, 2015 at 6:35
  • If you examine the 4.2.2 POM, you will see that it has a <relocation> section, redirecting from com.lowagie to com.itextpdf. Ideally, such a POM should have been online at the same iText 5.0.0 was released, in 2009. Unfortunately that didn't happen, and this situation was only recently corrected. I don't know why your Maven doesn't pick up that <relocation> tag, it should. More information about relocation at stackoverflow.com/questions/28881819/maven-pom-relocation Commented Jul 10, 2015 at 7:05
  • 1
    It does, my maven see the relocation, but goes to itextpdf:itextpdf:pom:4.2.2 and there is no jar, you can see it in mave log error in the original question. Do you say that problem is recently corrected? Do you attach 4.2.2 jar in the new group id? Commented Jul 10, 2015 at 7:17
  • 1
    OK, this is useful feedback, thank you! That's a situation I can fix, I need to upload another POM that redirects to a itextpdf:itextpdf:pom version that actually exists, like 5.5.6. That way you will still get an error in your build, because of the binary incompatibility, but at least your Maven won't complain. Commented Jul 10, 2015 at 7:21
  • I have updated the POM on Maven Central. I deleted my local maven cache and created a test project with dependency on itext 4.2.2. Maven gave this warning but the build did not fail (itext wasn't actually used in the test project): [WARNING] The artifact com.lowagie:itext:jar:4.2.2 has been relocated to com.itextpdf:itextpdf:jar:5.5.6 Commented Jul 10, 2015 at 8:12
9

I got the same problem,

Just realized that https://jaspersoft.jfrog.io/artifactory/third-party-ce-artifacts is not accessible by public, you need to change the artifactory to jaspersoft directory.

For maven you can use below repositories in pom.xml

<repositories>
  <repository>
    <id>jaspersoft-third-party</id>
    <url>https://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/</url>
  </repository>
</repositories>
8

I was making manteinance to some legacy code, and i faced the same problem. The solution that i found was to add the following to the pom.xml:

<repositories>
  <repository>
    <id>jasper-3rd-party</id>
    <name>Jasper3rdParty</name>
    <url>http://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/</url>
  </repository>
</repositories>

<dependencies>

  <dependency>
    <groupId>net.sf.jasperreports</groupId>
    <artifactId>jasperreports</artifactId>
    <version>6.12.2</version>
  </dependency>

  <!-- More dependencies like: commons-collections4, org.apache.xmlgraphics, etc -->

  <dependency>
    <groupId>com.lowagie</groupId>
    <artifactId>itext</artifactId>
    <version>2.1.7.js4</version>
  </dependency>

</dependencies>

The JasperReports version used to test this code was released on Mar/2020. Hope this helps!

4
  • 2
    Why do they keep depending on custom versions of itext but not publishing them? This is so painful...
    – rogerdpack
    Commented Apr 23, 2021 at 13:47
  • @rogerdpack Itext changed its license to AGPL in later versions, which is why JasperReports uses the old version with some bugfixes. They are not allowed to publish those to central.
    – Tigerware
    Commented Apr 26, 2021 at 5:49
  • I'd assume they could change the coordinates and publish their own full version, since the 2.x versions are MIT license or something...?
    – rogerdpack
    Commented Apr 26, 2021 at 16:07
  • The URL of the repository has changed to jaspersoft.jfrog.io/ui/native/third-party-ce-artifacts/com/…
    – Javi2EE
    Commented Jun 9, 2022 at 13:37
7

JasperReports patched the iText with some bug fixes. So you have to add the patched iText repo[1] in your pom/gradle file.

[1] http://jasperreports.sourceforge.net/maven2/

Below is the gradle snippet for your reference when using jasper report 6.1.1.

repositories {
 mavenLocal()
    mavenCentral()
    maven { url "http://repo.spring.io/release" }
    maven { url "https://jaspersoft.jfrog.io/artifactory/third-party-ce-artifacts/" }
    maven { url "http://jasperreports.sourceforge.net/maven2/" }
}
5

This worked with the latest jasper-reports version 6.17.0 and maven 3.8.1, especially with the jasperreports-plugin from com.alexnederlof in version 2.8:

<project>
    ...
    <repositories>
        <!-- JasperSoft, they modified a standard library for their own special needs -->
        <repository>
            <id>jaspersoft-third-party</id>
            <url>https://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/</url>
        </repository>
    </repositories>

    <pluginRepositories>
        <!-- JasperSoft, they modified a standard library for their own special needs -->
        <pluginRepository>
            <id>jaspersoft-third-party</id>
            <url>https://jaspersoft.jfrog.io/jaspersoft/third-party-ce-artifacts/</url>
        </pluginRepository>
    </pluginRepositories>
    ...

It's important to know that there is not only <repositories> but also <pluginRepositories> which you maybe have to supply (depending on your setup and transitive dependencies).

4

Answer for searchers in 2k19

Artifact:

<groupId>com.lowagie</groupId>
<artifactId>itext</artifactId>

is deprecated now.

Better to exclude it from jasperreports and add new itext dependency manually

<dependency>
    <groupId>jasperreports</groupId>
    <artifactId>jasperreports</artifactId>
    <version>6.10.0</version> <!--(or higher)-->
    <exclusions>
        <exclusion>
            <groupId>com.lowagie</groupId>
            <artifactId>itext</artifactId>
        </exclusion>
    </exclusions>
</dependency>
<dependency>
    <groupId>com.itextpdf</groupId>
    <artifactId>itextpdf</artifactId>
    <version>5.5.13</version> <!--(or higher)-->
</dependency>
1
  • 1
    In this case it is very important to mention that "itextpdf" is under the AGLP license.
    – Alex
    Commented Apr 5, 2021 at 11:14
3

"Fix" for me was to switch from jasperreports version 5.5.0 to 4.5.1 LOL. (which doesn't depend on itext)

Then it doesn't depend on a custom, seemingly unpublished dependency version of itext (2.1.7.js2 in my case).

You could download 2.1.7.js2.jar from the jasper people and publish it locally to your "own" custom maven repo, or even your local ~/.m2/repository (ugh). I've even seen people have a custom ivy command to "publish" a local copy of it to a local server (ivy or maven).

Or add the repo's in the other answers. Or just specify it manually as 2.1.7, which is in the main repo's, etc. (you'll miss some bug fixes though).

2
3

If you are using gradle Note That the url to the jaspersoft package below was changed from this one:

maven{ url "http://jaspersoft.artifactoryonline.com/jaspersoft/third-party-ce-artifacts" }

To this one here:

maven { url "https://jaspersoft.jfrog.io/artifactory/third-party-ce-artifacts" }
2

We have the same problem. To solve it, we have deleted the proxy parameters of the Maven config, and change the last version of the maven-metadata-central (in folder com\lowagie\itext of your repository).

A bad solution, but, temporaly, works :/

8
  • Your temporal solution (don't works with Jenkins) brights me the idea. That link talks about version ranges (that jasperreports in my question uses) and how maven gets the newest version if you do it. That problem from jasperrreport pom.xml added with Itext update, what tells maven that version 4.2.2 is latets but haven't .jar causes the problem. Good solution is maven central update the metadata, not we. Commented Jul 9, 2015 at 12:22
  • I only see the "contact us" in the web of mvnrepository... Other options is exclude the worng version. Suerte.
    – Usul Yo
    Commented Jul 9, 2015 at 12:33
  • I create an issue in maven. Only that I can do now is wait that someone with permission update the metadata or work without connection. Mavens jira Commented Jul 9, 2015 at 12:40
  • With the exclusions you can take the version that you want (i think): <dependency> <groupId>jasperreports</groupId> <artifactId>jasperreports</artifactId> <version>3.0.0</version> <exclusions> <exclusion> <!-- declare the exclusion here --> <groupId>com.lowagie</groupId> <artifactId>itext</artifactId> </exclusion> </exclusions> </dependency>
    – Usul Yo
    Commented Jul 9, 2015 at 13:28
  • 1
    The problem is, that other company probably does not exist any more. Commented Jul 10, 2015 at 8:46
0

I have the same problem when using Maven 2.2.1, i re-built my project using Maven 3.2.3 and its works !

You have to use Maven 3 to resolve your problem, the bug seem to be resolved in this version.

3
  • 1
    Could you please tell me which version of itext is actually used? Commented Jul 9, 2015 at 17:06
  • i'm not using itext directly, but JasperReports 1.3.2 references itext 4.2.2
    – Meher
    Commented Jul 10, 2015 at 12:09
  • 1
    JasperReports 1.3.2 (April 2007) references iText [1.02b,), that means any version at or above 1.02b, until infinity and beyond. If you look at mvnrepository.com/artifact/jasperreports/jasperreports/1.3.2, you will see that the iText dependency has version 5.5.6 in the column Updates. That would be com.itextpdf:itextpdf:jar:5.5.6. Commented Jul 10, 2015 at 12:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.