Remove Repackaged Dependencies

Epic Description

Title: Migrate from Repackaged Dependencies to Standard Maven Dependencies

Description:
The dotCMS project currently uses 76 repackaged dependencies with the groupId com.dotcms.lib. These dependencies were originally repackaged to avoid conflicts but now create maintenance overhead, security vulnerabilities, and complicate dependency management.

This epic aims to systematically migrate from repackaged dependencies to standard Maven dependencies, improving security, maintainability, and reducing technical debt.

Business Value

• Security: Eliminate known vulnerabilities in outdated repackaged libraries
• Maintainability: Use standard Maven dependencies with regular security updates
• Build Performance: Reduce build complexity and potentially improve performance
• Developer Experience: Simplify dependency management and IDE integration

Scope

• Migrate 76 repackaged dependencies to standard Maven coordinates
• Remove unused dependencies (estimated 50+ candidates)
• Update import statements throughout the codebase
• Ensure backward compatibility and no functional regressions

Success Criteria

• Reduce repackaged dependencies from 76 to <20
• All tests pass (unit, integration, postman)
• No performance regressions
• Security vulnerability count reduced
• Build time maintained or improved

Epic Timeline (With Claude Assistance)

6-10 weeks (significantly reduced from 4-7 months due to Claude's assistance with code migration)

Priority

High - Technical debt reduction with security implications

Sub-Tasks & Estimates (Claude-Assisted)

Phase 1: Foundation & Cleanup ✅ (Completed)

• Task 1.1: Migrate Hibernate Dependencies ✅ COMPLETED → PR #32671
• Task 1.2: Migrate Hibernate Validator ✅ COMPLETED → PR #32672

Phase 2: Low-Risk Migrations (1-2 weeks with Claude)

• Task 2.1: Remove Unused Dependencies Analysis (1-2 days)
  • Claude can analyze dependencies and identify unused ones quickly
• Task 2.2: Migrate JSoup Dependency (1 day)
  • Claude can update 6+ import statements automatically
• Task 2.3: Migrate Commons CLI (1 day)
  • Claude can handle the limited usage quickly
• Task 2.4: Migrate SLF4J Dependencies (1 day)
  • Claude can verify patterns and update imports

Phase 3: Medium-Risk Migrations (2-3 weeks with Claude)

• Task 3.1: Migrate Google Guava (High Usage) (2-3 days)
  • Claude can handle 219+ import statements systematically
• Task 3.2: Migrate Commons HTTP Client (3-4 days)
  • Claude can analyze 30+ imports and suggest migration patterns
• Task 3.3: Migrate JAXB Dependencies (2-3 days)
  • Claude can handle XML binding updates efficiently
• Task 3.4: Migrate Database Connection Libraries (2-3 days)
  • Claude can update DBCP/Pool configurations safely
• Task 3.5: Migrate Utility Libraries (2 days)
  • Claude can handle multiple utility libraries in parallel

Phase 4: High-Risk Migrations (2-4 weeks with Claude)

• Task 4.1: Evaluate DWR Migration (1-2 weeks)
  • Claude can analyze 42+ DWR imports and suggest modern alternatives
• Task 4.2: Portlet System Evaluation (1 week)
  • Claude can analyze 361+ portlet imports and create migration strategy
• Task 4.3: Struts Migration Planning (1 week)
  • Claude can analyze 311+ Struts imports and plan modernization

Phase 5: Validation & Cleanup (1 week with Claude)

• Task 5.1: Comprehensive Testing (3-4 days)
  • Claude can help analyze test results and identify issues
• Task 5.2: Documentation Update (1-2 days)
  • Claude can update documentation efficiently
• Task 5.3: Final Cleanup (1 day)
  • Claude can identify and remove remaining unused dependencies

Claude Assistance Benefits

• Automated Import Updates: Claude can handle bulk import statement changes
• Pattern Recognition: Claude can identify usage patterns and suggest best practices
• Code Analysis: Claude can quickly analyze large codebases and identify dependencies
• Documentation: Claude can generate comprehensive documentation and migration guides
• Risk Assessment: Claude can help identify potential issues before migration
• Testing Support: Claude can help analyze test failures and suggest fixes

Dependencies

• Access to CI/CD pipeline for testing
• Security scanning tools for vulnerability assessment
• Performance testing environment
• Claude Code access for development team

Acceptance Criteria

• All repackaged dependencies migrated to standard Maven coordinates
• All tests pass (unit, integration, postman)
• No performance regressions
• Security vulnerability count reduced
• Build time maintained or improved
• Documentation updated

Assumptions & Initiation Needs

• Team has access to full test suite
• Security scanning tools are available
• Performance testing environment is set up
• Claude Code is available for development assistance

Quality Assurance Notes & Workarounds

• Each migration phase includes comprehensive testing
• Rollback plan available for each dependency migration
• Performance benchmarking before and after each phase
• Claude assists with code review and quality assurance

Completed Work

• ✅ Hibernate 5.6.15.Final Migration: PR #32671

  • Upgraded from repackaged Hibernate 2.x to standard Hibernate 5.6.15.Final
  • Updated 30+ files with API changes and import statements
  • Modernized database layer and schema generation

• ✅ Hibernate Validator Migration: PR #32672

  • Replaced repackaged Hibernate Validator with standard version 5.4.3.Final
  • Updated 65+ files with validation imports and annotations
  • Maintained all validation functionality

This is a broad epic covering 76 repackaged dependencies and multiple migration phases; review completed PRs #32671 and #32672 before choosing a narrowly scoped dependency task. Start with the Maven dependency declarations and the relevant imports, then run the unit, integration, and Postman test suites. Done requires standard Maven coordinates, passing tests, reduced vulnerabilities, and no performance or build-time regression.