Jersey locks JAR, cannot undeploy cleanly

Jersey seems to hold a file lock on Windows. Consider a very simple Spring Boot/Jersey application setup:

- Generate a fresh Spring Boot application using [Initializr][1] and select the Jersey dependency (in my case, I prefer the Gradle setup).
- Add simple Controller and Configuration classes:

**JerseyConfig.java**

package com.example.unload;
import org.glassfish.jersey.server.ResourceConfig;
import org.springframework.context.annotation.Configuration;
@Configuration
public class JerseyConfig extends ResourceConfig {
JerseyConfig() { register(TestController.class); }
}

**TestController.java**

package com.example.unload;
import org.springframework.stereotype.Component;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
@Component @Path("test")
public class TestController {
@GET public String test() {
return "test";
}
}

- Run the `war` task and deploy the WAR to Tomcat (8.5 in my case).

Whenever I want to undeploy (e.g. for re-deployment) the WAR, I get the following error message

Oct 23, 2017 8:13:11 AM org.apache.catalina.startup.ExpandWar deleteDir
FATAL: […\apache-tomcat-8.5.20\webapps\unload-0.0.1-SNAPSHOT\WEB-INF\lib] could not be completely deleted. The presence of the remaining files may cause problems

The culprit is the jersey-server-2.25.1.jar in the lib directory, to which apparently some classloader must have a reference. I also cannot manually delete the file, because Java holds a lock on it.

Interestingly, after manually executing a GC run (externally through jvisualvm), I *am* able to delete the jersey-server.jar.

As this is only happening to jersey (and no other libraries), I suspect that this must be a bug in Jersey. Probably it is not closing a stream, but I find this hard to debug. (See also #317.)

I could also reproduce this using jersey-2.26 and jersey-hk2-2.26.

[1]: https://start.spring.io/