Please build the Java8/10 shim classes into the sanitizer JAR

[jlczuk]

The latest release removes the Guava dependency and introduces the use of Java8 and Java10 shims. The sanitzer JAR was previously completely self-contained except for the Guava dependency. It would be very helpful if the build of the JAR could include the shim classes rather than making them external dependencies.

Currently, I am required to identify the licenses and other information related to any JAR dependencies. The current setup will no require me to get approval to use the java8-shim/java10-shim JARs as if they were separate dependencies from the sanitizer; the same thing I had to do for Guava previously.

[aleruz-dt]

Hi @aalmiray — PR #379 implements exactly what is requested here: the shims (java8-shim and java10-shim) are now inlined into the main sanitizer JAR via the Maven Shade plugin and marked <optional>true</optional>, making the JAR self-contained again.

This also fixes the JPMS split-package error reported in #329.

PR: #379

[jmanico]

Fixed on main by #379 from @aleruz-dt: the java8-shim and java10-shim classes are now bundled inside owasp-java-html-sanitizer.jar and the shim artifacts are no longer published separately, so there is no split package on the module path and nothing extra to put on the classpath. If you added an explicit dependency on either shim as a workaround, remove it when you upgrade. This ships in the next release after 20260313.1. Closing; please reopen if the new release does not fix your case.