Andrew Steinborn
Andrew Steinborn
I will probably consider this if and when we bump Velocity to Java 11 as the minimum.
We are going to be using Java 11 as the minimum in Velocity 2.0.0 so the path is clear to implement this.
...why not use a plugin?
I would recommend applying as much of indra as you can - it will likely eliminate all of the custom Gradle plugins you currently employ (with the exception of licensing...
The other thing I want to stress is that this is not a security mechanism - it's more of a correctness mechanism.
We will probably leverage Jigsaw support (see #354) to enforce these restrictions.
I actually disagree with your proposed solution - since Velocity injects all the dependencies that a plugin will receive from the proxy through the injector, the programming model is vulnerable...
I'm open to it but it'd be a low priority for me right now. (I'm already failing to cut releases on time, adding the additional complication of producing and pushing...
I'm happy with this but would like some input from others before I merge.