Proper fix for Java 10 complaining about illegal reflection access by jaxb-impl 2.3.0?

We are looking at upgrading some legacy code to Java 10. As JAXB is not visible by default (EDIT: and the proper long term solution is not to circumvent the symptom using various JVM flags, but fix it properly) I have added this snippet to my pom.xml:

    <!-- https://mvnrepository.com/artifact/javax.xml.bind/jaxb-api -->
    <dependency>
        <groupId>javax.xml.bind</groupId>
        <artifactId>jaxb-api</artifactId>
        <version>2.3.0</version>
    </dependency>
    <dependency>
        <groupId>com.sun.xml.bind</groupId>
        <artifactId>jaxb-core</artifactId>
        <version>2.3.0</version>
    </dependency>
    <dependency>
        <groupId>com.sun.xml.bind</groupId>
        <artifactId>jaxb-impl</artifactId>
        <version>2.3.0</version>
    </dependency>

Unfortunately there is still a warning printed at startup to stderr. Apparently this is not the correct fix.

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int)
WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release

The full output from --illegal-access=debug is:

WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.getMethod(Injector.java:222)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.access$000(Injector.java:74)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:175)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:172)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.<clinit>(Injector.java:171)
    at com.sun.xml.bind.v2.runtime.reflect.opt.AccessorInjector.prepare(AccessorInjector.java:81)
    at com.sun.xml.bind.v2.runtime.reflect.opt.OptimizedAccessorFactory.get(OptimizedAccessorFactory.java:179)
    at com.sun.xml.bind.v2.runtime.reflect.Accessor$FieldReflection.optimize(Accessor.java:285)
    at com.sun.xml.bind.v2.runtime.property.ArrayProperty.<init>(ArrayProperty.java:68)
    at com.sun.xml.bind.v2.runtime.property.ArrayERProperty.<init>(ArrayERProperty.java:88)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementProperty.<init>(ArrayElementProperty.java:100)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementNodeProperty.<init>(ArrayElementNodeProperty.java:62)
    at com.sun.xml.bind.v2.runtime.property.PropertyFactory.create(PropertyFactory.java:128)
    at com.sun.xml.bind.v2.runtime.ClassBeanInfoImpl.<init>(ClassBeanInfoImpl.java:181)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.getOrCreate(JAXBContextImpl.java:514)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:331)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:139)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1156)
    at com.sun.xml.bind.v2.ContextFactory.createContext(ContextFactory.java:165)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:297)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:286)
    at javax.xml.bind.ContextFinder.find(ContextFinder.java:409)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:721)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:662)
    at dk.statsbiblioteket.medieplatform.autonomous.PremisManipulatorFactory.<init>(PremisManipulatorFactory.java:28)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule.providePremisManipulatorFactory(DomsModule.java:182)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:32)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:11)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:56)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:12)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.doms.DomsRepository_Factory.get(DomsRepository_Factory.java:53)
WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.resolveClass(java.lang.Class)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.getMethod(Injector.java:222)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.access$000(Injector.java:74)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:175)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:172)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.<clinit>(Injector.java:171)
    at com.sun.xml.bind.v2.runtime.reflect.opt.AccessorInjector.prepare(AccessorInjector.java:81)
    at com.sun.xml.bind.v2.runtime.reflect.opt.OptimizedAccessorFactory.get(OptimizedAccessorFactory.java:179)
    at com.sun.xml.bind.v2.runtime.reflect.Accessor$FieldReflection.optimize(Accessor.java:285)
    at com.sun.xml.bind.v2.runtime.property.ArrayProperty.<init>(ArrayProperty.java:68)
    at com.sun.xml.bind.v2.runtime.property.ArrayERProperty.<init>(ArrayERProperty.java:88)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementProperty.<init>(ArrayElementProperty.java:100)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementNodeProperty.<init>(ArrayElementNodeProperty.java:62)
    at com.sun.xml.bind.v2.runtime.property.PropertyFactory.create(PropertyFactory.java:128)
    at com.sun.xml.bind.v2.runtime.ClassBeanInfoImpl.<init>(ClassBeanInfoImpl.java:181)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.getOrCreate(JAXBContextImpl.java:514)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:331)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:139)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1156)
    at com.sun.xml.bind.v2.ContextFactory.createContext(ContextFactory.java:165)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:297)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:286)
    at javax.xml.bind.ContextFinder.find(ContextFinder.java:409)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:721)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:662)
    at dk.statsbiblioteket.medieplatform.autonomous.PremisManipulatorFactory.<init>(PremisManipulatorFactory.java:28)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule.providePremisManipulatorFactory(DomsModule.java:182)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:32)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:11)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:56)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:12)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.doms.DomsRepository_Factory.get(DomsRepository_Factory.java:53)
WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector (file:/home/tra/.m2/repository/com/sun/xml/bind/jaxb-impl/2.3.0/jaxb-impl-2.3.0.jar) to method java.lang.ClassLoader.findLoadedClass(java.lang.String)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.getMethod(Injector.java:222)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.access$000(Injector.java:74)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:175)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1.run(Injector.java:172)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at com.sun.xml.bind.v2.runtime.reflect.opt.Injector.<clinit>(Injector.java:171)
    at com.sun.xml.bind.v2.runtime.reflect.opt.AccessorInjector.prepare(AccessorInjector.java:81)
    at com.sun.xml.bind.v2.runtime.reflect.opt.OptimizedAccessorFactory.get(OptimizedAccessorFactory.java:179)
    at com.sun.xml.bind.v2.runtime.reflect.Accessor$FieldReflection.optimize(Accessor.java:285)
    at com.sun.xml.bind.v2.runtime.property.ArrayProperty.<init>(ArrayProperty.java:68)
    at com.sun.xml.bind.v2.runtime.property.ArrayERProperty.<init>(ArrayERProperty.java:88)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementProperty.<init>(ArrayElementProperty.java:100)
    at com.sun.xml.bind.v2.runtime.property.ArrayElementNodeProperty.<init>(ArrayElementNodeProperty.java:62)
    at com.sun.xml.bind.v2.runtime.property.PropertyFactory.create(PropertyFactory.java:128)
    at com.sun.xml.bind.v2.runtime.ClassBeanInfoImpl.<init>(ClassBeanInfoImpl.java:181)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.getOrCreate(JAXBContextImpl.java:514)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:331)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:139)
    at com.sun.xml.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1156)
    at com.sun.xml.bind.v2.ContextFactory.createContext(ContextFactory.java:165)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:297)
    at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:286)
    at javax.xml.bind.ContextFinder.find(ContextFinder.java:409)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:721)
    at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:662)
    at dk.statsbiblioteket.medieplatform.autonomous.PremisManipulatorFactory.<init>(PremisManipulatorFactory.java:28)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule.providePremisManipulatorFactory(DomsModule.java:182)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:32)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvidePremisManipulatorFactoryFactory.get(DomsModule_ProvidePremisManipulatorFactoryFactory.java:11)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:56)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.tools.modules.DomsModule_ProvideSBOIEventIndexFactory.get(DomsModule_ProvideSBOIEventIndexFactory.java:12)
    at dk.statsbiblioteket.digital_pligtaflevering_aviser.doms.DomsRepository_Factory.get(DomsRepository_Factory.java:53)

What are the proper dependencies to use here to resolve this problem?

Answer

jaxb-ri runtime uses ClassLoader#defineClass / Unsafe#defineClass to do some bytecode modification in runtime to optimize performance. ClassLoader#defineClass is tried first which causes the warning.

This legacy optimization is removed completely in jaxb-ri master (after 2.3.0, not released yet).

To disable this optimization for 2.3.0, set system property com.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize.

After next jaxb-ri release updating to newest version will remove the warning. jaxb-core artifact will be discontinued in favor for JPMS support. Correct pom will look like:

<dependency>
    <groupId>javax.xml.bind</groupId>
    <artifactId>jaxb-api</artifactId>
    <version>2.4.0</version> 
</dependency>
<dependency>
    <groupId>org.glassfish.jaxb</groupId>
    <artifactId>jaxb-runtime</artifactId>
    <version>2.4.0</version> 
</dependency>

If you wish to try early, you can pick latest promoted build from: https://maven.java.net/content/groups/promoted/org/glassfish/jaxb/jaxb-runtime/