Source code analysis: calls to wrapper class constructors

[Dan Smith]

Here are some numbers looking at Maven jars published since 2019:

116,532 jars
4,726 jars that invoke a wrapper constructor (4.1%)
1,031 jars that have more than 10 classes invoking a wrapper constructor (0.9%)

If we focus just on the largest projects (jars with >1000 classes):
3,315 jars
1,620 jars that invoke a wrapper constructor (48.9%)
805 jars that have more than 10 classes invoking a wrapper constructor (24.3%)
133 jars that have more than 100 classes invoking a wrapper constructor (4.0%)

Are these intended to be run on bleeding-edge JVMs? Class files show the following version breakdown:

Pre-5: 2%
5-6: 34%
7: 15%
8: 46%
11: 2%
Others (non-LTS): 0%

What this doesn't tell us is the *latest* JVM a jar file is intended to support. We can at least say that newly-released jars targeting JDK 8 or earlier will be with us for quite some time.

The wrapper constructors were deprecated in 9, and the post-8 sample size is fairly small, but there's not an obvious trend towards reduced use of wrapper constructors in those classes. On the other hand, when you dig into specific projects, I *do* see plenty of examples of projects that have updated their code, apparently in response to the deprecation warnings.

Some specific examples, chosen pretty much at random among the worst offenders:

- Apache Commons: The legacy commons.lang and commons.collections packages have many constructor calls, but these have been fixed in the newer APIs commons.lang3 and commons.collections4

- Apache FOP: Lots of constructor calls in generated code (representing fonts); these have all been fixed as of FOP 2.2, released in 2017.

- Clover repackages old versions of utility libraries like fastutil and Apache Commons, which make heavy use of the wrapper constructors. Both of these projects have been updated to use 'valueOf', but the repackaged sources preserve the old code.

- The GemFire project has a lot of constructor calls, but almost all appear in tests.

- org.omg.CORBA makes heavy use of the constructors, but is also unmaintained code as of JEP 320 (I think?). Would there be an expectation that these libraries continue to run on a new JVM in a few years?

- OpenCMS is an example of an active project that calls the constructor in what appears to be old code, e.g., manually boxing to Object when storing primitives in collections.