2.5.2 Release Breaking Upstream Dependencies #240

siladu · 2025-02-12T06:07:52Z

Is it correct that 2.5.2 is supposed to be the only version specified in https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml ?

This is breaking some upstream dependencies, namely oauth2-oidc-sdk which has this in its POM:

<dependency>
    <groupId>net.minidev</groupId>
    <artifactId>json-smart</artifactId>
    <version>[1.3.2,2.4.2]</version>
</dependency>

transitive via io.kubernetes:client-java

./gradlew dependencyInsight --configuration=runtimeClasspath --dependency=json-smart

> Configure project :
Generating project version as supplied is version not semver: unspecified

> Task :dependencyInsight
net.minidev:json-smart:[1.3.2,2.4.2] FAILED
   Failures:
      - Could not find any version that matches net.minidev:json-smart:[1.3.2,2.4.2].
        Versions that do not match: 2.5.2
        Searched in the following locations:
          - https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml

net.minidev:json-smart:[1.3.2,2.4.2] FAILED
\--- com.nimbusds:oauth2-oidc-sdk:9.4
     \--- com.microsoft.azure:adal4j:1.6.7
          \--- io.kubernetes:client-java:21.0.1-legacy
               +--- project :nat (requested io.kubernetes:client-java)

The text was updated successfully, but these errors were encountered:

hezhangjian · 2025-02-12T06:12:40Z

I see the maven metadata's xml, that's indeed only one version, but normally we will update this file during release. the versions should have many. Is there any broken during maven central migrate? @UrielCh

<metadata>
	<groupId>net.minidev</groupId>
	<artifactId>json-smart</artifactId>
	<versioning>
		<latest>2.5.2</latest>
		<release>2.5.2</release>
		<versions>
			<version>2.5.2</version>
		</versions>
		<lastUpdated>20250212044256</lastUpdated>
	</versioning>
</metadata>

strangeundersun · 2025-02-12T06:23:22Z

Same issue found after 2.5.2 released -

Could not find any version that matches net.minidev:json-smart:[1.3.3,2.4.10].
     Versions that do not match: 2.5.2
     Searched in the following locations:
       - https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml
       - https://build.shibboleth.net/maven/releases/net/minidev/json-smart/maven-metadata.xml
       - https://gitlab.com/api/v4/projects/34165892/packages/maven/net/minidev/json-smart/maven-metadata.xml
       - https://gitlab.com/api/v4/projects/34165892/packages/maven/net/minidev/json-smart/
     Required by:
         project :Independence > org.springframework.security:spring-security-oauth2-client:6.2.3 > com.nimbusds:oauth2-oidc-sdk:9.43.3

Dristand · 2025-02-12T06:26:57Z

   > Could not find any version that matches net.minidev:json-smart:[1.3.1,2.3].
     Versions that do not match: 2.5.2
     Searched in the following locations:
       - https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml
       - https://maven.pkg.github.com/org/spark/net/minidev/json-smart/maven-metadata.xml
       - https://jitpack.io/net/minidev/json-smart/maven-metadata.xml
     Required by:
         project :app > com.nimbusds:nimbus-jose-jwt:5.8

Same issue here

ijioio · 2025-02-12T06:53:41Z

It seems that artifact metadata announce version 2.5.2 but artifact itself is not available

Ramnathpraveen-G · 2025-02-12T07:05:33Z

Please help resolve

jabouchleih · 2025-02-12T07:11:20Z

It seems that artifact metadata announce version 2.5.2 but artifact itself is not available

The dependency is available in Maven Central, see: https://repo.maven.apache.org/maven2/net/minidev/json-smart/

The issue - as @hezhangjian already mentioned - that the version history is missing in the maven-metadata.xml.

fugary · 2025-02-12T07:12:19Z

Please help resolve

https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml

Before the bug is fixed, you can manually add the versions to local maven-metadata-central.xml yourself.

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>net.minidev</groupId>
  <artifactId>json-smart</artifactId>
  <versioning>
    <latest>2.5.2</latest>
    <release>2.5.2</release>
    <versions>
      <version>2.5.2</version>
      <version>2.5.1</version>
      <version>2.5.0</version>
      <version>2.4.11</version>
      <version>2.4.10</version>
      <version>2.4.9</version>
      <version>2.4.8</version>
      <version>2.4.7</version>
      <version>2.4.6</version>
      <version>2.4.5</version>
      <version>2.4.4</version>
      <version>2.4.2</version>
      <version>2.4.1</version>
      <version>2.3.1</version>
      <version>2.3</version>
      <version>2.2.1</version>
      <version>2.2</version>
      <version>2.1.1</version>
      <version>2.1.0</version>
      <version>2.0</version>
      <version>2.0-RC3</version>
      <version>2.0-RC2</version>
      <version>2.0-RC1</version>
      <version>1.3.3</version>
      <version>1.3.2</version>
      <version>1.3.1</version>
      <version>1.3</version>
      <version>1.2</version>
      <version>1.1.1</version>
      <version>1.1</version>
      <version>1.0.9-1</version>
      <version>1.0.9</version>
      <version>1.0.8</version>
      <version>1.0.6.3</version>
    </versions>
    <lastUpdated>20250212044256</lastUpdated>
  </versioning>
</metadata>

ijioio · 2025-02-12T07:29:50Z

It seems that artifact metadata announce version 2.5.2 but artifact itself is not available

The dependency is available in Maven Central, see: https://repo.maven.apache.org/maven2/net/minidev/json-smart/

The issue - as @hezhangjian already mentioned - that the version history is missing in the maven-metadata.xml.

Yeah, true, now it shows for me as well. Probably browser cache issue. Thanks!

thewisenerd · 2025-02-12T07:34:26Z

here's a more complete list; versions from https://mvnrepository.com/artifact/net.minidev/json-smart

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>net.minidev</groupId>
  <artifactId>json-smart</artifactId>
  <versioning>
    <latest>2.5.2</latest>
    <release>2.5.2</release>
    <versions>
      <version>2.5.2</version>
      <version>2.5.1</version>
      <version>2.5.0</version>
      <version>2.4.11</version>
      <version>2.4.10</version>
      <version>2.4.9</version>
      <version>2.4.8</version>
      <version>2.4.7</version>
      <version>2.4.6</version>
      <version>2.4.5</version>
      <version>2.4.4</version>
      <version>2.4.2</version>
      <version>2.4.1</version>
      <version>2.3.1</version>
      <version>2.3</version>
      <version>2.2.1</version>
      <version>2.2</version>
      <version>2.1.1</version>
      <version>2.1.0</version>
      <version>2.0</version>
      <version>2.0-RC3</version>
      <version>2.0-RC2</version>
      <version>2.0-RC1</version>
      <version>1.3.3</version>
      <version>1.3.2</version>
      <version>1.3.1</version>
      <version>1.3</version>
      <version>1.2</version>
      <version>1.1.1</version>
      <version>1.1</version>
      <version>1.0.9-1</version>
      <version>1.0.9</version>
      <version>1.0.8</version>
      <version>1.0.6.3</version>
    </versions>
    <lastUpdated>20250212044256</lastUpdated>
  </versioning>
</metadata>

ijioio · 2025-02-12T07:58:32Z

Before the bug is fixed, you can manually add the versions to local maven-metadata-central.xml yourself.

As an alternative you can provide artifact of required version from local repository, it will resolve version discovery issue. For Gradle:

repositories {
    mavenCentral()
    flatDir {
        dirs 'libs'
    }
}

project
    \- libs
        \- json-smart-2.4.10.jar

shyvum · 2025-02-12T08:12:27Z

@hezhangjian by when can this be fixed, this is causing build issues on our production codebase.

ArloL · 2025-02-12T09:03:28Z

If you want a quick fix now you can use dependencyManagement. This is best practice anyway to make sure your dependency tree is a little more deterministic and reproducible:

<dependencyManagement>
	<dependencies>
		<dependency>
			<groupId>net.minidev</groupId>
			<artifactId>json-smart</artifactId>
			<version>2.5.2</version>
		</dependency>
	</dependencies>
</dependencyManagement>

I am not completely sure if this is best practice but it does the trick in gradle for me

configurations.all {
	resolutionStrategy {
		force 'net.minidev:json-smart:2.5.2'
	}
}

And also nimbus-jose-jwt:8.20 was released in 2020 and was the last release with the range dependency on json-smart. Maybe now is the time to consider updating some of your dependencies to immediately get rid of this issue ☺️

Edit:
I see now that the issue is oauth2-oidc-sdk:9.43.4 which has the range dependency and it is part of spring-security-oauth2-client and that is managed in spring boot 3.4.2 so that's why so many people have the issue. You can fix your builds using the above strategies.

cbertoldi · 2025-02-12T09:09:00Z

@ArloL that works but not if you run mvn dependency:go-offline, which will try to download an older version even if you specified the latest one with the dependencyManagement.

renoth · 2025-02-12T09:21:42Z

We changed maven-metadata.xml in our artifactory to have the correct format, as seen above, this seems to be a temporary fix

leonardehrenfried · 2025-02-12T09:27:01Z

It looks like a bug in the process that writes the metadata file. If that is a systematic problem in Sonatype's software we will have a big problem today.

prawilny · 2025-02-12T09:32:55Z

Temporary fix that installs into a local repository the required version of the library for mvn users needing version 2.3:

wget https://repo.maven.apache.org/maven2/net/minidev/json-smart/2.3/json-smart-2.3.jar
wget https://repo.maven.apache.org/maven2/net/minidev/json-smart/2.3/json-smart-2.3.pom
mvn install:install-file -Dfile=json-smart-2.3.jar -DpomFile=json-smart-2.3.pom

Alf-Melmac · 2025-02-12T09:35:34Z

Cross referencing the same issue reported on StackOverflow https://stackoverflow.com/a/77851892/16201869

ArloL · 2025-02-12T09:40:37Z

@ArloL that works but not if you run mvn dependency:go-offline, which will try to download an older version even if you specified the latest one with the dependencyManagement.

I can reproduce, @cbertoldi. That seems like a bug in maven-dependency-plugin. It looks like go-offline has a few related issues. qaware/go-offline-maven-plugin seems to work for my reproduction with ./mvnw de.qaware.maven:go-offline-maven-plugin:1.2.8:resolve-dependencies

Ref netplex/json-smart-v2#240

cbertoldi · 2025-02-12T09:49:14Z

Thanks @ArloL, I saw those tickets as well, I am a bit skeptical though about introducing a plugin that does not seem to be actively maintained, the last release is from 2020.

UrielCh · 2025-02-12T09:57:43Z

Can I do anythink about that ?

leonardehrenfried · 2025-02-12T09:59:33Z

@UrielCh Presumably you used Sonatype to publish to Maven Central, which should generate the metadata-file for you. To me it looks like a bug on their side.

Vicferron · 2025-02-12T10:02:39Z

I'm facing the same issue while installing Azure libraries in Databricks, Did anyone solved it??

Library installation attempted on the driver node of cluster 0204-082058-o4puj2qu and failed. Library resolution failed. Error code: ERROR_MAVEN_LIBRARY_RESOLUTION, error message: Library resolution failed because unresolved dependency: net.minidev:json-smart:[1.3.1,2.3]: not found

cbertoldi · 2025-02-12T13:19:37Z

@fctaddia a few different workarounds have been presented. Now please be patient and let @UrielCh work without hammering him with questions, that won't speed up the solution 😉

Edit: and as @ArloL pointed out while I was writing this, it's not even up to @UrielCh to solve the problem.

lir2002 · 2025-02-12T13:21:58Z

here's a more complete list; versions from https://mvnrepository.com/artifact/net.minidev/json-smart

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>net.minidev</groupId>
  <artifactId>json-smart</artifactId>
  <versioning>
    <latest>2.5.2</latest>
    <release>2.5.2</release>
    <versions>
      <version>2.5.2</version>
      <version>2.5.1</version>
      <version>2.5.0</version>
      <version>2.4.11</version>
      <version>2.4.10</version>
      <version>2.4.9</version>
      <version>2.4.8</version>
      <version>2.4.7</version>
      <version>2.4.6</version>
      <version>2.4.5</version>
      <version>2.4.4</version>
      <version>2.4.2</version>
      <version>2.4.1</version>
      <version>2.3.1</version>
      <version>2.3</version>
      <version>2.2.1</version>
      <version>2.2</version>
      <version>2.1.1</version>
      <version>2.1.0</version>
      <version>2.0</version>
      <version>2.0-RC3</version>
      <version>2.0-RC2</version>
      <version>2.0-RC1</version>
      <version>1.3.3</version>
      <version>1.3.2</version>
      <version>1.3.1</version>
      <version>1.3</version>
      <version>1.2</version>
      <version>1.1.1</version>
      <version>1.1</version>
      <version>1.0.9-1</version>
      <version>1.0.9</version>
      <version>1.0.8</version>
      <version>1.0.6.3</version>
    </versions>
    <lastUpdated>20250212044256</lastUpdated>
  </versioning>
</metadata>

It works for me in a Gradle build. I couldn't know where is the maven-metadata.xml for json-smart, so I search the file in Everything and check every file's content and then I put this correct file content.

Ref netplex/json-smart-v2#240

Force resolution to an available version. netplex/json-smart-v2#240

UrielCh · 2025-02-12T13:34:10Z

To try and fix these issues once and for all, I'm starting the final migration from s01.oss.sonatype.org to central.sonatype.com, so I won't have to do it again in 5 or 10 years.

arthurc · 2025-02-12T13:52:28Z

Sent a small sponsorship payment to @UrielCh. Least I can do when you to have to deal with this

fctaddia · 2025-02-12T14:16:07Z

@UrielCh So then from s01.oss.sonatype.org will it become central.sonatype.com? Need a helping hand? Thank you

mikesouthron · 2025-02-12T14:17:07Z

I discovered that 2.5.2 isn't the only version available, but it is the only version in the metadata, so if you specify an older version exactly it will work, it's only if you are using a range it fails, so the spring dependency I am on (old version) has [1.3,2.3] range.

Using @ArloL's fix I was able to build with:

<dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>net.minidev</groupId>
                <artifactId>json-smart</artifactId>
                <version>2.3</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

Add version contraint ensuring that we are always using the 2.3 version for json-smart. There is a transitive dependecy to json-smart from the piglet module with a version range [1.3.1,2.3]: project :piglet > org.apache.hadoop:hadoop-common:2.10.2 > org.apache.hadoop:hadoop-auth:2.10.2 > com.nimbusds:nimbus-jose-jwt:7.9 The maven-metadata.xml of json-smart in Maven central [1] is used to resolve version ranges. After the 2.5.2 relase of json-smart [2] the previous versions were removed from the metadata file leading to failures in the resolution of ranged versions. Using a version constraint by-passes the ranged version problem and improves build stability. [1] https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml [2] netplex/json-smart-v2#240

fctaddia · 2025-02-12T14:30:58Z

@ArloL I specified the maximum version allowed by the library that imports "json-smart" in my build.gradle, so I don't get any more error at build time. Thank you

jeevangali-agi · 2025-02-12T14:46:10Z

I discovered that 2.5.2 isn't the only version available, but it is the only version in the metadata, so if you specify an older version exactly it will work, it's only if you are using a range it fails, so the spring dependency I am on (old version) has [1.3,2.3] range.

Using @ArloL's fix I was able to build with:
<dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>net.minidev</groupId>
                <artifactId>json-smart</artifactId>
                <version>2.3</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

Exactly, it works for me, When quote the extact version, and exclude this depdnency from the other referred dependencies, like msl4j, springOAuth etc.,

Closes gh-44238

jonaskoelker-jypo · 2025-02-12T15:12:54Z

I discovered that 2.5.2 isn't the only version available, but it is the only version in the metadata, so if you specify an older version exactly it will work

I can confirm this: I have an SBT project with the dependency line "net.minidev" % "json-smart" % "2.4.9" and I don't have this problem.

If I delete this line and remove "MuleSoft" at "https://repository.mulesoft.org/nexus/content/repositories/public/" from my list of resolvers the problem starts happening. (You might also need to delete json-smart from your local resolver caches.)

This suggests yet another workaround to investigate: add MuleSoft to your list of resolvers.

ackjui · 2025-02-12T15:31:30Z

To try and fix these issues once and for all, I'm starting the final migration from s01.oss.sonatype.org to central.sonatype.com, so I won't have to do it again in 5 or 10 years.

I believe this is done to provide all versions in the maven central, but how much time it takes to publish? Build is still failing for me.

@arthurc @UrielCh

airvine-r7 · 2025-02-12T15:31:59Z

Have people been able to verify for sure this new release fixes the CVE? My snyk scan is still showing the the vuln exists for this version but i'm presuming that is likely due to snyk not being fully up-to-date with the patch version.

hughpv · 2025-02-12T15:36:40Z

I am seeing all the versions at https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml now.

I just took out the resolutionStrategy workaround and my project builds successfully, but it may just be that my cache is happy. Can others confirm?

ackjui · 2025-02-12T15:49:20Z

It's published now and working for us. No change done at our end.

hezhangjian · 2025-02-12T16:11:21Z

maven-metadata.xml might be updated by central support. They reply an email to me and @UrielCh
I think we can close this issue, feel free to comment if still have problems.

from:	Support <[email protected]>
reply-to:	Support <[email protected]>
to:	Zhangjian He <[email protected]>
cc:	Uriel Chemouni <[email protected]>
date:	Feb 12, 2025, 11:36 PM
subject:	[Central Support by Sonatype] Re: Inquiry About JsonSmart Maven Metadata Versioning
mailed-by:	sonatype.com

We believe that we have successfully addressed all of the issues with the net.minidev namespace's maven-metadata.xml files. Please let us know if there are still outstanding issues.
 
Thank you,
The Central Team

siladu · 2025-02-13T00:42:38Z

Thanks for the quick turnaround @hezhangjian and @UrielCh - much appreciated!

siladu mentioned this issue Feb 12, 2025

Hotfix for gradle compile issue by locking in json-smart version hyperledger/besu#8282

Merged

hezhangjian mentioned this issue Feb 12, 2025

Expected release date for 2.5.2? #236

Closed

marcelstoer mentioned this issue Feb 12, 2025

fix CVE-2024-57699 for predefined parsers #233

Merged

leonardehrenfried mentioned this issue Feb 12, 2025

Update azure-identity to fix build opentripplanner/OpenTripPlanner#6456

Merged

squakez mentioned this issue Feb 12, 2025

feat(components): add camel-telemetry component apache/camel#16949

Merged

4 tasks

squakez added a commit to squakez/camel that referenced this issue Feb 12, 2025

fix(ci): missing dependency workaround

8f558e5

Ref netplex/json-smart-v2#240

squakez added a commit to squakez/camel that referenced this issue Feb 12, 2025

fix(ci): missing dependency workaround

872f783

Ref netplex/json-smart-v2#240

squakez mentioned this issue Feb 12, 2025

fix(ci): missing dependency workaround apache/camel#17132

Merged

4 tasks

squakez added a commit to apache/camel that referenced this issue Feb 12, 2025

fix(ci): missing dependency workaround

f12f626

Ref netplex/json-smart-v2#240

dbes-gds added a commit to govuk-one-login/authentication-api that referenced this issue Feb 12, 2025

BAU: INC0014151 json-smart maven breakage

Loading
Loading status checks…

4387432

Force resolution to an available version. netplex/json-smart-v2#240

dbes-gds mentioned this issue Feb 12, 2025

DONOTMERGE: BAU: INC0014151 json-smart maven breakage govuk-one-login/authentication-api#5934

Closed

3 tasks

FANNG1 mentioned this issue Feb 12, 2025

[HOTFIX] fix compile paimon error by broken maven version for net.minidev:json-smart apache/gravitino#6442

Closed

pdurbin mentioned this issue Feb 12, 2025

Could not find artifact net.minidev:json-smart:jar:2.3 IQSS/dataverse#11248

Closed

jeffkni referenced this issue in spring-projects/spring-boot Feb 12, 2025

Upgrade to Json-smart 2.5.2

d4ad8f5

Closes gh-44238

amkCha mentioned this issue Feb 12, 2025

hotfix: temp dependency conflict Consensys/linea-tracer#1801

Merged

hezhangjian closed this as completed Feb 12, 2025

hezhangjian unpinned this issue Feb 12, 2025

matthew1001 mentioned this issue Feb 12, 2025

Fix previous hotfix which pinned library to an old version kaleido-io/besu#19

Merged

pkubowicz mentioned this issue Feb 12, 2025

Corrupt serialized resolution result/Problems reading from Binary store when executing dependencies tasks or build scans gradle/gradle#14220

Open

coderabbitai bot mentioned this issue Feb 12, 2025

[RORDEV-1394] CVE-2024-57699 CVE-2025-25193 CVE-2025-24970 sscarduzio/elasticsearch-readonlyrest-plugin#1075

Merged

jonesbusy mentioned this issue Feb 13, 2025

Bump json-smart.version from 2.5.1 to 2.5.2 jenkinsci/json-path-api-plugin#75

Merged

OndroMih mentioned this issue Feb 13, 2025

Fixed potential NPE in ServiceLoader class eclipse-ee4j/glassfish-hk2-extra#144

Merged

2.5.2 Release Breaking Upstream Dependencies #240

2.5.2 Release Breaking Upstream Dependencies #240

Comments

siladu commented Feb 12, 2025 • edited Loading

hezhangjian commented Feb 12, 2025

strangeundersun commented Feb 12, 2025

Dristand commented Feb 12, 2025 • edited Loading

ijioio commented Feb 12, 2025

Ramnathpraveen-G commented Feb 12, 2025

jabouchleih commented Feb 12, 2025

fugary commented Feb 12, 2025 • edited Loading

ijioio commented Feb 12, 2025

thewisenerd commented Feb 12, 2025

ijioio commented Feb 12, 2025 • edited Loading

shyvum commented Feb 12, 2025 • edited Loading

ArloL commented Feb 12, 2025 • edited Loading

cbertoldi commented Feb 12, 2025

renoth commented Feb 12, 2025

leonardehrenfried commented Feb 12, 2025

prawilny commented Feb 12, 2025 • edited Loading

Alf-Melmac commented Feb 12, 2025

ArloL commented Feb 12, 2025 • edited Loading

cbertoldi commented Feb 12, 2025

UrielCh commented Feb 12, 2025

leonardehrenfried commented Feb 12, 2025

Vicferron commented Feb 12, 2025

cbertoldi commented Feb 12, 2025 • edited Loading

lir2002 commented Feb 12, 2025

UrielCh commented Feb 12, 2025

arthurc commented Feb 12, 2025

fctaddia commented Feb 12, 2025

mikesouthron commented Feb 12, 2025

fctaddia commented Feb 12, 2025

jeevangali-agi commented Feb 12, 2025

jonaskoelker-jypo commented Feb 12, 2025

ackjui commented Feb 12, 2025

airvine-r7 commented Feb 12, 2025

hughpv commented Feb 12, 2025 • edited Loading

ackjui commented Feb 12, 2025 • edited Loading

hezhangjian commented Feb 12, 2025 • edited Loading

siladu commented Feb 13, 2025

siladu commented Feb 12, 2025 •

edited

Loading

Dristand commented Feb 12, 2025 •

edited

Loading

fugary commented Feb 12, 2025 •

edited

Loading

ijioio commented Feb 12, 2025 •

edited

Loading

shyvum commented Feb 12, 2025 •

edited

Loading

ArloL commented Feb 12, 2025 •

edited

Loading

prawilny commented Feb 12, 2025 •

edited

Loading

ArloL commented Feb 12, 2025 •

edited

Loading

cbertoldi commented Feb 12, 2025 •

edited

Loading

hughpv commented Feb 12, 2025 •

edited

Loading

ackjui commented Feb 12, 2025 •

edited

Loading

hezhangjian commented Feb 12, 2025 •

edited

Loading