Spring Boot 2.4 dependency conflict

[adamzr]

This library uses com.nimbusds:oauth2-oidc-sdk:7.4. Spring Boot version 2.4 manages that dependency to version 8.23.1. See https://docs.spring.io/spring-boot/docs/current/reference/html/appendix-dependency-versions.html#dependency-versions-coordinates:~:text=oauth2%2Doidc%2Dsdk

This means that if you try and use this library in a Spring Boot 2.4 project you get an error at runtime, since Maven will choose the newer version.

Please upgrade this dependency.

Thanks!

[SomkaPe]

Adam Richeimer (@adamzr) Could you please provide details about runtime error ?

[adamzr]

java.lang.ClassNotFoundException: com.nimbusds.oauth2.sdk.http.CommonContentTypes

[MBurchard]

com.microsoft.graph.core.ClientException: Error during http request
	at com.microsoft.graph.http.CoreHttpProvider.sendRequestInternal(CoreHttpProvider.java:471) ~[microsoft-graph-2.3.2.jar:na]
	at com.microsoft.graph.http.CoreHttpProvider.send(CoreHttpProvider.java:220) ~[microsoft-graph-2.3.2.jar:na]
	at com.microsoft.graph.http.CoreHttpProvider.send(CoreHttpProvider.java:200) ~[microsoft-graph-2.3.2.jar:na]
	at com.microsoft.graph.http.BaseCollectionRequest.send(BaseCollectionRequest.java:92) ~[microsoft-graph-2.3.2.jar:na]
	at com.microsoft.graph.requests.extensions.UserCollectionRequest.get(UserCollectionRequest.java:71) ~[microsoft-graph-2.3.2.jar:na]
	at com.uniper.cimapp.services.MSGraphServiceClient.lambda$getUsers$3(MSGraphServiceClient.java:95) ~[main/:na]
	at com.uniper.cimapp.services.MSGraphServiceClient.sendRequest(MSGraphServiceClient.java:143) ~[main/:na]
	at com.uniper.cimapp.services.MSGraphServiceClient.sendRequest(MSGraphServiceClient.java:176) ~[main/:na]
	at com.uniper.cimapp.services.MSGraphServiceClient.getUsers(MSGraphServiceClient.java:94) ~[main/:na]
	at com.uniper.cimapp.services.UserService.loadCompaniesFromUsers(UserService.java:238) ~[main/:na]
	at org.springframework.security.concurrent.DelegatingSecurityContextRunnable.run(DelegatingSecurityContextRunnable.java:82) ~[spring-security-core-5.4.1.jar:5.4.1]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[na:na]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[na:na]
	at java.base/java.lang.Thread.run(Thread.java:834) ~[na:na]
Caused by: java.util.concurrent.CompletionException: java.lang.NoClassDefFoundError: com/nimbusds/oauth2/sdk/http/CommonContentTypes
	at java.base/java.util.concurrent.CompletableFuture.encodeThrowable(CompletableFuture.java:314) ~[na:na]
	at java.base/java.util.concurrent.CompletableFuture.completeThrowable(CompletableFuture.java:319) ~[na:na]
	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run$$$capture(CompletableFuture.java:1702) ~[na:na]
	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java) ~[na:na]
	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.exec(CompletableFuture.java:1692) ~[na:na]
	at java.base/java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:290) ~[na:na]
	at java.base/java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1020) ~[na:na]
	at java.base/java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1656) ~[na:na]
	at java.base/java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1594) ~[na:na]
	at java.base/java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:177) ~[na:na]
Caused by: java.lang.NoClassDefFoundError: com/nimbusds/oauth2/sdk/http/CommonContentTypes
	at com.microsoft.aad.msal4j.TokenRequestExecutor.createOauthHttpRequest(TokenRequestExecutor.java:46) ~[msal4j-1.8.0.jar:1.8.0]
	at com.microsoft.aad.msal4j.TokenRequestExecutor.executeTokenRequest(TokenRequestExecutor.java:36) ~[msal4j-1.8.0.jar:1.8.0]
	at com.microsoft.aad.msal4j.AbstractClientApplicationBase.acquireTokenCommon(AbstractClientApplicationBase.java:119) ~[msal4j-1.8.0.jar:1.8.0]
	at com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier.execute(AcquireTokenByAuthorizationGrantSupplier.java:63) ~[msal4j-1.8.0.jar:1.8.0]
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:59) ~[msal4j-1.8.0.jar:1.8.0]
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:17) ~[msal4j-1.8.0.jar:1.8.0]
	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run$$$capture(CompletableFuture.java:1700) ~[na:na]
	... 7 common frames omitted
Caused by: java.lang.ClassNotFoundException: com.nimbusds.oauth2.sdk.http.CommonContentTypes
	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:581) ~[na:na]
	at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178) ~[na:na]
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522) ~[na:na]
	... 14 common frames omitted

[MBurchard]

Gradle task dependencies...

+--- com.microsoft.azure:msal4j:1.8.0
|    +--- com.nimbusds:oauth2-oidc-sdk:7.4 -> 8.23.1
|    |    +--- com.github.stephenc.jcip:jcip-annotations:1.0-1
|    |    +--- com.nimbusds:content-type:2.1
|    |    +--- net.minidev:json-smart:[1.3.1,2.3] -> 2.3
|    |    |    \--- net.minidev:accessors-smart:1.2
|    |    |         \--- org.ow2.asm:asm:5.0.4
|    |    +--- com.nimbusds:lang-tag:1.4.4
|    |    \--- com.nimbusds:nimbus-jose-jwt:8.18 -> 9.1.2
|    |         \--- com.github.stephenc.jcip:jcip-annotations:1.0-1
|    +--- org.slf4j:slf4j-api:1.7.28 -> 1.7.30
|    \--- com.fasterxml.jackson.core:jackson-databind:2.10.1 -> 2.11.3 (*)

[adamzr]

SomkaPe Is this info sufficient?

[SomkaPe]

Adam Richeimer (@adamzr) Martin Burchard (@MBurchard) thank you for providing details, version will be changed in next release

[henrik-me]

Per discussion. Will update deprecated dependencies.

[davidkarlsen]

Adam Richeimer (@adamzr) Martin Burchard (@MBurchard) thank you for providing details, version will be changed in next release

Any rough ETA on that?

[Avery-Dunn]

Hello David J. M. Karlsen (@davidkarlsen) : I made this PR #322 to take care of this issue (pretty much just removed the use of the file causing issues as a quick fix), and this will be released by the end of the week.

[Avery-Dunn]

Adam Richeimer (@adamzr) and Martin Burchard (@MBurchard) : Sorry for the long delay, but the newest version of the library (1.8.1) has been released and should solve the issue you were having.

David J. M. Karlsen (@davidkarlsen) : Hey, I saw your comment on this PR #322 about an issue with one of the Nimbus SDK's JSON methods. That part of the dependency is unrelated to the one in that PR or this thread, so it may be an unrelated issue.

What version of the Nimbus SDK is your environment using? I haven't been able to recreate your issue with either the version the library uses (7.4) or the one mentioned in this thread (8.23), and the Nimbus SDK doesn't seem to have had any changes to that method for a while, so you may want to make a separate thread for the issue you're having.

[adamzr]

Avery-Dunn Thank you very much! Dependabot just made a PR to my project with your update.