Using v2 and v3 BOMs results in ambiguous version management of jackson-annotations

[mattnelson]

Using v2 and v3 BOMs together results in ambiguous version management of jackson-annotations. The BOM listed higher "wins", which when coupled with the requireUpperBoundDeps enforcer rule causes thrashing as each are released independently.

2.22.0

jackson-bom/pom.xml

Line 62 in 112e859

<jackson.version.annotations>2.22</jackson.version.annotations>

3.1.4

jackson-bom/pom.xml

Line 60 in 4085e4d

<jackson.version.annotations>2.21</jackson.version.annotations>

Rule 0: org.apache.maven.enforcer.rules.dependency.RequireUpperBoundDeps failed with message:
Failed while enforcing RequireUpperBoundDeps. The error(s) are [
Require upper bound dependencies error for com.fasterxml.jackson.core:jackson-annotations:2.21 [test] paths to dependency are:
+-myGroup:myArtifact:1.0.0-SNAPSHOT
  +-com.fasterxml.jackson.core:jackson-annotations:2.21 [test]
and
+-myGroup:myArtifact:1.0.0-SNAPSHOT
  +-com.fasterxml.jackson.core:jackson-databind:2.22.0 [test]
    +-com.fasterxml.jackson.core:jackson-annotations:2.21 [test] (managed) <-- com.fasterxml.jackson.core:jackson-annotations:2.22 [test]
]

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>com.fasterxml.jackson</groupId>
            <artifactId>jackson-bom</artifactId>
            <version>2.22.0</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
        <dependency>
            <groupId>tools.jackson</groupId>
            <artifactId>jackson-bom</artifactId>
            <version>3.1.4</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
  </dependencies>
</dependencyManagement>

---

Current workarounds

• Evaluate and reorder BOMs on every version bump to determine which should be first.
• Manage jackson-annotations explicitly.

Possible solution

• Create a combined BOM that include v2 and v3.
• Sync up v2/v3 releases to minimize divergence.

[cowtowncoder]

Using higher version of jackson-annotations is what should occur, if both 2.x and 3.x boms are used.
That is meant to be safe, given both 2.x and 3.x depend on 2.x annotations (there is no 3.x version).

I am not sure what syncing up v2/v3 releases would mean in this context.

[mattnelson]

Using higher version of jackson-annotations is what should occur, if both 2.x and 3.x boms are used. That is meant to be safe, given both 2.x and 3.x depend on 2.x annotations (there is no 3.x version).

Maven's dep mgmt resolution order makes this a bit more complicated when using both BOMs and they have different managed versions of annotations that "conflict" with each other. dependencyManagment is how to say which one "wins", but in the case of import BOMs you'd have to inspect each one and which ever currently has the higher version of annotations would need to be ordered first.

Or if you don't want to inspect on each version bump, manage annotations yourself. But this kinda defeats the point of deferring jackson dep mgmt to the BOMs.

<dependencyManagement>
    <dependencies>
        <dependency>
            <!-- when using both BOMs, manage annotations yourself -->
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-annotations</artifactId>
            <version>2.22</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson</groupId>
            <artifactId>jackson-bom</artifactId>
            <version>2.22.0</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
        <dependency>
            <groupId>tools.jackson</groupId>
            <artifactId>jackson-bom</artifactId>
            <version>3.1.4</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
  </dependencies>
</dependencyManagement>

I am not sure what syncing up v2/v3 releases would mean in this context.

My thought was that for consumers that use both BOMs, if they were both kept in sync on annotations version and released in a shorter window to each other it would reduce the amount of time in which the latest version of each BOM disagreed with each other on which version of annotations to use.

[cowtowncoder]

Yeah it gets tricky: 2.x and 3.x boms need to be somewhat loosely coupled by intent -- neither relies on the other -- but they do "share" jackson-annotations. And it def makes sense NOT to have to separately manage that dependency.

Not sure what could be done on short term but leaving open for now.

[megfigura]

Just fyi, for me, this manifested as an error at runtime:

java.lang.NoClassDefFoundError: com/fasterxml/jackson/annotation/JsonApplyView
        at tools.jackson.databind.introspect.JacksonAnnotationIntrospector.findApplyView(JacksonAnnotationIntrospector.java:556)
        at tools.jackson.databind.introspect.POJOPropertyBuilder.findApplyView(POJOPropertyBuilder.java:830)
        at tools.jackson.databind.ser.PropertyBuilder.buildWriter(PropertyBuilder.java:249)
...
Caused by: java.lang.ClassNotFoundException: com.fasterxml.jackson.annotation.JsonApplyView
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
        at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)
        ... 21 more

...because I had a slightly older 2.x BOM listed before the latest 3.x BOM.

Sorry, wish I had an idea for a fix.

[cowtowncoder]

@megfigura Right, that is unfortunate (@JsonApplyView added in annotations 2.22). Would be great if there was a way to merge BOM definition with "later one wins" but I don't think there is.

[mattnelson]

Create a combined BOM that include v2 and v3.

How about a new uber bom? The example has it with the j2 GAV because at some future point when j2 is EOL, then this BOM also goes away. Being a new BOM would also have to be opted into case by case, which means they accept that the version of annotations managed by this new BOM may differ from the highest version individually from j2/j3 BOMs

<project>
  <groupId>com.fasterxml.jackson</groupId>
  <artifactId>jackson-uber-bom</artifactId>
  <version>2.22.0</version>
  <properties>
      <properties>
    <jackson2.version>2.22.0</jackson2.version>
    <jackson3.version>3.2.0</jackson3.version>
    <jackson.version.annotations>2.22</jackson.version.annotations>
  </properties>
    <dependencyManagement>
        <dependencies>
            <dependency>
                <!-- since annotations is shared, list it first -->
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-annotations</artifactId>
                <version>2.22</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${jackson2.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>tools.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${jackson3.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
</project>