Critical: Missing Guava in graphql-java 19.7 Causing Service Failures

Describe the bug
There appears to be an issue with graphql-java version 19.7 related to the way it handles the guava dependency.

In version 19.6, guava was bundled within the JAR. However, in 19.7, it's absent. Is this intentional?

Additioanlly, both the POMs for 19.6 and 19.7 are identical (apart from the library version), suggesting a reliance on the packaged version of the dependency in the META-INF of the library.

Adding the guava dependency directly leads to a type mismatch errors all over the place even when the exact version indicated for guava in graphql-java's build.gradle is provided.

This surfaced in our org in a rather nasty way yesterday, as a number of services automatically upgraded to the next minor version bump, but are now in a broken state because graphql-java complains that guava is non existent.

The solution is to pin graphql-java to 19.6, but because other libraries, e.g. DGS, Apollo jvm, rely on graphql-java, pinning can result in other unintended side-effects. We will do it in the meantime to unblock services, but can anyone comment as to why guava was removed from the 19.7 JAR file?

** To Reproduce **

Observe that the 19.6 JAR has guava bundled within.
In contrast, the 19.7 JAR does not.

@samjcombs

Our DGS/Apollo projects are also broken since yesterday.

graphql/com/google/common/collect/ImmutableList
java.lang.NoClassDefFoundError: graphql/com/google/common/collect/ImmutableList

As suggested by @samjcombs, pinning graphql-java to version 19.6 solved the problem for us.

implementation("com.graphql-java:graphql-java:19.6")

@sullrich84

Thanks @sullrich84 for the additional context. Upon deeper investigation, we are going to pin to 19.2 instead of 19.6 to ensure maximum compatibility with our DGS and Apollo deps.

thanks for the quick feedback everybody ... we will look into it as soon as possible. In the meantime just use the previous bugfix release as already suggested.

Thanks!

Notes for the graphql-java team but also in the spirit of open source.

I didn't think we bundled Guava at all in its original form. I thought we shaded it into our own package for the classes we use, namely the Immutable collection classes (and support code)

If I recall right , then nominally we shouldn't have any com.google.* in our code base at all. Did we upgrade gradle at some point and start to "unshade" good into the code base and then consumers started to depend on it

We will want to look through versions and see when we started to provide guava classes in com.google form...

The old code intent is that it gets shaded like this to graphql.com.google.common

shadowJar {
    minimize()
    archiveClassifier.set('')
    configurations = [project.configurations.compileClasspath]
    relocate('com.google.common', 'graphql.com.google.common') {
        include 'com.google.common.collect.*'
        include 'com.google.common.base.*'
        include 'com.google.common.math.*'
        include 'com.google.common.primitives.*'
    }
    relocate('org.antlr.v4.runtime', 'graphql.org.antlr.v4.runtime')
    dependencies {
        include(dependency('com.google.guava:guava:32.1.2-jre'))
        include(dependency('org.antlr:antlr4-runtime:' + antlrVersion))
    }

Lets have a look at old versions and see whats going on

Affected versions

Version	has `graphql.com.google.common`
17.0	✅
17.6	✅

18.0	✅
18.7	✅

19.0	✅
19.4	✅
19.5	✅
19.6	✅
19.7	❌

20.0	✅
20.4	✅
20.5	❌

21.0	✅

Its seems that the the latest master builds are also producing jars without the shaded google code.

master builds look fine to me

$ wget https://repo1.maven.org/maven2/com/graphql-java/graphql-java/0.0.0-2023-09-01T02-27-18-c14a72f/graphql-java-0.0.0-2023-09-01T02-27-18-c14a72f.jar
$ tar -tvf "graphql-java-0.0.0-2023-09-01T02-27-18-c14a72f.jar" | grep "graphql/com/google" | wc -l
   901

To me it looks like the guava versions are out of sync between the dependency declaration (com.google.guava:guava:32.0.0-jre) and the shadow configuration (com.google.guava:guava:32.1.1-jre). This is the case on both 20.x and 19.x branches. Aligning the versions and building the jar locally fixes things for me.

It's really easy to make such a typo, so maybe turning that version into a variable or refactoring all of those into a version catalog.

Thanks everyone for reporting the issue and helping us to debug. I have started the release process for v20.6 and v19.8 which will fix the problem. It will land in Maven shortly.

Confirming both v19.8 and v20.6 have landed in Maven and we triple checked the JARs to verify that Guava is shaded.

https://repo1.maven.org/maven2/com/graphql-java/graphql-java/19.8/
https://repo1.maven.org/maven2/com/graphql-java/graphql-java/20.6/

Navigation Menu

Repository navigation

Critical: Missing Guava in graphql-java 19.7 Causing Service Failures #3318

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Critical: Missing Guava in graphql-java 19.7 Causing Service Failures #3318

Description

Activity

sullrich84 commented on Sep 1, 2023

samjcombs commented on Sep 1, 2023

andimarek commented on Sep 1, 2023

bbakerman commented on Sep 2, 2023

bbakerman commented on Sep 2, 2023

bclozel commented on Sep 2, 2023

dondonz commented on Sep 4, 2023

dondonz commented on Sep 4, 2023

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions