Flow: Problematic dependency

[heruan]

This dependency might cause serious issues with applications using the Java Mail API or Spring.

See for example this StackOverflow question.

[heruan]

Also this dependency from swagger-codegen causes dramatic issues (i.e. app not running):

Like the Mail API, there could different versions on the server (e.g. 4.7.1 for antlr-runtime).

[knoobie]

I'm wondering, is swagger-codegen really needed in flow-server at runtime or is it only used to create Vaadin Connect stuff while developing? Shouldn't this be done by the vaadin-*-plugin or in a separate module.

[Legioth]

swagger-codegen is needed at runtime in development mode since then all the processing is done separately for each redeploy rather than only as a built-time thing.

It would be great to somehow have the development mode dependencies separated from the "real" runtime dependencies, but achieving that isn't trivial with the current setup.

[knoobie]

@Legioth it would be lovely, if flow-development-mode would be a separate artifact which can be removed in the profile that activates production.

[Legioth]

Just separating the artefacts would be a good first step, but there would still be a problem with runtime conflicts during development.

A "proper" solution would be to use a separate classloader for the development mode dependencies instead of including them on the regular classpath.

[haijian-vaadin]

A workaround could be to manually exclude the mailapi dependency. For example, if it's a Vaadin spring application, you can exclude it from the vaadin-spring-boot-starter, i.e.

<dependency>
    <groupId>com.vaadin</groupId>
    <artifactId>vaadin-spring-boot-starter</artifactId>
       <exclusions>
          <exclusion>
             <groupId>javax.mail</groupId>
             <artifactId>mailapi</artifactId>
          </exclusion>
       </exclusions>
</dependency>

If it's a non Spring Vaadi application. You can exclude it from vaadin or vaadin-core in a similar manner. i.e.

<dependency>
    <groupId>com.vaadin</groupId>
    <artifactId>vaadin-core</artifactId>
       <exclusions>
          <exclusion>
             <groupId>javax.mail</groupId>
             <artifactId>mailapi</artifactId>
          </exclusion>
       </exclusions>
</dependency>

[madduci]

In addition to the exclusion that @haijian-vaadin mentioned, If you plan to use the spring-boot-starter-mailer, you need to add also these dependencies:

   <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-mail</artifactId>
      <exclusions>
        <exclusion>
          <groupId>com.sun.mail</groupId>
          <artifactId>jakarta.mail</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>com.sun.mail</groupId>
      <artifactId>smtp</artifactId>
      <version>1.6.4</version>
    </dependency>
    <dependency>
      <groupId>com.sun.mail</groupId>
      <artifactId>jakarta.mail</artifactId>
      <version>1.6.4</version>
    </dependency>
    <dependency>
      <groupId>com.sun.mail</groupId>
      <artifactId>mailapi</artifactId>
      <version>1.6.4</version>
    </dependency>

the version 2.0.0 of those dependencies cannot be used due to the change in the package name, from javax.* to jakarta.* as the Spring JavaSimpleMailer references the old package name.