Spring-boot: org.json implementation used by spring-boot-starter-test clashes with the commonly used one

[xtreye]

spring-boot-starter-test eventually depends on non-standard org.json implementation com.vaadin.external.google:android-json which clashes with the commonly used org.json:json.

The symptom is exception

java.lang.NoSuchMethodError: org.json.JSONObject.stringToValue(Ljava/lang/String;)Ljava/lang/Object;

when XML.toJSONObject(String) is called inside a test. Production code works fine since does not depend on spring-boot-starter-test.

It is not possible to accept this and use com.vaadin.external.google:android-json implementation in a project because it has different interface and moreover lacks XML convertion functionality. Also, Spring Boot is not an Android framework to have such dependency. Thus, I consider this an bug to be fixed.

The bug is reproducible with the latest versions 1.5.2 to 1.5.4.

[xtreye]

Workaround is dependency exclusion:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-test</artifactId>
    <scope>test</scope>
    <exclusions>
        <exclusion>
            <groupId>com.vaadin.external.google</groupId>
            <artifactId>android-json</artifactId>
        </exclusion>
    </exclusions>
</dependency>

[wilkinsona]

With 1.5.4 there should have been a warning generated in the logs (see #9248). Did it not appear?

[xtreye]

Yes, it appears, now I have noticed it. The ticket you mentioned describes my issue so they could be merged.

This "The Software shall be used for Good, not Evil." conflict is a really weird stuff. Spring Boot should at least give an ability to choose the implementation. The Android lib is outdated anyway.

[wilkinsona]

Thanks for following up.

[xtreye]

NP, but I do not feel that notification about the conflict actually fixes the issue.

I have informed the author of the JSON-java: https://github.com/stleary/JSON-java/issues/353

This misconception is to be dealt with, not avoided.

[wilkinsona]

I don't think there's any misconception here. The dependency that we care about is the org.json:json the source for which is https://github.com/stleary/JSON-java. Its README says:

The license includes this restriction: "The software shall be used for good,
not evil." If your conscience cannot live with that, then choose a different
package.

Use of the JSON checker test suite makes no difference. The project's FAQ makes it clear that the licence isn't going to change.

The dependency that we use instead, com.vaadin.external.google:android-json, doesn't really have anything to do with Android. It's a clean-room reimplementation of (a relatively old version of) org.json:json. It just happens to have been written by the Android team.

The situation that we're in here is undoubtedly unfortunate, but, until other libraries more away from org.json:json, there's not much we can do.

[xtreye]

I see. So the long-term solution is to fork and develop the original library or persuade the developer that his position is not acceptable. I just wonder why nobody cares.

Thanks anyway.

[xtreye]

Sorry, I feel I have given the wrong link about the RapidJSON. My bad. As long as nothing specific this thread has, you may want to remove it at all.