Spring-boot: snakeyaml conflict with Elasticsearch 6.2.x and up

[jloisel]

Hi,

Following the discussion on: https://github.com/elastic/elasticsearch/issues/31459#event-1691229615

Apparently spring boot relies on snakeyaml 1.19, specifically on class LoaderOptions which is not present in older snakeyaml versions. That makes it difficult impossible to use Elasticsearch 6.2.x and Spring Boot 2.0.2.RELEASE and up.

I could possibly solve this issue by excluding the snakeyaml version used by Elasticsearch but that doesn't sound like a good solution to me.

I'm requesting some insight to know what should be done here.

[wilkinsona]

The first thing to be aware of is that Spring Boot 2.0 doesn't officially support Elasticsearch 6.2.x. If you want to use Spring Boot's Elasticsearch auto-configuration or Spring Data Elasticsearch, then you should use Elasticsearch 5.6.x. That said, this will become a problem in Spring Boot 2.1 where we do support Elasticsearch 6.2.x.

That makes it difficult impossible to use Elasticsearch 6.2.x and Spring Boot 2.0.2.RELEASE and up.

That shouldn't be the case as Spring Boot doesn't require SnakeYAML. If you don't use YAML files for configuration, Spring Boot shouldn't make any calls to SnakeYAML and, therefore, should work with any version of the library or without it.

I'm requesting some insight to know what should be done here.

I'm not sure that there's much we can do in Spring Boot. We already have a request to try and support 1.20+ in Boot 2.0.x but that's proving difficult due to a breaking API change in 1.20. Supporting that requirement (which, IMO, has more merit than this one as it's a more up-to-date-version) and also supporting the older version that is apparently required by Elasticsearch may not even be possible. It's quite possible that all will be able to do is to upgrade to SnakeYAML 1.20+ in Boot 2.1.

Judging by the comment on the Elasticsearch issue, it sounds like they may not have realised that you were only using the Elasticsearch client. I'd recommend politely pushing back and asking them to decouple the client from requiring an old version of SnakeYAML. It doesn't seem sustainable in the long term to keep everyone who needs to use Elasticsearch's client on an out-dated version of SnakeYAML.

In the meantime, if you want to use Elasticsearch 6.2.x with Spring Boot 2.0.x and are comfortable with the caveats mentioned above, I would recommend that you use .properties files for configuration. That should allow Boot to work with whatever version of SnakeYAML Elasticsearch's client needs. If it does not, please let us know and we can investigate.

[wilkinsona]

I'll flag this one for team attention in case anyone feels strongly that we should try to support an older version of SnakeYAML in Boot 2.0.x. My feeling is that we should close this and, until, Elasticsearch's client is compatible with up-to-date versions of SnakeYAML, .properties files should be used for Boot's configuration.

[jloisel]

Thanks for the workaround! As of now, I think i'm going to see whenever it's possible to move to .properties files instead of .yml configuration files, or simply freeze the updates until the issue is resolved.

I'm fully okay with the fact Spring Boot uses the latest SnakeYAML version along with latest Jackson version. Elasticsearch Team has also valid points regarding why they didn't moved to latest versions yet.

I guess this issue will be resolved when the points mentioned by the elastic team are either resolved by Jackson and/or SnakeYAML teams.

[wilkinsona]

We've discussed this and we don't want to add the complexity of supporting an older version of SnakeYAML.

[jloisel]

Elasticsearch should upgrade their Jackson which in effect will upgrade their SnakeYAML dependency too.