Spring-boot: Prevent mysql-connector-java from pulling in an old version of protobuf-java

Created on 14 Aug 2018  路  2Comments  路  Source: spring-projects/spring-boot

Spring Boot 2.1 upgraded to MySQL Connector/J version 8, which now includes protobuf-java 2.6.0.
This older version is conflicting with Google Cloud Java APIs which depend on protobuf-java 3.6.0, but since GCJ doesn't manage the version of protobuf-java, mysql-connector-java with its protobuf-java:2.6 being closer to the root of the dependency tree, wins and breaks GCJ.

Related issues: https://github.com/spring-cloud/spring-cloud-gcp/issues/951, https://bugs.mysql.com/bug.php?id=91999

Proposed solution: Exclude protobuf-java from mysql-connector-java dependency import.

        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <optional>true</optional>
            <!-- protobuf-java:2.6.0 included by MySQL Connector J is not compatible with
                 Google Cloud Java libraries. -->
            <exclusions>
                <exclusion>
                    <groupId>com.google.protobuf</groupId>
                    <artifactId>protobuf-java</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
superseded

Most helpful comment

From the referenced MySQL bug:

This dependency is needed only when using new X DevAPI as mentioned on https://dev.mysql.com/doc/connector-j/8.0/en/connector-j-installing-classpath.html or when building the c/J 8.0 from sources. Actually, for the last case you can use protobuf 3.6 version.

So if you use only JDBC API then just don't put protobuf-java-2.6.0.jar into classpath.

Given this, I agree with @saturnism that the Protobuf dependency should probably be optional. Until that's the case, excluding it in our dependency management seems reasonable to me.

All 2 comments

From the referenced MySQL bug:

This dependency is needed only when using new X DevAPI as mentioned on https://dev.mysql.com/doc/connector-j/8.0/en/connector-j-installing-classpath.html or when building the c/J 8.0 from sources. Actually, for the last case you can use protobuf 3.6 version.

So if you use only JDBC API then just don't put protobuf-java-2.6.0.jar into classpath.

Given this, I agree with @saturnism that the Protobuf dependency should probably be optional. Until that's the case, excluding it in our dependency management seems reasonable to me.

Closing in favour of PR #14062.

Was this page helpful?
0 / 5 - 0 ratings