Maven dependency convergence issue

[FlattestGuitar]

Maven Enforcer will flag the yubico:webauthn package because of conflicting versions of its dependencies. This will make many pipelines out there fail without a patchwork fix.

[WARNING] 
Dependency convergence error for com.github.peteroupc:numbers:0.2.1 paths to dependency are:
 +-com.yubico:webauthn-server-core:1.3.0
   +-com.augustcellars.cose:cose-java:0.9.4
     +-com.upokecenter:cbor:2.4.1
       +-com.github.peteroupc:numbers:0.2.1
and
 +-com.yubico:webauthn-server-core:1.3.0
   +-com.augustcellars.cose:cose-java:0.9.4
     +-com.github.peteroupc:numbers:0.3.0

A potential fix would be excluding the peteroupc:numbers package from one of the modules, but I don't know much about maven, so maybe there's a better solution?

[emlun]

Thanks for the report! Looks like this is an issue with the transitive dependencies from cose-java. I'm also not familiar with Maven Enforcer, but maybe this can be resolved by bumping the dependency version.

[emlun]

@FlattestGuitar Does 1.4.0-RC2 fix this?

[FlattestGuitar]

Sorry for the late response. I tried to test it but I'm having some trouble building my project.

Error:(4, 1) java: cannot access com.yubico.internal.util.json.JsonStringSerializable
class file for com.yubico.internal.util.json.JsonStringSerializable not found

That (4,1) points to one of my static imports:
import static com.yubico.webauthn.data.PublicKeyCredentialType.PUBLIC_KEY;.

Is this my fault or yours? 🤔

[emlun]

That looks like the dependency com.yubico:yubico-util is missing. Which is strange, because it should be resolved automatically by the build system...

[ralscha]

The problem is that yubico-util is defined with scope runtime, thus not available at compile time.
In version 1.3.0 this dependency has a scope of compile

    <dependency>
      <groupId>com.yubico</groupId>
      <artifactId>yubico-util</artifactId>
      <version>1.4.0</version>
      <scope>runtime</scope>
    </dependency>

Workaround is to add yubico-util to your project's pom.xml without the scope

    <dependency>
      <groupId>com.yubico</groupId>
      <artifactId>yubico-util</artifactId>
      <version>1.4.0</version>
    </dependency>

[FlattestGuitar]

Thanks @ralscha, that worked.

Unfortunately on version 1.4.0 I'm getting the same error but for a different dep:

Dependency convergence error for com.upokecenter:cbor:3.4.0 paths to dependency are:
+-MY MODULE
  +-com.yubico:webauthn-server-core:1.4.0
    +-com.augustcellars.cose:cose-java:0.9.10
      +-com.upokecenter:cbor:3.4.0
and
+-MY MODULE
  +-com.yubico:yubico-util:1.4.0
    +-com.upokecenter:cbor:2.4.1```

[emlun]

Ok, I think I see what's going on with that classpath issue. Between 1.3.0 and 1.4.0 I upgraded to using Gradle's new dependency API that separates between API and implementation dependencies. The internal dependencies were previously defined in the compile configuration - since this project needs them to compile - which meant they also bled into the compile classpath of downstream projects depending on this library. Now, instead, they are declared as compile dependencies for the library and only as runtime dependencies of dependent projects since dependent projects don't need them to compile.

What part of the build hit that class file for com.yubico.internal.util.json.JsonStringSerializable not found error? Was it the normal compile step, or some introspection plugin like enforcer?

[FlattestGuitar]

It was definitely a part of the normal compilation.

[emlun]

Ok, I'll see if I can reproduce the issue.

[ralscha]

In my application

com.yubico.webauthn.data.ByteArray.getBytes()

throws the error during compilation.

 cannot access com.yubico.internal.util.json.JsonStringSerializable
  class file for com.yubico.internal.util.json.JsonStringSerializable not found

It only works when yubico-util is on the compile classpath.

[ralscha]

Make sense that PublicKeyCredentialType also throws this error because it implements JsonStringSerializable like ByteArray

[emlun]

Ok, looks like the compilation issue is specific to Kotlin. The following code works fine in a Java project depending on 1.4.0:

    @Test
    public void instantiateStuff() {
        ByteArray a = new ByteArray(new byte[] {1, 2, 3, 4});
        System.out.println(a);

        PublicKeyCredentialType b = PublicKeyCredentialType.PUBLIC_KEY;
        System.out.println(b);
    }

but the following does not work in a Kotlin project with equivalent setup:

    @Test fun byteArray() {
        val a = com.yubico.webauthn.data.ByteArray(byteArrayOf(1, 2, 3, 4))
        println(a)
        val b = PublicKeyCredentialType.PUBLIC_KEY
        println(b)
    }

It does work with 1.3.0, though.

I guess I'll have to revert the "upgrade" to the new Gradle API, then.

[ralscha]

For me the compiler error occurs in a Java application

[FlattestGuitar]

@emlun try to turn that PUBLIC_KEY into a static import or do a.getBytes(). It should fail on both counts. I'm not sure how Java works all this out (I'm new to this D:), but it seems to be unable to actually access that class somehow.

In your Kotlin code you use byteArrayOf(), a method that would likely also cause a failure if you used it in your Java code.