Incompatibility with Spring 4

[peltsi212]

Environment

**Liquibase Version **: 4.9.0

Liquibase Integration & Version: spring boot

Liquibase Extension(s) & Version:

Database Vendor & Version: Postgress

Operating System Type & Version: Windows 10

Description

Error when starting Spring boot 1.5 and Spring core 4.3 application with Liquibase 4.9.0
"An attempt was made to call the method org.springframework.core.io.Resource.isFile()Z but it does not exist."

Liquibase 3.5.5 was working fine

Latest level 4 Spring core 4.3.30 do not have method org.springframework.core.io.Resource.isFile
Spring core 5.0 do have this method
There is commit 2 at Oct 2020 5cc51bf
With this commit java classloader is replaced with Spring core 5.0 functionality

According documentation there is no isFile method in older Spring
https://docs.spring.io/spring-framework/docs/4.3.30.RELEASE/javadoc-api/org/springframework/core/io/Resource.html
According https://mvnrepository.com/artifact/org.liquibase/liquibase-core
There is vulnerability [CVE-2022-0839] (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0839) in older versions of liquibase

There is now need to mitigate this vulnerability in Spring 4 application.
Please add compatibility for Spring 4 to newest liquibase or implement vulnerability fix to older liquibase that is still compatible with Spring 4

Steps To Reproduce

Actual Behavior

2022-03-24 10:26:52.970 DEBUG o.s.boot.StartupInfoLogger.logStarting:51 - Running with Spring Boot v1.5.22.RELEASE, Spring v4.3.30.RELEASE
2022-03-24 10:27:53.259 INFO liquibase.logging.core.JavaLogger.log:30 - Successfully acquired change log lock
2022-03-24 10:27:53.290 INFO liquibase.logging.core.JavaLogger.log:30 - Reading from databasechangelog
2022-03-24 10:27:53.311 INFO liquibase.logging.core.JavaLogger.log:30 - Successfully released change log lock
2022-03-24 10:27:53.314 WARN o.s.c.s.AbstractApplicationContext.refresh:550 - Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'rollbackLiquibaseConfig': Invocation of init method failed; nested exception is java.lang.NoSuchMethodError: org.springframework.core.io.Resource.isFile()Z
2022-03-24 10:27:53.446 INFO org.apache.juli.logging.DirectJDKLog.log:173 - Stopping service [Tomcat]

---

APPLICATION FAILED TO START

---

Description:

An attempt was made to call the method org.springframework.core.io.Resource.isFile()Z but it does not exist. Its class, org.springframework.core.io.Resource, is available from the following locations:

jar:file:/C:/Users/tv/.m2/repository/org/springframework/spring-core/4.3.30.RELEASE/spring-core-4.3.30.RELEASE.jar!/org/springframework/core/io/Resource.class

It was loaded from the following location:

file:/C:/Users/tv/.m2/repository/org/springframework/spring-core/4.3.30.RELEASE/spring-core-4.3.30.RELEASE.jar

Action:

Correct the classpath of your application so that it contains a single, compatible version of org.springframework.core.io.Resource

Expected/Desired Behavior

Screenshots (if appropriate)

Additional Context

[Brahmaiah-Rayalla]

We are also facing same issue. Any update on this?

[kataggart]

At this time, we are currently only testing against Spring 5.3 and later (we are supporting all of the non-end-of-life versions of Spring). Are you able to upgrade to one of these versions of Spring?

[peltsi212]

Upgrade to newer version of Spring now is not possible.
It is possible to fix all other major vulnerabilities in Spring core 4.3 and related libraries.
Currently only liquibase is problematic.
If there is no fix in main product we have to consider making fork.
grunt-usemin is an example where this can lead.
There is now 351 forks in that library package.
https://github.com/yeoman/grunt-usemin

[kataggart]

@Brahmaiah-Rayalla are you able to upgrade Spring on your end? Currently we are not planing on supporting any end-of-life versions of Spring.