SLF4J API dependency conflict

[marschall]

spring-boot-dependencies:2.5.6 includes HikariCP:4.0.3 and slf4j:1.7.32. I believe this is a conflict because on JDK 11 HikariCP:4.0.3 depends on slf4j:2.0.0-alpha1 https://github.com/brettwooldridge/HikariCP/blob/HikariCP-4.0.3/pom.xml#L605. It currently seems to work by chance as HikariCP does not yet seem to call any new API.

Note that HikariCP:4.0.3 is outdated and in maintenance mode, the current version is HikariCP:5.0.0 which requires JDK 11.

A reproducer can be found here: https://github.com/marschall/hikari-dependencies

Screenshot from m2eclipse:

[snicoll]

I believe this is a conflict because on JDK 11 HikariCP:4.0.3 depends on slf4j:2.0.0-alpha1

I am not sure I am following what you're reporting or what we could do here about it. A few lines above, you can see that the Java 8 profile is using slf4j 1.7.30.

Note that HikariCP:4.0.3 is outdated and in maintenance mode, the current version is HikariCP:5.0.0 which requires JDK 11.

We are aware and Spring Boot is still Java 8-based so we can't offer this version by default at the moment.

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

[marschall]

I am not sure I am following what you're reporting or what we could do here about it.

You could either remove HikariCP from Spring Boot dependencies or upgrade Spring Boot dependencies to slf4j:2.0.0-alpha1. These options would ensure there are no conflicting dependencies.

A few lines above, you can see that the Java 8 profile is using slf4j 1.7.30.

Yes, but but HikariCP could be using a Multi-Release JAR file that makes use of SLF4J 2+ API on JDK 11+. It isn't for now.

Note that HikariCP:4.0.3 is outdated and in maintenance mode, the current version is HikariCP:5.0.0 which requires JDK 11.

We are aware and Spring Boot is still Java 8-based so we can't offer this version by default at the moment.

Couldn't you do the same thing that HikariCP does and offer a JDK 11+ profile that uses HikariCP 5+ on JDK 11+?

[wilkinsona]

Thanks for raising this but the underlying reason for raising this issue seems to be based on a theoretical problem that won't occur in practice.

It currently seems to work by chance

As far as I know, it is not by chance. AIUI, 2.0.0-alpha1 is used purely for its improved JPMS compatibility. Hikari does not make use of any API that is new in 2.0. This is verified via the profile in Hikari's own build which uses SLF4J 1.7

We'll upgrade to Hikari 5 in Spring Boot 3 when we'll also raise of JDK baseline to 17. In the meantime, you may be able to use Hikari 5 with Spring Boot 2.x if it contains a new feature or performance improvement which is of interest to you.