Usage of Spring Data Redis 1.7.1 which has critical bug https://jira.spring.io/browse/DATAREDIS-502

[mumukiller]

Hi,

Spring Session uses Spring Data Redis 1.7.1 which has critical bug already fixed in 1.7.3 https://jira.spring.io/browse/DATAREDIS-502

I haven't seen any related pull requests for 1.4.0 M1. Are there any plans to update Spring Data Redis?

P.S. I do not know gradle well but i suppose that "springDataReleaseTrainVersion=Kay-BUILD-SNAPSHOT" means that current master branch points to the latest Spring Data Redis version 2.0 M3 (Kay). If so is it possible to have Snapshot of Spring Session which uses 2.0 M3 (Kay)?

[jxblum]

For Spring Session 1.4.x (next is 1.4.0.M1), Spring Data Redis has already been updated to 1.8.0.RC1. This should probably be updated to the latest version of SD Redis on the 1.8.x line (currently, 1.8.3.RELEASE).

For Spring Session master (next is 2.0.0.M1), Spring Data Redis has been updated to Spring Data Kay, which includes the latest, Spring Data Redis 2.0.0. Spring Session 2.0 has been rebased on the SD Release Train (going forward) to keep all SD modules from the SD Release Train (namely, SD GemFire, SD MongoDB and SD Redis) in sync and up-to-date. Repositories supported by Spring Session that are not part of the SD Release Train (as they are public modules, e.g. Hazelcast) is not subject to the same in-sync updates, so must be maintained separately. The other reason Spring Session (as of 2.0) has been sync'd with the SD Release Train is because Spring Session is also pulled in by Spring Boot, which also has a dependency on the SD Release Train, and, as of Spring Session 2, which is based on Spring Boot 2, both are based on SD Kay.

As for Spring Session 1.3.x (next is .1.3.1.RELEASE), Spring Session will stay fixed on SD Redis 1.7.x, but will be updated to the latest maintenance releases. For SD Redis, that is currently 1.7.10.RELEASE. And, as you can see from DATAREDIS-502, this issue was fixed in SD Redis 1.7.3.RELEASE (Hopper SR3).

I will make the necessary updates.

Cheers,
John

[jxblum]

Damn it! Now, I remember why Spring Session 1.3.x could not be upgraded beyond Spring Data Redis 1.7.1.RELEASE. Test failures (a method used by SDR was removed in core Spring)...

org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfigurationTests > resolveValue FAILED
    org.springframework.beans.factory.UnsatisfiedDependencyException at RedisHttpSessionConfigurationTests.java:72
        Caused by: org.springframework.beans.factory.BeanCreationException at RedisHttpSessionConfigurationTests.java:72
            Caused by: java.lang.NoSuchMethodError at RedisHttpSessionConfigurationTests.java:72

The failure is caused by an incompatibility between the core Spring Framework
version used by Spring Session 1.3 to run Spring 3 Tests and the core Spring Framework version expected by Spring Data Redis 1.7 (indirectly determined by Spring Data Build parent, and then this).

In a nutshell... something in the way the Spring Session, Spring 3 Test Suite is invoked/ran causes this constructor to be called in versions of Spring Data Redis beyond 1.7.1.RELEASE, which then calls this constructor of the core Spring Framework's DeserializingConverter. Unfortunately that constructor does not exist in earlier versions of the core Spring Framework prior to 4.2.1.RELEASE (for example, in 4.2.0.RELEASE).

Anyway, a few of the details allude me now.

I should have remembered this since I tried to upgrade SD Redis previously on 1.3.x. I will try to dig up the earlier comments I made regarding this.

[jxblum]

Found it! The details are explained in the first half of this comment.

@rwinch will need to chime in here as to how he wants to handle this.

There are a few options...

1. (Least likely) Drop support for Spring 3 in Spring Session 1.3.x (starting from the 1.3.1.RELEASE). Core Spring Framework 3.2.x is effectively in its EOL anyway, at least there are no planned maintenance versions beyond 3.2.18.RELEASE that I am aware of.

2. Wait for Spring Session 1.4.0.M1. I have just upgraded Spring Session 1.4 to Spring Data Redis 1.8.3.RELEASE, the latest version in Spring Data Ingalls.

3. Finally, you can add an exclusion to the version (i.e. 1.7.1.RELEASE) of Spring Data Redis pulled in by Spring Session 1.3.0.RELEASE and add an explicit dependency on a later version in your application Maven POM file or Gradle build file. For example...

compile ("org.springframework.session:spring-session:1.3.0.RELEASE") {
    exclude group: "org.springframework.data", module: 'spring-data-redis'
}

compile "org.springframework.data:spring-data-redis:1.7.10.RELEASE"

You may be importing the spring-session-data-redis module, specifically. If so, you will need to switch to the dependency declarations directly above and forgo the spring-session-data-redis module. I don't foresee any problems running the latest SD Redis 1.7 with Spring Session 1.3.

[jxblum]

As further confirmation, when I set the Spring Data Redis version to "1.7.10.RELEASE" and run the Spring Session 1.3.x build...

$ gradlew clean build install -x spring3Test

NOTE: -x spring3Test effectively skips the Spring 3 compatibility testing

Then the Spring Session Test Suite passes!

...
:spring-session:install
:spring-session-data-gemfire:install
:spring-session-data-mongo:install
:spring-session-data-redis:install
:spring-session-hazelcast:install
:spring-session-jdbc:install

BUILD SUCCESSFUL

Total time: 8 mins 28.248 secs

Therefore, functionally, Spring Data Redis 1.7.10.RELEASE should work just fine with Spring Session 1.3.0.RELEASE.

Still, I cannot check in this change for Spring Session 1.3.x (for 1.3.1.RELEASE).

@rwinch, Spring Session lead, must decide how to proceed.

Thanks!

[jxblum]

Final note, both Spring Session master and 1.4.x are up-to-date as of this comment.

[mumukiller]

The option # 3 works for me. Thanks for help!