Skip to content

Critical: Missing Guava in graphql-java 19.7 Causing Service Failures #3318

@samjcombs

Description

@samjcombs

Describe the bug
There appears to be an issue with graphql-java version 19.7 related to the way it handles the guava dependency.

In version 19.6, guava was bundled within the JAR. However, in 19.7, it's absent. Is this intentional?
image

Additioanlly, both the POMs for 19.6 and 19.7 are identical (apart from the library version), suggesting a reliance on the packaged version of the dependency in the META-INF of the library.
image

Adding the guava dependency directly leads to a type mismatch errors all over the place even when the exact version indicated for guava in graphql-java's build.gradle is provided.

image

This surfaced in our org in a rather nasty way yesterday, as a number of services automatically upgraded to the next minor version bump, but are now in a broken state because graphql-java complains that guava is non existent.

The solution is to pin graphql-java to 19.6, but because other libraries, e.g. DGS, Apollo jvm, rely on graphql-java, pinning can result in other unintended side-effects. We will do it in the meantime to unblock services, but can anyone comment as to why guava was removed from the 19.7 JAR file?

** To Reproduce **

Observe that the 19.6 JAR has guava bundled within.
In contrast, the 19.7 JAR does not.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions