2.5.2 Release Breaking Upstream Dependencies

[siladu]

(Extracted from #236 (comment))

Is it correct that 2.5.2 is supposed to be the only version specified in https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml ?

This is breaking some upstream dependencies, namely oauth2-oidc-sdk which has this in its POM:

<dependency>
    <groupId>net.minidev</groupId>
    <artifactId>json-smart</artifactId>
    <version>[1.3.2,2.4.2]</version>
</dependency>

transitive via io.kubernetes:client-java

./gradlew dependencyInsight --configuration=runtimeClasspath --dependency=json-smart

> Configure project :
Generating project version as supplied is version not semver: unspecified

> Task :dependencyInsight
net.minidev:json-smart:[1.3.2,2.4.2] FAILED
   Failures:
      - Could not find any version that matches net.minidev:json-smart:[1.3.2,2.4.2].
        Versions that do not match: 2.5.2
        Searched in the following locations:
          - https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml

net.minidev:json-smart:[1.3.2,2.4.2] FAILED
\--- com.nimbusds:oauth2-oidc-sdk:9.4
     \--- com.microsoft.azure:adal4j:1.6.7
          \--- io.kubernetes:client-java:21.0.1-legacy
               +--- project :nat (requested io.kubernetes:client-java)

[hezhangjian]

I see the maven metadata's xml, that's indeed only one version, but normally we will update this file during release. the versions should have many. Is there any broken during maven central migrate? @UrielCh

<metadata>
	<groupId>net.minidev</groupId>
	<artifactId>json-smart</artifactId>
	<versioning>
		<latest>2.5.2</latest>
		<release>2.5.2</release>
		<versions>
			<version>2.5.2</version>
		</versions>
		<lastUpdated>20250212044256</lastUpdated>
	</versioning>
</metadata>

[strangeundersun]

Same issue found after 2.5.2 released -

Could not find any version that matches net.minidev:json-smart:[1.3.3,2.4.10].
     Versions that do not match: 2.5.2
     Searched in the following locations:
       - https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml
       - https://build.shibboleth.net/maven/releases/net/minidev/json-smart/maven-metadata.xml
       - https://gitlab.com/api/v4/projects/34165892/packages/maven/net/minidev/json-smart/maven-metadata.xml
       - https://gitlab.com/api/v4/projects/34165892/packages/maven/net/minidev/json-smart/
     Required by:
         project :Independence > org.springframework.security:spring-security-oauth2-client:6.2.3 > com.nimbusds:oauth2-oidc-sdk:9.43.3

[Dristand]

   > Could not find any version that matches net.minidev:json-smart:[1.3.1,2.3].
     Versions that do not match: 2.5.2
     Searched in the following locations:
       - https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml
       - https://maven.pkg.github.com/org/spark/net/minidev/json-smart/maven-metadata.xml
       - https://jitpack.io/net/minidev/json-smart/maven-metadata.xml
     Required by:
         project :app > com.nimbusds:nimbus-jose-jwt:5.8

Same issue here

[ijioio]

It seems that artifact metadata announce version 2.5.2 but artifact itself is not available

[Ramnathpraveen-G]

Please help resolve

[jabouchleih]

It seems that artifact metadata announce version 2.5.2 but artifact itself is not available

The dependency is available in Maven Central, see: https://repo.maven.apache.org/maven2/net/minidev/json-smart/

The issue - as @hezhangjian already mentioned - that the version history is missing in the maven-metadata.xml.

[fugary]

Please help resolve

https://repo.maven.apache.org/maven2/net/minidev/json-smart/maven-metadata.xml

Before the bug is fixed, you can manually add the versions to local maven-metadata-central.xml yourself.

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>net.minidev</groupId>
  <artifactId>json-smart</artifactId>
  <versioning>
    <latest>2.5.2</latest>
    <release>2.5.2</release>
    <versions>
      <version>2.5.2</version>
      <version>2.5.1</version>
      <version>2.5.0</version>
      <version>2.4.11</version>
      <version>2.4.10</version>
      <version>2.4.9</version>
      <version>2.4.8</version>
      <version>2.4.7</version>
      <version>2.4.6</version>
      <version>2.4.5</version>
      <version>2.4.4</version>
      <version>2.4.2</version>
      <version>2.4.1</version>
      <version>2.3.1</version>
      <version>2.3</version>
      <version>2.2.1</version>
      <version>2.2</version>
      <version>2.1.1</version>
      <version>2.1.0</version>
      <version>2.0</version>
      <version>2.0-RC3</version>
      <version>2.0-RC2</version>
      <version>2.0-RC1</version>
      <version>1.3.3</version>
      <version>1.3.2</version>
      <version>1.3.1</version>
      <version>1.3</version>
      <version>1.2</version>
      <version>1.1.1</version>
      <version>1.1</version>
      <version>1.0.9-1</version>
      <version>1.0.9</version>
      <version>1.0.8</version>
      <version>1.0.6.3</version>
    </versions>
    <lastUpdated>20250212044256</lastUpdated>
  </versioning>
</metadata>

[ijioio]

It seems that artifact metadata announce version 2.5.2 but artifact itself is not available

The dependency is available in Maven Central, see: https://repo.maven.apache.org/maven2/net/minidev/json-smart/

The issue - as @hezhangjian already mentioned - that the version history is missing in the maven-metadata.xml.

Yeah, true, now it shows for me as well. Probably browser cache issue. Thanks!

[thewisenerd]

here's a more complete list; versions from https://mvnrepository.com/artifact/net.minidev/json-smart

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>net.minidev</groupId>
  <artifactId>json-smart</artifactId>
  <versioning>
    <latest>2.5.2</latest>
    <release>2.5.2</release>
    <versions>
      <version>2.5.2</version>
      <version>2.5.1</version>
      <version>2.5.0</version>
      <version>2.4.11</version>
      <version>2.4.10</version>
      <version>2.4.9</version>
      <version>2.4.8</version>
      <version>2.4.7</version>
      <version>2.4.6</version>
      <version>2.4.5</version>
      <version>2.4.4</version>
      <version>2.4.2</version>
      <version>2.4.1</version>
      <version>2.3.1</version>
      <version>2.3</version>
      <version>2.2.1</version>
      <version>2.2</version>
      <version>2.1.1</version>
      <version>2.1.0</version>
      <version>2.0</version>
      <version>2.0-RC3</version>
      <version>2.0-RC2</version>
      <version>2.0-RC1</version>
      <version>1.3.3</version>
      <version>1.3.2</version>
      <version>1.3.1</version>
      <version>1.3</version>
      <version>1.2</version>
      <version>1.1.1</version>
      <version>1.1</version>
      <version>1.0.9-1</version>
      <version>1.0.9</version>
      <version>1.0.8</version>
      <version>1.0.6.3</version>
    </versions>
    <lastUpdated>20250212044256</lastUpdated>
  </versioning>
</metadata>

[ijioio]

Before the bug is fixed, you can manually add the versions to local maven-metadata-central.xml yourself.

As an alternative you can provide artifact of required version from local repository, it will resolve version discovery issue. For Gradle:

repositories {
    mavenCentral()
    flatDir {
        dirs 'libs'
    }
}

project
    \- libs
        \- json-smart-2.4.10.jar

[shyvum]

@hezhangjian by when can this be fixed, this is causing build issues on our production codebase.

[ArloL]

If you want a quick fix now you can use dependencyManagement. This is best practice anyway to make sure your dependency tree is a little more deterministic and reproducible:

<dependencyManagement>
	<dependencies>
		<dependency>
			<groupId>net.minidev</groupId>
			<artifactId>json-smart</artifactId>
			<version>2.5.2</version>
		</dependency>
	</dependencies>
</dependencyManagement>

I am not completely sure if this is best practice but it does the trick in gradle for me

configurations.all {
	resolutionStrategy {
		force 'net.minidev:json-smart:2.5.2'
	}
}

And also nimbus-jose-jwt:8.20 was released in 2020 and was the last release with the range dependency on json-smart. Maybe now is the time to consider updating some of your dependencies to immediately get rid of this issue ☺️

Edit:
I see now that the issue is oauth2-oidc-sdk:9.43.4 which has the range dependency and it is part of spring-security-oauth2-client and that is managed in spring boot 3.4.2 so that's why so many people have the issue. You can fix your builds using the above strategies.