SpotBugs 4.8.1 fails parsing filter files in Spring Boot projects with NoSuchMethodError: Range.of(Comparable, Comparable) #2686

josephearl · 2023-11-08T07:56:17Z

SpotBugs 4.8.1 fails to parse filter files in projects with Spring Boot which worked with SpotBugs 4.8.0.

Minimal reproducer: https://github.com/josephearl/spotbugs-spring-boot-filter-repro

Error:

> Task :spotbugsMain FAILED
Exception in thread "main" java.lang.NoSuchMethodError: 'org.apache.commons.lang3.Range org.apache.commons.lang3.Range.of(java.lang.Comparable, java.lang.Comparable)'
        at org.apache.commons.text.translate.NumericEntityEscaper.<init>(NumericEntityEscaper.java:97)
        at org.apache.commons.text.translate.NumericEntityEscaper.between(NumericEntityEscaper.java:59)
        at org.apache.commons.text.StringEscapeUtils.<clinit>(StringEscapeUtils.java:271)
        at edu.umd.cs.findbugs.util.Strings.unescapeXml(Strings.java:295)
        at edu.umd.cs.findbugs.SAXBugCollectionHandler.getRequiredAttribute(SAXBugCollectionHandler.java:804)
        at edu.umd.cs.findbugs.SAXBugCollectionHandler.parseMatcher(SAXBugCollectionHandler.java:452)
        at edu.umd.cs.findbugs.SAXBugCollectionHandler.startElement(SAXBugCollectionHandler.java:340)
        at java.xml/com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.startElement(AbstractSAXParser.java:518)
        at java.xml/com.sun.org.apache.xerces.internal.parsers.AbstractXMLDocumentParser.emptyElement(AbstractXMLDocumentParser.java:183)
        at java.xml/com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanStartElement(XMLDocumentFragmentScannerImpl.java:1387)
        at java.xml/com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl$FragmentContentDriver.next(XMLDocumentFragmentScannerImpl.java:2726)
        at java.xml/com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(XMLDocumentScannerImpl.java:605)
        at java.xml/com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(XMLDocumentFragmentScannerImpl.java:542)
        at java.xml/com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:889)
        at java.xml/com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:825)
        at java.xml/com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:141)
        at java.xml/com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.parse(AbstractSAXParser.java:1224)
        at java.xml/com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl$JAXPSAXParser.parse(SAXParserImpl.java:637)
        at edu.umd.cs.findbugs.filter.Filter.parse(Filter.java:234)
        at edu.umd.cs.findbugs.filter.Filter.parse(Filter.java:208)
        at edu.umd.cs.findbugs.filter.Filter.<init>(Filter.java:133)
        at edu.umd.cs.findbugs.FindBugs.configureFilter(FindBugs.java:471)
        at edu.umd.cs.findbugs.FindBugs2.addFilter(FindBugs2.java:404)
        at edu.umd.cs.findbugs.FindBugs2.configureFilters(FindBugs2.java:551)
        at edu.umd.cs.findbugs.FindBugs2.setUserPreferences(FindBugs2.java:505)
        at edu.umd.cs.findbugs.TextUICommandLine.configureEngine(TextUICommandLine.java:723)
        at edu.umd.cs.findbugs.FindBugs.processCommandLine(FindBugs.java:359)
        at edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1221)

Expected: SpotBugs 4.8.1 can parse filter files in projects with Spring Boot as 4.8.0 was able to

gtoison · 2023-11-08T11:03:40Z

The error seems to be due to using mismatched versions of commons-text and commons-lang3.
commons:commons-text:1.11.0 requires commons-lang3:3.13.0 so this renovate commit seems fine 0ed9c56

I tried reproducing the problem in SpotBugs but it worked for me and the zip distribution also has the correct versions.

@hazendaz I wonder if the transitive dependencies might be different in the gradle plugin (it needs to be using commons-lang3:3.13.0).

josephearl · 2023-11-08T12:56:10Z

4.8.1 works fine in other projects not using Spring Boot, like a Quarkus project

gtoison · 2023-11-08T13:43:56Z

On the SpotBugs project the dependency tree is:

> gradlew -q :spotbugs:dependencies

runtimeClasspath - Runtime classpath of source set 'main'.
+--- org.ow2.asm:asm:9.6
+--- org.ow2.asm:asm-analysis:9.6
|    \--- org.ow2.asm:asm-tree:9.6
|         \--- org.ow2.asm:asm:9.6
+--- org.ow2.asm:asm-commons:9.6
|    +--- org.ow2.asm:asm:9.6
|    \--- org.ow2.asm:asm-tree:9.6 (*)
+--- org.ow2.asm:asm-tree:9.6 (*)
+--- org.ow2.asm:asm-util:9.6
|    +--- org.ow2.asm:asm:9.6
|    +--- org.ow2.asm:asm-tree:9.6 (*)
|    \--- org.ow2.asm:asm-analysis:9.6 (*)
+--- org.apache.bcel:bcel:6.6.1
|    \--- org.apache.commons:commons-lang3:3.12.0 -> 3.13.0
+--- com.github.stephenc.jcip:jcip-annotations:1.0-1
+--- org.dom4j:dom4j:2.1.4
+--- org.apache.commons:commons-lang3:3.13.0
+--- org.apache.commons:commons-text:1.11.0
|    \--- org.apache.commons:commons-lang3:3.13.0
+--- org.slf4j:slf4j-api:2.0.9
+--- project :spotbugs-annotations
|    +--- com.google.code.findbugs:jsr305:3.0.2
|    \--- org.apache.logging.log4j:log4j-core:{strictly [2.17.1, 3[} -> 2.21.1 (c)
+--- com.google.code.gson:gson:2.10.1
+--- jaxen:jaxen:2.0.0
+--- net.sf.saxon:Saxon-HE:12.3
|    \--- org.xmlresolver:xmlresolver:5.2.0
|         +--- org.apache.httpcomponents.client5:httpclient5:5.1.3
|         |    +--- org.apache.httpcomponents.core5:httpcore5:5.1.3
|         |    +--- org.apache.httpcomponents.core5:httpcore5-h2:5.1.3
|         |    |    \--- org.apache.httpcomponents.core5:httpcore5:5.1.3
|         |    +--- org.slf4j:slf4j-api:1.7.25 -> 2.0.9
|         |    \--- commons-codec:commons-codec:1.15
|         \--- org.apache.httpcomponents.core5:httpcore5:5.1.3
+--- org.apache.logging.log4j:log4j-core:2.21.1
|    \--- org.apache.logging.log4j:log4j-api:2.21.1
\--- org.apache.logging.log4j:log4j-core:{strictly [2.17.1, 3[} -> 2.21.1 (c)

but in your reproducer it is:

spotbugs - configuration for the SpotBugs engine
\--- com.github.spotbugs:spotbugs:4.8.1
     +--- jaxen:jaxen:2.0.0
     +--- net.sf.saxon:Saxon-HE:12.3
     |    \--- org.xmlresolver:xmlresolver:5.2.0
     |         +--- org.apache.httpcomponents.client5:httpclient5:5.1.3 -> 5.2.1
     |         |    +--- org.apache.httpcomponents.core5:httpcore5:5.2 -> 5.2.3
     |         |    +--- org.apache.httpcomponents.core5:httpcore5-h2:5.2 -> 5.2.3
     |         |    |    \--- org.apache.httpcomponents.core5:httpcore5:5.2.3
     |         |    \--- org.slf4j:slf4j-api:1.7.36 -> 2.0.9
     |         \--- org.apache.httpcomponents.core5:httpcore5:5.1.3 -> 5.2.3
     +--- org.apache.logging.log4j:log4j-core:2.21.1 -> 2.20.0
     |    \--- org.apache.logging.log4j:log4j-api:2.20.0
     +--- org.ow2.asm:asm:9.6
     +--- org.ow2.asm:asm-analysis:9.6
     |    \--- org.ow2.asm:asm-tree:9.6
     |         \--- org.ow2.asm:asm:9.6
     +--- org.ow2.asm:asm-commons:9.6
     |    +--- org.ow2.asm:asm:9.6
     |    \--- org.ow2.asm:asm-tree:9.6 (*)
     +--- org.ow2.asm:asm-tree:9.6 (*)
     +--- org.ow2.asm:asm-util:9.6
     |    +--- org.ow2.asm:asm:9.6
     |    +--- org.ow2.asm:asm-tree:9.6 (*)
     |    \--- org.ow2.asm:asm-analysis:9.6 (*)
     +--- org.apache.bcel:bcel:6.6.1
     |    \--- org.apache.commons:commons-lang3:3.12.0
     +--- com.github.stephenc.jcip:jcip-annotations:1.0-1
     +--- org.dom4j:dom4j:2.1.4
     +--- org.apache.commons:commons-lang3:3.13.0 -> 3.12.0
     +--- org.apache.commons:commons-text:1.11.0
     |    \--- org.apache.commons:commons-lang3:3.13.0 -> 3.12.0
     +--- org.slf4j:slf4j-api:2.0.9
     +--- com.github.spotbugs:spotbugs-annotations:4.8.1
     |    +--- com.google.code.findbugs:jsr305:3.0.2
     |    \--- org.apache.logging.log4j:log4j-core:{strictly [2.17.1, 3[} -> 2.20.0 (c)
     +--- com.google.code.gson:gson:2.10.1
     \--- org.apache.logging.log4j:log4j-core:{strictly [2.17.1, 3[} -> 2.20.0 (c)

So commons-text is downgraded: org.apache.commons:commons-lang3:3.13.0 -> 3.12.0

My understanding is that (unlike Maven) Gradle resolves conflicts by picking the highest version but that's not the case here.
Do you know if Spring might be altering the default version conflict resolution?

In the meantime I think we should revert to using commons-text:1.10.0

Upgrading to 1.11.0 caused a version conflict on commons-lang3 which is: - a direct dependency - a transitive dependency of commons-text - a transitive dependency of BCEL On a Spring/Gradle project the later wins: +--- org.apache.bcel:bcel:6.6.1 | \--- org.apache.commons:commons-lang3:3.12.0 Fixes spotbugs#2686

Upgrading to 1.11.0 caused a version conflict on commons-lang3 which is: - a direct dependency - a transitive dependency of commons-text - a transitive dependency of BCEL On a Spring/Gradle project the later wins: +--- org.apache.bcel:bcel:6.6.1 | \--- org.apache.commons:commons-lang3:3.12.0 Revert to commons-text:1.10.0 which is compatible with commons-lang3:3.12.0 Fixes spotbugs#2686

hazendaz · 2023-11-08T13:57:22Z

Will look more closely tonight. I don't think reverting is necessary. Spring boot is always heavy handed on purpose. What's broke now naturally won't in weeks. These things happen and they generally say override it if an issue. What happens if the reproducer has commons Lang added directly? Does that not just solve it? I know that always works easily enough with maven. Not sure with gradle but this isn't first override concern need. Anyways will look more closely tonight and given spring boot complexities we probably should incorporate that into the gradle plugin tests to avoid any potential needs for consumer overrides. Sent from my Verizon, Samsung Galaxy smartphone Get Outlook for Android<https://aka.ms/AAb9ysg>

________________________________ From: Guillaume Toison ***@***.***> Sent: Wednesday, November 8, 2023 8:44:07 AM To: spotbugs/spotbugs ***@***.***> Cc: Jeremy Landis ***@***.***>; Mention ***@***.***> Subject: Re: [spotbugs/spotbugs] SpotBugs 4.8.1 fails parsing filter files in Spring Boot projects with NoSuchMethodError: Range.of(Comparable, Comparable) (Issue #2686) On the SpotBugs project the dependency tree is:

gradlew -q :spotbugs:dependencies

runtimeClasspath - Runtime classpath of source set 'main'. +--- org.ow2.asm:asm:9.6 +--- org.ow2.asm:asm-analysis:9.6 | \--- org.ow2.asm:asm-tree:9.6 | \--- org.ow2.asm:asm:9.6 +--- org.ow2.asm:asm-commons:9.6 | +--- org.ow2.asm:asm:9.6 | \--- org.ow2.asm:asm-tree:9.6 (*) +--- org.ow2.asm:asm-tree:9.6 (*) +--- org.ow2.asm:asm-util:9.6 | +--- org.ow2.asm:asm:9.6 | +--- org.ow2.asm:asm-tree:9.6 (*) | \--- org.ow2.asm:asm-analysis:9.6 (*) +--- org.apache.bcel:bcel:6.6.1 | \--- org.apache.commons:commons-lang3:3.12.0 -> 3.13.0 +--- com.github.stephenc.jcip:jcip-annotations:1.0-1 +--- org.dom4j:dom4j:2.1.4 +--- org.apache.commons:commons-lang3:3.13.0 +--- org.apache.commons:commons-text:1.11.0 | \--- org.apache.commons:commons-lang3:3.13.0 +--- org.slf4j:slf4j-api:2.0.9 +--- project :spotbugs-annotations | +--- com.google.code.findbugs:jsr305:3.0.2 | \--- org.apache.logging.log4j:log4j-core:{strictly [2.17.1, 3[} -> 2.21.1 (c) +--- com.google.code.gson:gson:2.10.1 +--- jaxen:jaxen:2.0.0 +--- net.sf.saxon:Saxon-HE:12.3 | \--- org.xmlresolver:xmlresolver:5.2.0 | +--- org.apache.httpcomponents.client5:httpclient5:5.1.3 | | +--- org.apache.httpcomponents.core5:httpcore5:5.1.3 | | +--- org.apache.httpcomponents.core5:httpcore5-h2:5.1.3 | | | \--- org.apache.httpcomponents.core5:httpcore5:5.1.3 | | +--- org.slf4j:slf4j-api:1.7.25 -> 2.0.9 | | \--- commons-codec:commons-codec:1.15 | \--- org.apache.httpcomponents.core5:httpcore5:5.1.3 +--- org.apache.logging.log4j:log4j-core:2.21.1 | \--- org.apache.logging.log4j:log4j-api:2.21.1 \--- org.apache.logging.log4j:log4j-core:{strictly [2.17.1, 3[} -> 2.21.1 (c) but in your reproducer it is: spotbugs - configuration for the SpotBugs engine \--- com.github.spotbugs:spotbugs:4.8.1 +--- jaxen:jaxen:2.0.0 +--- net.sf.saxon:Saxon-HE:12.3 | \--- org.xmlresolver:xmlresolver:5.2.0 | +--- org.apache.httpcomponents.client5:httpclient5:5.1.3 -> 5.2.1 | | +--- org.apache.httpcomponents.core5:httpcore5:5.2 -> 5.2.3 | | +--- org.apache.httpcomponents.core5:httpcore5-h2:5.2 -> 5.2.3 | | | \--- org.apache.httpcomponents.core5:httpcore5:5.2.3 | | \--- org.slf4j:slf4j-api:1.7.36 -> 2.0.9 | \--- org.apache.httpcomponents.core5:httpcore5:5.1.3 -> 5.2.3 +--- org.apache.logging.log4j:log4j-core:2.21.1 -> 2.20.0 | \--- org.apache.logging.log4j:log4j-api:2.20.0 +--- org.ow2.asm:asm:9.6 +--- org.ow2.asm:asm-analysis:9.6 | \--- org.ow2.asm:asm-tree:9.6 | \--- org.ow2.asm:asm:9.6 +--- org.ow2.asm:asm-commons:9.6 | +--- org.ow2.asm:asm:9.6 | \--- org.ow2.asm:asm-tree:9.6 (*) +--- org.ow2.asm:asm-tree:9.6 (*) +--- org.ow2.asm:asm-util:9.6 | +--- org.ow2.asm:asm:9.6 | +--- org.ow2.asm:asm-tree:9.6 (*) | \--- org.ow2.asm:asm-analysis:9.6 (*) +--- org.apache.bcel:bcel:6.6.1 | \--- org.apache.commons:commons-lang3:3.12.0 +--- com.github.stephenc.jcip:jcip-annotations:1.0-1 +--- org.dom4j:dom4j:2.1.4 +--- org.apache.commons:commons-lang3:3.13.0 -> 3.12.0 +--- org.apache.commons:commons-text:1.11.0 | \--- org.apache.commons:commons-lang3:3.13.0 -> 3.12.0 +--- org.slf4j:slf4j-api:2.0.9 +--- com.github.spotbugs:spotbugs-annotations:4.8.1 | +--- com.google.code.findbugs:jsr305:3.0.2 | \--- org.apache.logging.log4j:log4j-core:{strictly [2.17.1, 3[} -> 2.20.0 (c) +--- com.google.code.gson:gson:2.10.1 \--- org.apache.logging.log4j:log4j-core:{strictly [2.17.1, 3[} -> 2.20.0 (c) So commons-text is downgraded: org.apache.commons:commons-lang3:3.13.0 -> 3.12.0 My understanding is that (unlike Maven) Gradle resolves conflicts by picking the highest version but that's not the case here. Do you know if Spring might be altering the default version conflict resolution? In the meantime I think we should revert to using commons-text:1.10.0 — Reply to this email directly, view it on GitHub<#2686 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAHODI2RIHPF6P4JVLKQKULYDOECPAVCNFSM6AAAAAA7CNVBSWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMBRHEYTSNJTGA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

gtoison · 2023-11-08T14:07:43Z

I made a PR to revert right before seeing your message

hazendaz · 2023-11-09T02:44:38Z

I made a PR to revert right before seeing your message

No worries. I didn't get time to look at this one tonight so I'll try again tomorrow night. I sort of expect we do another release by sometime next week. I opened a discussion on that.

spotbugs/spotbugs#2686

josephearl · 2023-11-16T11:03:12Z

Any update on this? 🙏

Upgrading to 1.11.0 caused a version conflict on commons-lang3 which is: - a direct dependency - a transitive dependency of commons-text - a transitive dependency of BCEL On a Spring/Gradle project the later wins: +--- org.apache.bcel:bcel:6.6.1 | \--- org.apache.commons:commons-lang3:3.12.0 Revert to commons-text:1.10.0 which is compatible with commons-lang3:3.12.0 Fixes #2686

JuditKnoll · 2024-03-04T12:56:27Z

Since #2877 updates commons-text to 1.11.0, this issue resurfices on the current master, even with having bcel updated to 6.8.2 and commons-lang3 to 3.14.0. There is already an issue about the problem at commons-text's Jira board: https://issues.apache.org/jira/projects/TEXT/issues/TEXT-233

Upgrading to 1.11.0 caused a version conflict on commons-lang3 which is: - a direct dependency - a transitive dependency of commons-text - a transitive dependency of BCEL On a Spring/Gradle project the later wins: +--- org.apache.bcel:bcel:6.6.1 | \--- org.apache.commons:commons-lang3:3.12.0 Revert to commons-text:1.10.0 which is compatible with commons-lang3:3.12.0 Fixes spotbugs#2686

Upgrading to 1.11.0 caused a version conflict on commons-lang3 which is: - a direct dependency - a transitive dependency of commons-text - a transitive dependency of BCEL On a Spring/Gradle project the later wins: +--- org.apache.bcel:bcel:6.6.1 | \--- org.apache.commons:commons-lang3:3.12.0 Revert to commons-text:1.10.0 which is compatible with commons-lang3:3.12.0 Fixes #2686

Upgrading to 1.11.0 caused a version conflict on commons-lang3 which is: - a direct dependency - a transitive dependency of commons-text - a transitive dependency of BCEL On a Spring/Gradle project the later wins: +--- org.apache.bcel:bcel:6.6.1 | \--- org.apache.commons:commons-lang3:3.12.0 Revert to commons-text:1.10.0 which is compatible with commons-lang3:3.12.0 Fixes spotbugs#2686

JuditKnoll · 2024-12-09T15:42:35Z

Since #3202 got merged, I tried out the reproducer provided at this issue with the latest master. Unfortunately, I could reproduce the issue - or at least a really similar bug (the underlying issue is the same, the exception is a NoClassDefFoundError with org/apache/commons/lang3/SystemProperties).
Spring really forces the versions of its dependencies. I tried using strictly in SpotBugs at commons-lang3, but it didn't help.

However, there are good news as well:

From Spring Boot 3.3.0, spring updates to commons-lang3 3.14.0, so with spring boot 3.3.0 and above the reproducer's build and running spotbugs is successful (tested with spring boot 3.3.0 and the latest version, 3.4.0).
The fix to the connecting issue at apache (https://issues.apache.org/jira/projects/TEXT/issues/TEXT-233) got merged ([TEXT-233] required OSGi Import-Package version numbers in MANIFEST.MF apache/commons-text#627), and will be released in commons-text 1.12.1.
- This version is not released yet.

I can see the following possible solutions:

Wait for apache:commons-text 1.12.1 release.
Adapt Spring's way of being forcing the dependencies more.
- This means we need to manually maintain the dependency tree, which means a lot of work.
- May cause issues at our users.
Since with the newer Spring Boot versions it's not an issue, don't try to solve it.

jochenberger mentioned this issue Nov 8, 2023

java.lang.NoSuchMethodError: 'org.apache.commons.lang3.Range org.apache.commons.lang3.Range.of(java.lang.Comparable, java.lang.Comparable)' spotbugs/spotbugs-gradle-plugin#1024

Open

gtoison mentioned this issue Nov 8, 2023

deps: revert to using commons-text 1.10.0 #2688

Merged

josephearl mentioned this issue Nov 8, 2023

Spring Dependency Management causes SpotBugs 4.8.1 to fail spring-projects/spring-boot#38269

Closed

C-Otto added a commit to C-Otto/java-platform that referenced this issue Nov 9, 2023

downgrade spotbugs

7b76aa8

spotbugs/spotbugs#2686

hazendaz closed this as completed in #2688 Nov 27, 2023

gtoison mentioned this issue Mar 7, 2024

deps: revert to using commons-text 1.10.0 #2892

Merged

JuditKnoll mentioned this issue Nov 27, 2024

fix(deps): update dependency org.apache.commons:commons-text to v1.12.0 #3202

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SpotBugs 4.8.1 fails parsing filter files in Spring Boot projects with NoSuchMethodError: Range.of(Comparable, Comparable) #2686

SpotBugs 4.8.1 fails parsing filter files in Spring Boot projects with NoSuchMethodError: Range.of(Comparable, Comparable) #2686

josephearl commented Nov 8, 2023

gtoison commented Nov 8, 2023

josephearl commented Nov 8, 2023 •

edited

Loading

gtoison commented Nov 8, 2023

hazendaz commented Nov 8, 2023 via email

gtoison commented Nov 8, 2023

hazendaz commented Nov 9, 2023

josephearl commented Nov 16, 2023

JuditKnoll commented Mar 4, 2024

JuditKnoll commented Dec 9, 2024

SpotBugs 4.8.1 fails parsing filter files in Spring Boot projects with NoSuchMethodError: Range.of(Comparable, Comparable) #2686

SpotBugs 4.8.1 fails parsing filter files in Spring Boot projects with NoSuchMethodError: Range.of(Comparable, Comparable) #2686

Comments

josephearl commented Nov 8, 2023

gtoison commented Nov 8, 2023

josephearl commented Nov 8, 2023 • edited Loading

gtoison commented Nov 8, 2023

hazendaz commented Nov 8, 2023 via email

gtoison commented Nov 8, 2023

hazendaz commented Nov 9, 2023

josephearl commented Nov 16, 2023

JuditKnoll commented Mar 4, 2024

JuditKnoll commented Dec 9, 2024

josephearl commented Nov 8, 2023 •

edited

Loading