I have a Java project which has a dependency of SpringBoot version 2.3.6.RELEASE. However, I'm in trouble trying to upgrade to 2.4.0 version. In the project nothing else was changed, only version of SpringBoot. Since then the application throws the following error message:
Caused by: java.lang.ClassCastException: com.nimbusds.jose.shaded.json.JSONObject cannot be cast to net.minidev.json.JSONObject I did some comparison of maven dependency tree (mvn dependency:tree) and found out that probably some significant changes have been done for nimbus-jose-jwt and json-smart libs.
2.3.6.RELEASE
[INFO] +- org.springframework.security:spring-security-oauth2-jose:jar:5.3.5.RELEASE:compile [INFO] | +- com.nimbusds:nimbus-jose-jwt:jar:8.19:compile (version managed from 8.20.1) [INFO] | | +- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile [INFO] | | \- net.minidev:json-smart:jar:1.3.1:provided (scope managed from compile) [INFO] | +- org.springframework.security:spring-security-core:jar:5.3.5.RELEASE:compile 2.4.0
[INFO] +- org.springframework.security:spring-security-oauth2-jose:jar:5.4.1:compile [INFO] | +- com.nimbusds:nimbus-jose-jwt:jar:9.1.2:compile (version managed from 9.0.1) [INFO] | | \- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile [INFO] | +- org.springframework.security:spring-security-core:jar:5.4.1:compile As can be seen above nimbus-jose-jwt has been updated from 8.19 to 9.1.2. Moreover, json-smart is not anymore part of nimbus-jose-jwt in 2.4.0.
The root cause is probably this change However, what should be done in order to prevent this exception?
22 Answers
You could override the default versions of jars nimbus-jose-jwt and json-smart, by adding the older version explicitly in your pom.
In my case - I had to upgrade to 2.5.7 Springboot version and the nimbus-jose-jwt:jar version came with SB-2.5.7 is 9.10.1.
org.springframework.security:spring-security-oauth2-jose:jar:5.5.3:compile [INFO] | +- (org.springframework.security:spring-security-core:jar:5.5.3:compile - version managed from 4.2.15.RELEASE; omitted for duplicate) [INFO] | +- (org.springframework.security:spring-security-oauth2-core:jar:5.5.3:compile - omitted for duplicate) [INFO] | +- (org.springframework:spring-core:jar:5.3.13:compile - version managed from 5.3.11; omitted for duplicate) [INFO] | \- com.nimbusds:nimbus-jose-jwt:jar:9.10.1:compile After downgrading the nimbus-jose-jwt to 8.20 the app started working.
