Provide dependency management for Yasson

[juliovalcarcel]

Recently while updating an app from Spring Boot 1 to 2 and additionally updating Java EE from 7 to 8 I ran into an issue with the JsonbAutoConfiguration getting setup but it failing to find classes from Yasson.

Upon further research it looks like in order to get JSON-B to work with spring you have to pull in yasson and javax.json from glassfish according to https://www.e4developer.com/2018/03/04/introducing-json-b-with-spring-boot-2-0/

Would it not make sense to include either JavaEE in dependency management as well as Yasson or is there a longer term plan for how to prevent this in the future?

[philwebb]

I guess your original application had a javax.json.bind-api JAR but not an actual implementation? Can you describe a little more about your setup? Are you deploying to a Java EE 8 application server, or just trying to make use of Java EE 8 APIs in stand-alone Spring Boot application?

Upon further research it looks like in order to get JSON-B to work with spring you have to pull in yasson

You need to have and API and an implementation, but I don't think it necessarily needs to be Yasson. We provide dependency management for Apache Johnzon currently.

Would it not make sense to include either JavaEE in dependency management as well as Yasson

I'm not keen on adding a managed JavaEE dependency since most typical Spring Boot developers need implementations as well as APIs. I prefer our current approach of pulling in individual spec APIs, rather than using the full JavaEE API JAR.

We could consider adding a Yasson dependency, but we typically only try to manage dependencies that are used directly in Spring Boot (or the Spring Boot tests).

I'll flag this issue to see what the rest of the team thinks.

[wilkinsona]

I think we probably made a mistake when we added the dependency management for Johnzon. We only use it as a test-scoped dependency so it probably should have been managed in spring-boot-parent.

That said, it does make things a bit easier for those wanting to use JSON-B. Perhaps we should add dependency management for Yasson and update the tests to verify that things work as expected with either Yasson or Johnzon.

[juliovalcarcel]

@philwebb We were using the Java EE 7 APIs in a standalone spring-boot app.... I was actually able to remove that dependency as whole, but before I realized we were no longer using the API I tried updating it from Java EE 7 to Java EE 8 (Just the API) and at that point the autoconfigure picked up that javax.json.bind.Jsonb was on the class path even though no implementation was available.

I am not sure what pulled in Yasson specifically (If you would like I can try to reproduce the issue to get more details).

[wilkinsona]

at that point the autoconfigure picked up that javax.json.bind.Jsonb was on the class path even though no implementation was available.

That sounds like a bug. What was the consequence of that set of dependencies?

[snicoll]

@wilkinsona the auto-configuration looks for Jsonb and uses the API hook-point to grab an instance. In retrospect, I agree it's probably too agressive.

[wilkinsona]

Answering my own question, the application fails to start. I've opened #14675.

[juliovalcarcel]

@wilkinsona Yup that is exactly what I was getting