JJWT dependency confusion

Question

I inherited a java project that has this in the POM.xml:

<properties>
    <jjwt.version>0.11.1</jjwt.version>
</properties>

// from https://github.com/jwtk/jjwt#maven
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>${jjwt.version}</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>${jjwt.version}</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId> <!-- or jjwt-gson if Gson is preferred -->
    <version>${jjwt.version}</version>
    <scope>runtime</scope>
</dependency>

// what is this "jjwt" dep, and why might it be using a different version?
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.1</version> 
</dependency>

what is this "jjwt" dep, and why might it be using a different version?

I don't see any mention of it at https://github.com/jwtk/jjwt

but it is here: https://mvnrepository.com/artifact/io.jsonwebtoken

score 9 · Accepted Answer · answered Aug 10 '20 at 19:39

Prior to the JJWT version 0.10.0, both the API and the implementation were packaged as a single artifact, io.jsonwebtoken:jjwt.

Starting with version 0.10.0, API and implementation were split in two different artifacts.

An excerpt from the JJWT Release Notes, version 0.10.0:

JJWT's new modular design utilizes distinctions between compile and runtime dependencies to ensure you only depend on the public APIs that are safe to use in your application. All internal/private implementation classes have been moved to a new jjwt-impl runtime dependency.

If you depended on any internal implementation classes in the past, you have two choices:

Refactor your code to use the public-only API classes and interfaces in the jjwt-api .jar. Any functionality you might have used in the internal implementation should be available via newer cleaner interfaces and helper classes in that .jar.

Specify the new jjwt-impl .jar not as a runtime dependency but as a compile dependency. This would make your upgrade to JJWT 0.10.0 fully backwards compatible, but you do so at your own risk. JJWT will make NO semantic version compatibility guarantees in the jjwt-impl .jar moving forward. Semantic versioning will be very carefully adhered to in all other JJWT dependencies however.

My guess is that your project's team just didn't finish upgrade from JJWT <= 0.9 to JJWT >= 0.10.

I missed that in the release notes. this is what I figured was the case, but wanted to be sure. thanks for the link — Jason, Aug 10 '20 at 21:04

JJWT dependency confusion

1 Answers1

Linked