confluentinc / confluentinc/common
Guava 32.0.1 causes sun.misc.Unsafe deprecation warnings on JDK 25
- Dominant language
- Java
- Stars
- 17
- Forks
- 243
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 38
Description
When running applications using Confluent 8.3.0 on JDK 25, Guava 32.0.1-jre
produces warnings because `AbstractFuture$UnsafeAtomicHelper` calls the
terminally deprecated `sun.misc.Unsafe.objectFieldOffset()` API.
The warning is:
WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
WARNING: Please consider reporting this to the maintainers of class
com.google.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper
WARNING: sun.misc.Unsafe::objectFieldOffset has been called by
com.google.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper
(file:/.../guava-32.0.1-jre.jar)
WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
## Dependency path
For example, with `io.confluent:kafka-streams-avro-serde:8.3.0`:
io.confluent:kafka-streams-avro-serde:8.3.0
-> io.confluent:kafka-avro-serializer:8.3.0
-> com.google.guava:guava:32.0.1-jre
and:
io.confluent:kafka-streams-avro-serde:8.3.0
-> io.confluent:kafka-schema-registry-client:8.3.0
-> com.google.guava:guava:32.0.1-jre
The Guava version is centrally managed by `confluentinc/common`:
32.0.1-jre
This version was introduced by commit `APPSEC-2796` in June 2023,
upgrading Guava from 30.1.1-jre to 32.0.1-jre.
## JDK 25
JDK 25 reports this because `sun.misc.Unsafe.objectFieldOffset()` is
terminally deprecated and scheduled for removal in a future JDK release.
Guava subsequently changed its Java 9+ implementations to avoid these
`Unsafe` APIs. Upgrading Guava to 33.4.8-jre removes this warning.
## Impact
The warning does not currently prevent the application from starting or
operating correctly. However, it indicates that Confluent's current
dependency management relies on an API that is scheduled for removal from
the JDK.
We are currently migrating 30+ applications to JDK 25, and applications
using Confluent's Avro/Schema Registry clients encounter this warning.
## Expected
The Guava version managed by `confluentinc/common` should be updated to a
version that does not invoke the terminally deprecated
`sun.misc.Unsafe` memory-access APIs on modern JDKs.
## Environment
- Confluent Platform: 8.3.0
- `kafka-streams-avro-serde`: 8.3.0
- JDK: 25
- Guava: 32.0.1-jre
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the centrally managed 32.0.1-jre entry in confluentinc/common and review how dependency versions are validated. Check the resolved dependency with the stated Confluent clients on JDK 25; done means the managed Guava version no longer produces the reported sun.misc.Unsafe deprecation warnings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100