confluentinc / confluentinc/common

Guava 32.0.1 causes sun.misc.Unsafe deprecation warnings on JDK 25

Open Beginner friendly
#1,071 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Java
Stars
17
Forks
243
Avg merge
1d 21h
Merged PRs (30d)
38

Description

When running applications using Confluent 8.3.0 on JDK 25, Guava 32.0.1-jre
produces warnings because `AbstractFuture$UnsafeAtomicHelper` calls the
terminally deprecated `sun.misc.Unsafe.objectFieldOffset()` API.

The warning is:

WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
WARNING: Please consider reporting this to the maintainers of class
com.google.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper
WARNING: sun.misc.Unsafe::objectFieldOffset has been called by
com.google.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper
(file:/.../guava-32.0.1-jre.jar)
WARNING: A terminally deprecated method in sun.misc.Unsafe has been called

## Dependency path

For example, with `io.confluent:kafka-streams-avro-serde:8.3.0`:

io.confluent:kafka-streams-avro-serde:8.3.0
-> io.confluent:kafka-avro-serializer:8.3.0
-> com.google.guava:guava:32.0.1-jre

and:

io.confluent:kafka-streams-avro-serde:8.3.0
-> io.confluent:kafka-schema-registry-client:8.3.0
-> com.google.guava:guava:32.0.1-jre

The Guava version is centrally managed by `confluentinc/common`:

32.0.1-jre

This version was introduced by commit `APPSEC-2796` in June 2023,
upgrading Guava from 30.1.1-jre to 32.0.1-jre.

## JDK 25

JDK 25 reports this because `sun.misc.Unsafe.objectFieldOffset()` is
terminally deprecated and scheduled for removal in a future JDK release.

Guava subsequently changed its Java 9+ implementations to avoid these
`Unsafe` APIs. Upgrading Guava to 33.4.8-jre removes this warning.

## Impact

The warning does not currently prevent the application from starting or
operating correctly. However, it indicates that Confluent's current
dependency management relies on an API that is scheduled for removal from
the JDK.

We are currently migrating 30+ applications to JDK 25, and applications
using Confluent's Avro/Schema Registry clients encounter this warning.

## Expected

The Guava version managed by `confluentinc/common` should be updated to a
version that does not invoke the terminally deprecated
`sun.misc.Unsafe` memory-access APIs on modern JDKs.

## Environment

- Confluent Platform: 8.3.0
- `kafka-streams-avro-serde`: 8.3.0
- JDK: 25
- Guava: 32.0.1-jre

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the centrally managed 32.0.1-jre entry in confluentinc/common and review how dependency versions are validated. Check the resolved dependency with the stated Confluent clients on JDK 25; done means the managed Guava version no longer produces the reported sun.misc.Unsafe deprecation warnings.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.