spring-projects / spring-projects/spring-security

Dependency regression: cas-client-core 4.1.x in Spring Security 7.1.0 breaks Java 17 baseline compatibility

Open
#19,325 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
Spring Security 7.1.0 updated its cas-client-core dependency to version 4.1.x. However, this version of the CAS client introduces a regression regarding the baseline Java version compliance. While Spring Security 7.1.0 targets Java 17+, the pulled cas-client-core 4.1.x artifact contains class files compiled for a higher Java version (or relies on features/bytecode incompatible with a standard Java 17 runtime), breaking compatibility for applications running on the expected Java 17 baseline.

see pr #18974 (commit 45b01bd on java-cas-client project).

To Reproduce

  1. Create a Spring Boot application using Spring Security 7.1.0.
  2. Configure the application to use CAS authentication, pulling in the transitive cas-client-core:4.1.x dependency.
  3. Ensure the project build and runtime environment are strictly set to Java 17.
  4. Start the application or run the test suite.
  5. The application fails to start, throwing an UnsupportedClassVersionError (e.g., class file version 65.0 or higher detected) or a linkage error related to the CAS client classes.

Expected behavior
Since Spring Security 7.1.0 maintains a Java 17 baseline, all of its required and major transitive dependencies—including cas-client-core—should be fully compatible with Java 17 bytecode and runtimes without requiring a JVM upgrade.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failure with Spring Security 7.1.0, CAS authentication, cas-client-core 4.1.x, and a Java 17 runtime. Read the dependency change associated with PR #18974 and commit 45b01bd in the java-cas-client project, then verify the resolved artifact's class-file version. Done means the CAS dependency works without UnsupportedClassVersionError or linkage errors on Java 17.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.