spring-projects / spring-projects/spring-security
Dependency regression: cas-client-core 4.1.x in Spring Security 7.1.0 breaks Java 17 baseline compatibility
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
Spring Security 7.1.0 updated its cas-client-core dependency to version 4.1.x. However, this version of the CAS client introduces a regression regarding the baseline Java version compliance. While Spring Security 7.1.0 targets Java 17+, the pulled cas-client-core 4.1.x artifact contains class files compiled for a higher Java version (or relies on features/bytecode incompatible with a standard Java 17 runtime), breaking compatibility for applications running on the expected Java 17 baseline.
see pr #18974 (commit 45b01bd on java-cas-client project).
To Reproduce
- Create a Spring Boot application using Spring Security 7.1.0.
- Configure the application to use CAS authentication, pulling in the transitive cas-client-core:4.1.x dependency.
- Ensure the project build and runtime environment are strictly set to Java 17.
- Start the application or run the test suite.
- The application fails to start, throwing an UnsupportedClassVersionError (e.g., class file version 65.0 or higher detected) or a linkage error related to the CAS client classes.
Expected behavior
Since Spring Security 7.1.0 maintains a Java 17 baseline, all of its required and major transitive dependencies—including cas-client-core—should be fully compatible with Java 17 bytecode and runtimes without requiring a JVM upgrade.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with Spring Security 7.1.0, CAS authentication, cas-client-core 4.1.x, and a Java 17 runtime. Read the dependency change associated with PR #18974 and commit 45b01bd in the java-cas-client project, then verify the resolved artifact's class-file version. Done means the CAS dependency works without UnsupportedClassVersionError or linkage errors on Java 17.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100