Dependency hell on cassandra connector

[brunoballekens]

Versions used

Akka version: 2.6.14 Play version: 2.8.8

Alpakka version 3.0.3

Actual Behavior

jackson module initialization failure :

[error] com.fasterxml.jackson.databind.JsonMappingException: Scala module 2.11.4 requires Jackson Databind version >= 2.11.0 and < 2.12.0
[error] 	at com.fasterxml.jackson.module.scala.JacksonModule.setupModule(JacksonModule.scala:61)
[error] 	at com.fasterxml.jackson.module.scala.JacksonModule.setupModule$(JacksonModule.scala:46)
[error] 	at com.fasterxml.jackson.module.scala.DefaultScalaModule.setupModule(DefaultScalaModule.scala:17)
[error] 	at com.fasterxml.jackson.databind.ObjectMapper.registerModule(ObjectMapper.java:835)
[error] 	at akka.serialization.jackson.JacksonObjectMapperProvider$.$anonfun$configureObjectMapperModules$4(JacksonObjectMapperProvider.scala:242)
[error] 	at akka.serialization.jackson.JacksonObjectMapperProvider$.$anonfun$configureObjectMapperModules$4$adapted(JacksonObjectMapperProvider.scala:241)
[error] 	at scala.collection.immutable.List.foreach(List.scala:333)
[error] 	at akka.serialization.jackson.JacksonObjectMapperProvider$.configureObjectMapperModules(JacksonObjectMapperProvider.scala:241)
[error] 	at akka.serialization.jackson.JacksonObjectMapperProvider$.createObjectMapper(JacksonObjectMapperProvider.scala:265)
[error] 	at akka.serialization.jackson.JacksonObjectMapperProvider.create(JacksonObjectMapperProvider.scala:359)
[error] 	at akka.serialization.jackson.JacksonObjectMapperProvider.$anonfun$getOrCreate$1(JacksonObjectMapperProvider.scala:317)
[error] 	at java.base/java.util.concurrent.ConcurrentHashMap.computeIfAbsent(ConcurrentHashMap.java:1705)
[error] 	at akka.serialization.jackson.JacksonObjectMapperProvider.getOrCreate(JacksonObjectMapperProvider.scala:317)
[error] 	at akka.serialization.jackson.JacksonJsonSerializer.<init>(JacksonSerializer.scala:141)
[error] 	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
[error] 	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
[error] 	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
[error] 	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
[error] 	at akka.actor.ReflectiveDynamicAccess.$anonfun$createInstanceFor$1(ReflectiveDynamicAccess.scala:40)
[error] 	at scala.util.Try$.apply(Try.scala:210)
[error] 	at akka.actor.ReflectiveDynamicAccess.createInstanceFor(ReflectiveDynamicAccess.scala:35)
[error] 	at akka.actor.ReflectiveDynamicAccess.$anonfun$createInstanceFor$5(ReflectiveDynamicAccess.scala:48)
[error] 	at scala.util.Success.flatMap(Try.scala:258)
[error] 	at akka.actor.ReflectiveDynamicAccess.createInstanceFor(ReflectiveDynamicAccess.scala:47)
[error] 	at akka.serialization.Serialization$$anonfun$serializerOf$1$$anonfun$applyOrElse$1.applyOrElse(Serialization.scala:396)
[error] 	at akka.serialization.Serialization$$anonfun$serializerOf$1$$anonfun$applyOrElse$1.applyOrElse(Serialization.scala:392)
[error] 	at scala.util.Failure.recoverWith(Try.scala:240)
[error] 	at akka.serialization.Serialization$$anonfun$serializerOf$1.applyOrElse(Serialization.scala:392)
[error] 	at akka.serialization.Serialization$$anonfun$serializerOf$1.applyOrElse(Serialization.scala:390)
[error] 	at scala.util.Failure.recoverWith(Try.scala:240)
[error] 	at akka.serialization.Serialization.serializerOf(Serialization.scala:390)
[error] 	at akka.serialization.Serialization.$anonfun$serializers$2(Serialization.scala:424)
[error] 	at scala.collection.Iterator$$anon$9.next(Iterator.scala:575)
[error] 	at scala.collection.immutable.HashMapBuilder.addAll(HashMap.scala:2360)
[error] 	at scala.collection.immutable.HashMap$.from(HashMap.scala:2182)
[error] 	at scala.collection.immutable.HashMap$.from(HashMap.scala:2158)
[error] 	at scala.collection.MapOps$WithFilter.map(Map.scala:381)
[error] 	at akka.serialization.Serialization.<init>(Serialization.scala:424)
[error] 	at akka.serialization.SerializationExtension$.createExtension(SerializationExtension.scala:18)
[error] 	at akka.serialization.SerializationExtension$.createExtension(SerializationExtension.scala:14)
[error] 	at akka.actor.ActorSystemImpl.registerExtension(ActorSystem.scala:1158)
[error] 	at akka.actor.ActorSystemImpl.$anonfun$loadExtensions$1(ActorSystem.scala:1201)
[error] 	at scala.collection.immutable.Vector.foreach(Vector.scala:1856)
[error] 	at akka.actor.ActorSystemImpl.loadExtensions$1(ActorSystem.scala:1195)
[error] 	at akka.actor.ActorSystemImpl.loadExtensions(ActorSystem.scala:1214)
[error] 	at akka.actor.ActorSystemImpl.liftedTree2$1(ActorSystem.scala:1035)
[error] 	at akka.actor.ActorSystemImpl._start$lzycompute(ActorSystem.scala:1022)
[error] 	at akka.actor.ActorSystemImpl._start(ActorSystem.scala:1022)
[error] 	at akka.actor.ActorSystemImpl.start(ActorSystem.scala:1045)
[error] 	at akka.actor.ActorSystem$.apply(ActorSystem.scala:272)
[error] 	at akka.actor.ActorSystem$.apply(ActorSystem.scala:316)
[error] 	at akka.actor.ActorSystem$.apply(ActorSystem.scala:290)
[error] 	at play.core.server.DevServerStart$.$anonfun$mainDev$1(DevServerStart.scala:291)

Issue is due to the fact the cassandra java driver (v4.10.0) used by the alpakka cassandra connector depends on jackson (and jackson databind) 2.12.0 (see https://github.com/datastax/java-driver/blame/889fe572e3720cfd4bcff06ce5cac3274243d110/pom.xml#L57).

That seems to be done because of security issue in older version of jackson (2.9.x).

[ennru]

Sounds annoying, but hard to resolve I guess.

Alpakka 3.0 is not expected to work with Akka 2.4 (are you sure you are on Akka 2.4.16?).

[brunoballekens]

oops, made a typo of course i'm not using akka 2.4, but akka 2.6.14 (since that comes with play)

I was able to fix it by the following in my dependencies:

// see https://github.com/akka/alpakka/issues/2734
      "com.lightbend.akka" %% "akka-stream-alpakka-cassandra" % alpakkaVersion excludeAll (
        ExclusionRule("com.fasterxml.jackson.core"),
        ExclusionRule("com.fasterxml.jackson.datatype")
      )

Also the commit they introduced the dependency is really messy (security issue was on Tinkerbell that bumped the dependency to 2.11.something, but then the cassandra pom bumped the jackson dependency to 2.12)

Anyway my above workaround seems to do the trick

[ennru]

Thank you for sharing the workaround. I'll leave this open for others to find.

[ennru]

In #2804 I removed the explicit dependency on Jackson as the Cassandra driver now pulls Jackson 2.12.2

[ennru]

Fixed with #2804. (I'll leave this issue open until the release goes out.)