Problem upgrading Vaadin 24.1.4 to 24.1.11

[wegerv]

trafficstars

Description of the bug

After (only) updating vaadin from 24.1.4 to 24.1.11 my (WildFly 29.0.1.FINAL) application server no longer starts the .war but gives an error:

 Failed to start service jboss.deployment.unit.".war".component."jakarta.servlet.http.HttpServlet$NoBodyAsyncContextListener".WeldInstantiator: org.jboss.msc.service.StartException in service jboss.deployment.unit.".war".component."jakarta.servlet.http.HttpServlet$NoBodyAsyncContextListener".WeldInstantiator: Failed to start service
        at [email protected]//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1609)
        at [email protected]//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1438)
        at [email protected]//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
        at [email protected]//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1990)
        at [email protected]//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
        at [email protected]//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1363)
        at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: org.jboss.weld.resources.spi.ResourceLoadingException: Error while loading class jakarta.servlet.http.HttpServlet$NoBodyAsyncContextListener
        at [email protected]//org.jboss.weld.resources.ClassTransformer.getBackedAnnotatedType(ClassTransformer.java:186)
        at [email protected]//org.jboss.weld.resources.ClassTransformer.getBackedAnnotatedType(ClassTransformer.java:194)
        at [email protected]//org.jboss.weld.resources.ClassTransformer.getEnhancedAnnotatedType(ClassTransformer.java:232)
        at [email protected]//org.jboss.as.weld.injection.InjectionTargets.createInjectionTarget(InjectionTargets.java:64)
        at [email protected]//org.jboss.as.weld.injection.WeldComponentService.start(WeldComponentService.java:121)
        at [email protected]//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1617)
        at [email protected]//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1580)
        ... 6 more
Caused by: java.lang.IncompatibleClassChangeError: jakarta.servlet.http.HttpServlet and jakarta.servlet.http.HttpServlet$NoBodyAsyncContextListener disagree on InnerClasses attribute
        at java.base/java.lang.Class.getDeclaringClass0(Native Method)
        at java.base/java.lang.Class.getDeclaringClass(Class.java:1598)
        at [email protected]//org.jboss.weld.util.reflection.Reflections.checkDeclaringClassLoadable(Reflections.java:427)
        at [email protected]//org.jboss.weld.resources.ClassTransformer$TransformClassToBackedAnnotatedType.apply(ClassTransformer.java:83)
        at [email protected]//org.jboss.weld.resources.ClassTransformer$TransformClassToBackedAnnotatedType.apply(ClassTransformer.java:79)
        at [email protected]//org.jboss.weld.util.cache.ReentrantMapBackedComputingCache.lambda$new$0(ReentrantMapBackedComputingCache.java:55)
        at [email protected]//org.jboss.weld.util.WeakLazyValueHolder$1.computeValue(WeakLazyValueHolder.java:35)
        at [email protected]//org.jboss.weld.util.WeakLazyValueHolder.get(WeakLazyValueHolder.java:53)
        at [email protected]//org.jboss.weld.util.cache.ReentrantMapBackedComputingCache.getValue(ReentrantMapBackedComputingCache.java:72)
        at [email protected]//org.jboss.weld.util.cache.ReentrantMapBackedComputingCache.getCastValue(ReentrantMapBackedComputingCache.java:78)
        at [email protected]//org.jboss.weld.resources.ClassTransformer.getBackedAnnotatedType(ClassTransformer.java:177)
        ... 12 more

Expected behavior

Application startup just like in 24.1.4

Minimal reproducible example

Upgrade from 24.1.4 to 24.1.11

Versions

• Vaadin / Flow version: 24.1.11
• Java version: jdk 18
• OS version: windows 11
• Browser version (if applicable):
• Application Server (if applicable): Wildfly 29.0.1.Final
• IDE (if applicable):

[caalador]

Is this using spring-boot? In that case it might sound like tomcat is being pulled in and that interferes with wildfly. Using mvn dependency:tree in the project see if something brings in spring-boot-starter-tomcat and exclude/make it provided scope.

[wegerv]

Yes it is using spring-boot (3.1.2). I've already excluded the tomcat starter. The only difference from my pom (effective pom) are the vaadin version and resulting from that selenium .

I also checked the .war. It is not in there, neither is jakarta-servlet-api.jar.

[caalador]

If you go from 24.1.11 towards 24.1.4 is there some specific version where is starts to work?

[wegerv]

24.1.7 is okay, 24.1.8 is not (same error as in 24.1.11).

[caalador]

I can see in the platform 24.1.7 to 24.1.8 commits https://github.com/vaadin/platform/commit/9bf1a3b453e4b9c4000c9f86291a64a94fb22fe9 Do those (tomcat-embed-core, tomcat-embed-websocket) get pulled in?

[wegerv]

Yes. I've included vaadin-eventbus (0.5.1) that pulls vaadin-spring-boot-starter (24.1.8 managed from 23.0.0) which pulls tomcat-embed-core (10.1.1 managed from 10.1.13).

If I have a look at vaadin-spring-boot-starter (pom, 24.1.8) I see tomcat-embed-core both included and excluded (from different groupId):

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-web</artifactId>
  <version>3.1.2</version>
  <scope>compile</scope>
  <exclusions>
    <exclusion>
      <artifactId>snakeyaml</artifactId>
      <groupId>org.yaml</groupId>
    </exclusion>
    <exclusion>
      <artifactId>tomcat-embed-core</artifactId>
      <groupId>org.apache.tomcat.embed</groupId>
    </exclusion>
    <exclusion>
      <artifactId>tomcat-embed-websocket</artifactId>
      <groupId>org.apache.tomcat.embed</groupId>
    </exclusion>
  </exclusions>
</dependency>
<dependency>
  <groupId>org.apache.tomcat.embed</groupId>
  <artifactId>tomcat-embed-core</artifactId>
  <version>10.1.13</version>
  <scope>compile</scope>
</dependency>
<dependency>
  <groupId>org.apache.tomcat.embed</groupId>
  <artifactId>tomcat-embed-websocket</artifactId>
  <version>10.1.13</version>
  <scope>compile</scope>
</dependency>

[wegerv]

Because vaadin-spring-boot-starter is pulled in by vaadin-eventbus I can't exclude from vaadin-spring-boot-starter: however adding exclusions to the vaadin-eventbus dependency solves it too:

	<dependency>
	    <groupId>de.codecamp.vaadin</groupId>
	    <artifactId>vaadin-eventbus</artifactId>
	    <version>0.5.1</version>
	    <exclusions>
		    <exclusion>
		      <groupId>org.apache.tomcat.embed</groupId>
		      <artifactId>tomcat-embed-core</artifactId>
		    </exclusion>
		    <exclusion>
		      <groupId>org.apache.tomcat.embed</groupId>
		      <artifactId>tomcat-embed-websocket</artifactId>
		    </exclusion>
		    <exclusion>
		      <groupId>org.apache.tomcat.embed</groupId>
		      <artifactId>tomcat-embed-el</artifactId>
		    </exclusion>
	    </exclusions>
	</dependency>

[mshabarov]

So we have an explicit tomcat version in platform (https://github.com/vaadin/flow/issues/17773#issuecomment-1746720838). Until we can get rid of these (spring-boot-starter-web gets a newer versions), let's keep this issue opened.

[mstahv]

In case we (really !?!) want to take the responsibility from Spring Boot to maintain Tomcat version, how about doing that by overriding <tomcat.version> (that Spring Boot uses) instead 🤔

cc: @ZheSun88, @manolo

[knoobie]

Let me better ask: why is the spring-web-starter even within vaadin's starter? Doesn't this enforce tomcat for everybody making it harder to use e.g. jetty or others? Shouldn't starter be as small as possible?

And yes, managing all those dependency yourself is hell - just yesterday tomcat and jetty released multiple CVEs and new patch releases. So you have to upgrade again :p

Example: Actuator Starter: it has no web dependency, even tho it is never intended to be used without - but this allows the flexible usage without pulling in tomcat and enforcing exclusion rules to all projects https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-actuator/3.1.4

Using the tomcat.version is not possible in the starter of the platform.

[ZheSun88]

So we have an explicit tomcat version in platform (#17773 (comment)). Until we can get rid of these (spring-boot-starter-web gets a newer versions), let's keep this issue opened.

I can see in the platform 24.1.7 to 24.1.8 commits vaadin/platform@9bf1a3b Do those (tomcat-embed-core, tomcat-embed-websocket) get pulled in?

just to answer the exclusions in platform. I just had a look about that tomcat-core version overwritten, as in the spring-boot 3.1.4, the tomcat dependency used is already the 10.1.13, so i will remove those exclusion and dependency declaration.

[mshabarov]

@ZheSun88 do you have any updates for this?

[ZheSun88]

in the current version of V24.2-V24.4. there are no exclusions/direct-dependencies on tomcat https://github.com/vaadin/platform/commit/824116bbab9465577c53092ac339fc9014af55b9

[mcollovati]

@ZheSun88 can this ticket be closed?

[ZheSun88]

awww.. i think so.. feel free to reopen if this issue still exists.