Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Version 2.13.2 uses Method.getParameterCount() which is not supported on Android before API 26 #3412

Closed
finiasz opened this issue Mar 8, 2022 · 14 comments
Closed

Version 2.13.2 uses Method.getParameterCount() which is not supported on Android before API 26 #3412

finiasz opened this issue Mar 8, 2022 · 14 comments
Labels
android Issues related to use on Android platform
Milestone
2.13.3

Comments

@finiasz
Copy link

finiasz commented Mar 8, 2022 •
edited by cowtowncoder
Loading

After updating from jackson 2.13.1 to jackson 2.13.2 I noticed my app no longer worked on Android API 21.

After digging into the code I found the issue at line 187 of AnnotatedMethodCollector.java:

  • version 2.13.1 used m.getParameterTypes().length
  • version 2.13.2 uses m.getParameterCount()

However, the getParameterCount() method requires API 26 on Android.

For now, I'm sticking to version 2.13.1 😄

EDIT: the fix included the official 2.13.3 release
@finiasz finiasz added the to-evaluate Issue that has been received but not yet evaluated label Mar 8, 2022
@cowtowncoder
Copy link
Member

Oh crap. :-(

This was not intentional -- but teaches me to not cherry pick changes into patch. PR #3293 should have gone in 2.14(.0).

I wonder if it was worth reverting this for 2.13.3, keeping for 2.14?
I mean, for 2.13.2, damage is done (alas). But still there is likely to be 2.13.3 which would at least allow latest 2.13.x to be usable on Android API 21.

@finiasz
Copy link
Author

finiasz commented Mar 9, 2022

I'm not sure my point of view is relevant (I'm a bit biased as I mostly use Jackson on Android), but maintaining a 2.13.x branch (with security patches), that is compatible with older Android versions would be perfect for me.

And if branch 2.14 breaks support for Android API <26, that's not a problem. We'll upgrade to this branch once we drop support for these Android versions in our app.

@cowtowncoder cowtowncoder changed the title Version 2.13.2 uses Method.getParameterCount() which is not supported on Android before API 26 Version 2.13.2 uses Method.getParameterCount() which is not supported on Android before API 26 Mar 9, 2022
@cowtowncoder cowtowncoder added 2.13 android Issues related to use on Android platform and removed to-evaluate Issue that has been received but not yet evaluated labels Mar 9, 2022
@cowtowncoder cowtowncoder modified the milestones: 2.10.0, 2.13.3 Mar 9, 2022
@cowtowncoder
Copy link
Member

@finiasz I made changes to revert #3293 from 2.13, so things should work in 2.13.3.

I pushed 2.13.3-SNAPSHOT to Sonatype snapshot repository so if there's any chance you could verify functioning, that'd be great -- there are quite a few places where getParameterCount() is called, but not all of them are related to Method.
But I hope I did not miss something.

@finiasz
Copy link
Author

finiasz commented Mar 9, 2022

Many thanks for your time @cowtowncoder, I'll check this tomorrow as it's getting late here in France :)

@cowtowncoder
Copy link
Member

Perfect, thank you @finiasz!

@finiasz
Copy link
Author

finiasz commented Mar 10, 2022

I was able to run some tests today and did not run into any issue when using the code from the latest commit in branch 2.13. So my understanding is that you caught all the problematic calls to getParameterCount().

However, keep in mind that I only use a small portion of the features of jackson, with simple serialization and deserialization of POJOs, so my tests should not be considered as "exhaustive"!

@cowtowncoder cowtowncoder mentioned this issue Mar 10, 2022
Closed
@cowtowncoder
Copy link
Member

@finiasz Understood. Thank you for doing that level of verification; I did try to change relevant places outside of just one you reported. But it can definitely be the case that something else was still there... I hope others can help if and when they hit this issue.

@jonathan-caryl
Copy link

I came to report this same issue, we just bumped from 2.12.1 up to 2.13.2 and ran in to this issue on older Android APIs. Is there a release date for 2.13.3 ?

@cowtowncoder
Copy link
Member

No release date, the usual OSS style "when it's ready" means in Jackson's case that there should be enough fixes, or, sometimes, enough time has passed. Former can be seen on:

https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13.3

and latter varies a bit; for first patch maybe 1 month since .0, later on from 2 to 4 months.

At this point there are not many fixes so 2.13.3 would probably be released at earliest in May, maybe June.

Having said that, I think this particular fix is actually contained in micro releases 2.13.2.1 and 2.13.2.2 which were released to address unrelated security issue (#2816).
So you should be able to use one of those (they are essentially identical except for some Gradle users); these micro-patches are listed on:

https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13

@cowtowncoder cowtowncoder modified the milestones: 2.13.3, 2.13.2.1 Apr 1, 2022
@jonathan-caryl
Copy link

Thanks @cowtowncoder

@geekbeast
Copy link

geekbeast commented Apr 11, 2022 •
edited
Loading

Thanks @cowtowncoder! Also came here to report and was so happy to see there's already a fix in the micro-releases. Will report back if it works.

geekbeast added a commit to methodic-labs/chronicle that referenced this issue Apr 11, 2022
@geekbeast
Bump jackson version due to CVE and FasterXML/jackson-databind#3412
9599837
jpelgrom added a commit to jpelgrom/home-assistant-android that referenced this issue May 1, 2022
@jpelgrom
Fix crash on start app on SDK <26
4b98ecc 
 - Manually specify databind version to fix FasterXML/jackson-databind#3412, as the Kotlin module still depends on the unfixed version and hasn't had a new release yet
This was referenced May 1, 2022
Closed
Merged
JBassett pushed a commit to home-assistant/android that referenced this issue May 1, 2022
@jpelgrom
Fix crash on start app on SDK <26 (#2497)
f33743d 
- Manually specify databind version to fix FasterXML/jackson-databind#3412, as the Kotlin module still depends on the unfixed version and hasn't had a new release yet
@cowtowncoder cowtowncoder mentioned this issue May 25, 2022
Closed
@cowtowncoder cowtowncoder modified the milestones: 2.13.2.1, 2.13.3 May 25, 2022
@cowtowncoder
Copy link
Member

2.13.3 now released, upgrade recommended for Android users.

adhirajsinghchauhan added a commit to oxygen-updater/oxygen-updater that referenced this issue Jun 26, 2022
@adhirajsinghchauhan
Updated dependencies
cd35f2f 
Kotlin                    1.6.21 -> 1.7.0
Kotlin Coroutines         1.6.1  -> 1.6.3
Koin                      3.1.6  -> 3.2.0

Android Gradle Plugin     7.1.3  -> 7.2.1
Firebase Gradle Plugin    2.8.1  -> 2.9.1

AndroidX AppCompat        1.4.1 -> 1.4.2
AndroidX ConstraintLayout 2.1.3 -> 2.1.4
AndroidX Core             1.7.0 -> 1.8.0

Material Components       1.6.0-rc01 ->  1.6.1
Firebase BOM             29.3.1      -> 30.2.0
Play Services Ads        20.6.0      -> 21.0.0
Glide                     4.13.1     ->  4.13.2
Jackson Kotlin Module     2.13.2     ->  2.13.3 (fixes crashes on API < 26: FasterXML/jackson-databind#3412)

Also migrated from the monolithic Play Core library (1.10.3) to the Play In-App Updates library (2.0.0): https://developer.android.com/reference/com/google/android/play/core/release-notes#partitioned-apis. We weren't using any other Play Core feature.

Note: Google Services Plugin was not updated from 4.3.10 -> 4.3.12 because of https://issuetracker.google.com/issues/237071883.
@vitorpamplona vitorpamplona mentioned this issue Sep 23, 2022
Open
zarakarlsson628 added a commit to zarakarlsson628/android-gradle-common that referenced this issue Oct 19, 2022
@zarakarlsson628
Fix crash on start app on SDK <26 (#2497)
e5caeb0 
- Manually specify databind version to fix FasterXML/jackson-databind#3412, as the Kotlin module still depends on the unfixed version and hasn't had a new release yet
@vitalyster
Copy link

vitalyster commented Nov 11, 2022 •
edited
Loading

This is broken again in 2.14, or it was intended to drop Android <API26 support?

@vitalyster vitalyster mentioned this issue Nov 11, 2022
Merged
@jonnycaley jonnycaley mentioned this issue Nov 11, 2022
Closed
@cowtowncoder
Copy link
Member

cowtowncoder commented Nov 12, 2022 •
edited
Loading

@vitalyster Not fully intentional. I do wish that at least one Android developer had tested one of multiple release candidates so this was uncovered early enough to decide on which path to take.

However, reading through notes I think the idea was to postpone the compatibility change. I'll add notes to the new issue (#3658)

@cowtowncoder cowtowncoder mentioned this issue Dec 19, 2022
Closed
@seadowg seadowg mentioned this issue Feb 21, 2023
Closed
@lognaturel lognaturel mentioned this issue Feb 22, 2023
Closed
@MGlolenstine MGlolenstine mentioned this issue May 22, 2023
Open
@bekuno bekuno mentioned this issue Dec 30, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
android Issues related to use on Android platform
Projects
None yet
Milestone
2.13.3
Development

Successfully merging a pull request may close this issue.

Upgrade Jackson seadowg/javarosa
5 participants
@cowtowncoder @vitalyster @jonathan-caryl @geekbeast @finiasz