Snakeyml 2.1 compatibility issue with shardingsphere-jdbc-core-spring-boot-starter 5.2.1

[shubham741]

Tech Stack - Java 17, Springboot 3.1.2, Spring Framework 6, shardingsphere-jdbc-core-spring-boot-starter 5.2.1
Exception -

Caused by: java.lang.NoSuchMethodError: org.yaml.snakeyaml.representer.Representer: method 'void ()' not found
at org.apache.shardingsphere.infra.util.yaml.representer.ShardingSphereYamlRepresenter.(ShardingSphereYamlRepresenter.java:41) ~[shardingsphere-infra-util-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.infra.util.yaml.YamlEngine.marshal(YamlEngine.java:113) ~[shardingsphere-infra-util-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.mode.metadata.persist.service.config.global.PropertiesPersistService.persist(PropertiesPersistService.java:45) ~[shardingsphere-mode-core-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.mode.metadata.persist.service.config.global.PropertiesPersistService.conditionalPersist(PropertiesPersistService.java:39) ~[shardingsphere-mode-core-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.mode.metadata.persist.MetaDataPersistService.persistConfigurations(MetaDataPersistService.java:86) ~[shardingsphere-mode-core-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.mode.manager.standalone.StandaloneContextManagerBuilder.persistConfigurations(StandaloneContextManagerBuilder.java:55) ~[shardingsphere-standalone-mode-core-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.mode.manager.standalone.StandaloneContextManagerBuilder.build(StandaloneContextManagerBuilder.java:46) ~[shardingsphere-standalone-mode-core-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.driver.jdbc.core.datasource.ShardingSphereDataSource.createContextManager(ShardingSphereDataSource.java:76) ~[shardingsphere-jdbc-core-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.driver.jdbc.core.datasource.ShardingSphereDataSource.(ShardingSphereDataSource.java:64) ~[shardingsphere-jdbc-core-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.driver.api.ShardingSphereDataSourceFactory.createDataSource(ShardingSphereDataSourceFactory.java:93) ~[shardingsphere-jdbc-core-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.spring.boot.ShardingSphereAutoConfiguration.shardingSphereDataSource(ShardingSphereAutoConfiguration.java:91) ~[shardingsphere-jdbc-core-spring-boot-starter-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.spring.boot.ShardingSphereAutoConfiguration$$SpringCGLIB$$0.CGLIB$shardingSphereDataSource$2() ~[shardingsphere-jdbc-core-spring-boot-starter-5.2.1.jar:5.2.1]
at org.apache.shardingsphere.spring.boot.ShardingSphereAutoConfiguration$$SpringCGLIB$$2.invoke() ~[shardingsphere-jdbc-core-spring-boot-starter-5.2.1.jar:5.2.1]
at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258) ~[spring-core-6.0.11.jar:6.0.11]
at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:331) ~[spring-context-6.0.11.jar:6.0.11]
at org.apache.shardingsphere.spring.boot.ShardingSphereAutoConfiguration$$SpringCGLIB$$0.shardingSphereDataSource() ~[shardingsphere-jdbc-core-spring-boot-starter-5.2.1.jar:5.2.1]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:568) ~[?:?]
at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:139) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:655) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:647) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1332) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1162) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:560) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:520) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:326) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:324) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:200) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.config.DependencyDescriptor.resolveCandidate(DependencyDescriptor.java:254) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1417) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:1337) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.ConstructorResolver.resolveAutowiredArgument(ConstructorResolver.java:888) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:791) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:550) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1332) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1162) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:560) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:520) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:326) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:324) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:200) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.config.DependencyDescriptor.resolveCandidate(DependencyDescriptor.java:254) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1417) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:1337) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.autowireByType(AbstractAutowireCapableBeanFactory.java:1498) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1407) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:597) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:520) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:326) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:324) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:200) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.config.DependencyDescriptor.resolveCandidate(DependencyDescriptor.java:254) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1417) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:1337) ~[spring-beans-6.0.11.jar:6.0.11]
at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.resolveFieldValue(AutowiredAnnotationBeanPostProcessor.java:713) ~[spring-beans-6.0.11.jar:6.0.11]

[dongguo4812]

org.yaml snakeyaml 1.33

[shubham741]

@dongguo4812 I don't want to use 1.33 as it has vulnerabilities. I want to use snakeyml 2.1 only.

[santosh0403088]

@dongguo4812 as it's already running with snakeyaml 1.33 (vulnerable). Is there any way to fix this issue with snakeyaml 2.x

[dongguo4812]

upgrading the version of shardingsphere can solve this problem

[linghengqian]

• Since shardingsphere-jdbc-core-spring-boot-starter is no longer maintained, the answer to this question is obviously no. See Removing Spring configuration from ShardingSphere #22469 .

• On the shardingsphere-jdbc-core side, the issue for updating SnakeYAML is located at Upgrade snakeyaml to 2.0 #24636 , which is blocked by the Release process of the sub-project.

• In the master branch of ShardingSphere, the SnakeYAML package has been shaded, which means that on ShardingSphere 5.4.1, there should no longer have SnakeYAML compatibility issues.

• Considering that the release of ShardingSphere ElasticJob must be done on the mailing list, I encourage friends in need to initiate discussions in this regard on the dev mailing list. Obviously, the Committer team spends most of their time solving the issues of ShardingSphere itself, which makes ElasticJob lack some reasonable maintenance.

[github-actions]

There hasn't been any activity on this issue recently, and in order to prioritize active issues, it will be marked as stale.

[raycoarana]

• Since shardingsphere-jdbc-core-spring-boot-starter is no longer maintained, the answer to this question is obviously no. See Removing Spring configuration from ShardingSphere #22469 .
• On the shardingsphere-jdbc-core side, the issue for updating SnakeYAML is located at Upgrade snakeyaml to 2.0 #24636 , which is blocked by the Release process of the sub-project.
• In the master branch of ShardingSphere, the SnakeYAML package has been shaded, which means that on ShardingSphere 5.4.1, there should no longer have SnakeYAML compatibility issues.
• Considering that the release of ShardingSphere ElasticJob must be done on the mailing list, I encourage friends in need to initiate discussions in this regard on the dev mailing list. Obviously, the Committer team spends most of their time solving the issues of ShardingSphere itself, which makes ElasticJob lack some reasonable maintenance.

Hi @linghengqian, from what I see in 5.4.1 the issue is not solved, SnakeYAML is only shaded in agent/core module, but not in infra/util module (the actual error in this issue). Are you aware of that?

[linghengqian]

• @raycoarana PRs for the shaded package are not related to me. Shardingsphere is strongly dependent on the SnakeYAML API. If you have any ideas, you will need to open a new issue.