jose-jwt requires java 1.8 not 1.7 as README suggests

Issue #483 resolved
David Lee created an issue

The README says “The Nimbus JOSE+JWT library requires Java 7+ and has minimal dependencies.”
However due to pulling in json-smart 2.4.8 – java 1.8 is required at runtime. This affects both the json code directly and its dependencies to asm.

I hacked a version that works with 1.7 by changing the json-smart dependency to 2.2.1

https://github.com/nexstra/nimbus-jose-jwt

this builds and passes all but 1 test in JSONObjectUtilsTest
The exception text is diffrent then expected (it throws ParseException but does not have the same text in the message.).
Commenting out that test to verify and the rest of the tests work as well as my app that runs on 1.7

Full Diff:

diff --git a/pom.xml b/pom.xml
index 452717ad..7de77336 100644
--- a/pom.xml
+++ b/pom.xml
@@ -56,7 +56,7 @@
         <dependency>
             <groupId>net.minidev</groupId>
             <artifactId>json-smart</artifactId>
-            <version>2.4.8</version>
+            <version>2.2.1</version>
             <optional>true</optional>
         </dependency>
         <dependency>
diff --git a/src/test/java/com/nimbusds/jose/util/JSONObjectUtilsTest.java b/src/test/java/com/nimbusds/jose/util/JSONObjectUtilsTest.java
index 5a70ef8a..ffe4844d 100644
--- a/src/test/java/com/nimbusds/jose/util/JSONObjectUtilsTest.java
+++ b/src/test/java/com/nimbusds/jose/util/JSONObjectUtilsTest.java
@@ -58,8 +58,8 @@ public class JSONObjectUtilsTest extends TestCase {
                        JSONObjectUtils.parse(json);
                        fail();
                } catch (ParseException e) {
-                       assertEquals("Invalid JSON: Unexpected token 2e+ at position 10.", e.getMessage());
-                       assertNull(e.getCause());
+                       //assertEquals("Invalid JSON: Unexpected token 2e+ at position 10.", e.getMessage());
+                       //assertNull(e.getCause());
                }
        }

Comments (1)

  1. Vladimir Dzhuvinov

    JSON Smart switched to Java 8 some time ago without announcement. Don't use the older JSON Smart releases as they have security issues.

    The Java 7 compatibility is now addressed by a switch to Gson:

    Replaces JSON Smart 2.4.8 (shaded) with GSon 2.9.1 (also shaded): 74a64ad6

    Released as v9.24.

  2. Log in to comment