Dependency on JavaMail

[Former user]

We noticed that Nimbus-Jose-JWT has a runtime dependency on JavaMail. This is quite strange given that we don't see any relation with mailing support in Java. Moreover, when we remove mail.jar from the classpath, we observe the following exception:

java.lang.NoClassDefFoundError: javax.mail.internet.ParameterList at com.nimbusds.jose.JOSEObject.<clinit>(JOSEObject.java:41) at java.lang.J9VMInternals.initializeImpl(Native Method) at java.lang.J9VMInternals.initialize(J9VMInternals.java:228) at java.lang.J9VMInternals.initialize(J9VMInternals.java:195) at testNimbus.TestNimbus.main(TestNimbus.java:50) Caused by: java.lang.ClassNotFoundException: javax.mail.internet.ParameterList at java.net.URLClassLoader.findClass(URLClassLoader.java:599) at java.lang.ClassLoader.loadClassHelper(ClassLoader.java:713) at java.lang.ClassLoader.loadClass(ClassLoader.java:681) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:325) at java.lang.ClassLoader.loadClass(ClassLoader.java:660) ... 5 more

which suggests that Nimbus only uses elements from javax.mail for utility classes, which should be easily avoidable.

We are bringing this up because we are facing a number of challenges getting legal clearance to use JavaMail in our products. Any chance the dependency could be removed?

[Vladimir Dzhuvinov]

Hi Simon,

This had been fixed in the dev branch, and will be part of the next stable release which is scheduled for tomorrow. I'll post here when it comes out so you can get it from Maven Central.

[Former user]

Excellent. Thanks Vladimir!

[Vladimir Dzhuvinov]

The new release is out (2.23), you can get it from Maven Central or from the download section.

Cheers,

Vladimir