[
https://issues.apache.org/jira/browse/CAMEL-24306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101417#comment-18101417
]
Omar Atie edited comment on CAMEL-24306 at 8/3/26 3:28 PM:
-----------------------------------------------------------
h3. Investigation summary
This is not a Camel application-code issue. The ~206 build warnings come from
*transitive dependencies* calling terminally deprecated {{sun.misc.Unsafe}}
APIs when building/testing on newer JDKs (JDK 24+). Camel core does not appear
to call {{sun.misc.Unsafe}} directly.
The fix is an {*}umbrella dependency-hygiene task{*}: BOM upgrades, transitive
version overrides, and in some cases upstream waits or component policy
decisions — not a single-class patch.
h3. Suggested triage (24 dependencies from the description)
*Quick wins (Camel-controlled BOM / direct bumps):*
* *disruptor* 3.4.4 → 4.x (JIRA notes test-only; {{disruptor-version}} in
parent POM)
* *fory* — parent already at 1.5.0; ensure JDK 25+ uses the multi-release
artifact ([fory#3702|https://github.com/apache/fory/pull/3702])
* *avro* — parent BOM is 1.12.1 but 1.11.5 still appears on the classpath;
find the puller and override/exclude (AVRO-4317)
*Transitive overrides (need dependency:tree + management):*
* *jboss-threads* 2.3.6 / 3.7.0 → 3.9+
([jboss-threads#264|https://github.com/jboss/jboss-threads/issues/264]) —
likely via Undertow/WildFly stack
* *lucene-core* 3.6.2 — ancient copy from {{jackrabbit-core}}
({{{}camel-jcr{}}}); needs Jackrabbit upgrade or dependency review
* *byte-buddy* 1.18.11 — bump when upstream fixes land
([#1915|https://github.com/raphw/byte-buddy/issues/1915],
[#1922|https://github.com/raphw/byte-buddy/issues/1922])
*Blocked / policy / upstream-dependent:*
* *hazelcast* 5.4.0 — intentionally pinned in parent POM (CP subsystem); track
[hazelcast#26608|https://github.com/hazelcast/hazelcast/issues/26608]
* *jctools* (also shaded in Netty/Hazelcast) — upstream [closed without
fix|https://github.com/JCTools/JCTools/issues/395]; may not be eliminable soon
* *ehcache* 3.12 — planned for ehcache 4
([ehcache3#3151|https://github.com/ehcache/ehcache3/issues/3151])
* *undertow* 2.4.2 —
[UNDERTOW-2788|https://redhat.atlassian.net/browse/UNDERTOW-2788]
* *fastjson2, kryo, xstream, protobuf-java, pulsar-client, ignite-core,
protostream, compress-lzf, robotframework, truffle-api, flink-rpc-akka/pekko* —
evaluate per upstream release; many need version bumps outside Camel's direct
control
h3. Proposed approach
# Reproduce on JDK 25 with a full or representative {{mvn verify}} and capture
which *modules* emit warnings
# For each offender: {{mvn dependency:tree -Dincludes=groupId:artifactId}}
from the pulling module
# Split into PR-sized chunks:
** BOM-only bumps with targeted component tests
** Transitive overrides with enforcer/duplicate-finder validation
** Document remaining warnings as "upstream blocked" with linked issues
# Avoid JVM-wide suppression (e.g.
{{{}--sun-misc-unsafe-memory-access=allow{}}}) as the permanent fix —
acceptable only as a temporary CI workaround if needed
h3. Scope note
Expect *multiple PRs* over time, not one merge. Some items cannot be closed
until third-party releases land or Camel policy changes (e.g. Hazelcast pin).
—
was (Author: JIRAUSER313980):
h3. Investigation summary
This is not a Camel application-code issue. The ~206 build warnings come from
*transitive dependencies* calling terminally deprecated {{sun.misc.Unsafe}}
APIs when building/testing on newer JDKs (JDK 24+). Camel core does not appear
to call {{sun.misc.Unsafe}} directly.
The fix is an {*}umbrella dependency-hygiene task{*}: BOM upgrades, transitive
version overrides, and in some cases upstream waits or component policy
decisions — not a single-class patch.
h3. Suggested triage (24 dependencies from the description)
*Quick wins (Camel-controlled BOM / direct bumps):*
* *disruptor* 3.4.4 → 4.x (JIRA notes test-only; {{disruptor-version}} in
parent POM)
* *fory* — parent already at 1.5.0; ensure JDK 25+ uses the multi-release
artifact ([fory#3702|https://github.com/apache/fory/pull/3702])
* *avro* — parent BOM is 1.12.1 but 1.11.5 still appears on the classpath;
find the puller and override/exclude (AVRO-4317)
*Transitive overrides (need dependency:tree + management):*
* *jboss-threads* 2.3.6 / 3.7.0 → 3.9+
([jboss-threads#264|https://github.com/jboss/jboss-threads/issues/264]) —
likely via Undertow/WildFly stack
* *lucene-core* 3.6.2 — ancient copy from {{jackrabbit-core}}
({{{}camel-jcr{}}}); needs Jackrabbit upgrade or dependency review
* *byte-buddy* 1.18.11 — bump when upstream fixes land
([#1915|https://github.com/raphw/byte-buddy/issues/1915],
[#1922|https://github.com/raphw/byte-buddy/issues/1922])
*Blocked / policy / upstream-dependent:*
* *hazelcast* 5.4.0 — intentionally pinned in parent POM (CP subsystem); track
[hazelcast#26608|https://github.com/hazelcast/hazelcast/issues/26608]
* *jctools* (also shaded in Netty/Hazelcast) — upstream [closed without
fix|https://github.com/JCTools/JCTools/issues/395]; may not be eliminable soon
* *ehcache* 3.12 — planned for ehcache 4
([ehcache3#3151|https://github.com/ehcache/ehcache3/issues/3151])
* *undertow* 2.4.2 —
[UNDERTOW-2788|https://redhat.atlassian.net/browse/UNDERTOW-2788]
* *fastjson2, kryo, xstream, protobuf-java, pulsar-client, ignite-core,
protostream, compress-lzf, robotframework, truffle-api, flink-rpc-akka/pekko* —
evaluate per upstream release; many need version bumps outside Camel's direct
control
h3. Proposed approach
# Reproduce on JDK 25 with a full or representative {{mvn verify}} and capture
which *modules* emit warnings
# For each offender: {{mvn dependency:tree -Dincludes=groupId:artifactId}}
from the pulling module
# Split into PR-sized chunks:
** BOM-only bumps with targeted component tests
** Transitive overrides with enforcer/duplicate-finder validation
** Document remaining warnings as "upstream blocked" with linked issues
# Avoid JVM-wide suppression (e.g.
{{{}--sun-misc-unsafe-memory-access=allow{}}}) as the permanent fix —
acceptable only as a temporary CI workaround if needed
h3. Scope note
Expect *multiple PRs* over time, not one merge. Some items cannot be closed
until third-party releases land or Camel policy changes (e.g. Hazelcast pin).
Happy to take this if unassigned — would start with disruptor/fory/avro
alignment and a JDK 25 dependency audit spreadsheet matching the 24 entries
above.
—
> Remove usage of terminally deprecated method in sun.misc.Unsafe from
> dependencies
> ---------------------------------------------------------------------------------
>
> Key: CAMEL-24306
> URL: https://issues.apache.org/jira/browse/CAMEL-24306
> Project: Camel
> Issue Type: Task
> Affects Versions: 4.21.0
> Reporter: Aurélien Pupier
> Priority: Minor
>
> in build log we can see 206 times this sentence:
> WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
> 24 unique dependencies found using sun.misc.Unsafe terminally deprecated
> methods:
> || Dependency || Version || Called by || Related Issue ||
> | avro | 1.11.5 | sun.misc.Unsafe::objectFieldOffset has been called by
> org.apache.avro.reflect.FieldAccessUnsafe$UnsafeCachedField |
> https://issues.apache.org/jira/browse/AVRO-4317 |
> | byte-buddy | 1.18.11 | sun.misc.Unsafe::objectFieldOffset has been called
> by
> net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
> | https://github.com/raphw/byte-buddy/issues/1915
> https://github.com/raphw/byte-buddy/issues/1922 |
> | compress-lzf | 1.2.0 | sun.misc.Unsafe::arrayBaseOffset has been called by
> com.ning.compress.lzf.impl.UnsafeChunkEncoder |
> https://github.com/ning/compress/issues/86 |
> | disruptor | 3.4.4 | sun.misc.Unsafe::arrayBaseOffset has been called by
> com.lmax.disruptor.RingBufferFields |
> https://github.com/LMAX-Exchange/disruptor/issues/493 test only and should be
> fixed in version 4 (released in 2023...) |
> | ehcache | 3.12.0-jakarta | sun.misc.Unsafe::objectFieldOffset has been
> called by org.ehcache.impl.internal.concurrent.ThreadLocalRandomUtil |
> https://github.com/ehcache/ehcache3/issues/3151 planned for in ehcache 4 |
> | fastjson2 | 2.0.63 | sun.misc.Unsafe::arrayBaseOffset has been called by
> com.alibaba.fastjson2.util.JDKUtils |
> https://github.com/alibaba/fastjson2/issues/3996 |
> | flink-rpc-akka | (embedded hash) | sun.misc.Unsafe::objectFieldOffset has
> been called by org.apache.pekko.util.Unsafe |
> | fory-core | 1.4.0 | sun.misc.Unsafe::staticFieldOffset has been called by
> org.apache.fory.platform.internal._Lookup |
> https://github.com/apache/fory/pull/3702 multi-release jar available, so if
> launched with jdk 25 it should not appear |
> | hazelcast | 5.4.0 | sun.misc.Unsafe::objectFieldOffset has been called by
> com.hazelcast.shaded.org.jctools.util.UnsafeAccess |
> https://github.com/hazelcast/hazelcast/issues/26608 |
> | ignite-core | 2.18.0 | sun.misc.Unsafe::arrayBaseOffset has been called by
> org.apache.ignite.internal.util.GridUnsafe |
> | java-driver-guava-shaded | 4.19.3 | sun.misc.Unsafe::objectFieldOffset has
> been called by
> com.datastax.oss.driver.shaded.guava.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper
> |
> | jboss-threads | 2.3.6.Final | sun.misc.Unsafe::objectFieldOffset has been
> called by org.jboss.threads.JBossExecutors |
> https://github.com/jboss/jboss-threads/issues/264 requires upgrades to 3.9+ |
> | jboss-threads | 3.7.0.Final | sun.misc.Unsafe::objectFieldOffset has been
> called by org.jboss.threads.JBossExecutors |
> https://github.com/jboss/jboss-threads/issues/264 requires upgrades to 3.9+ |
> | jctools-core | 4.0.6 | sun.misc.Unsafe::objectFieldOffset has been called
> by org.jctools.util.UnsafeAccess |
> https://github.com/JCTools/JCTools/issues/395 closed like they won't do and
> suggest to use other libraries?|
> | kryo | 5.6.2 | sun.misc.Unsafe::arrayBaseOffset has been called by
> com.esotericsoftware.kryo.unsafe.UnsafeUtil |
> | lucene-core | 3.6.2 | sun.misc.Unsafe::objectFieldOffset has been called by
> org.apache.lucene.util.RamUsageEstimator | to test with recent versions, this
> one is from 2012, curren tis 10.5.0 , dependncy comes from camel-jcr ->
> [jackrabbit-core ->
> lucene-core|https://github.com/apache/jackrabbit/blame/4d897482f6c4c3c4e55212996aa3ed0fe491eca6/jackrabbit-parent/pom.xml#L495]|
> | netty-common | 4.2.16.Final | sun.misc.Unsafe::objectFieldOffset has been
> called by io.netty.util.internal.shaded.org.jctools.util.UnsafeAccess |
> | protobuf-java | 4.34.2 | sun.misc.Unsafe::arrayBaseOffset has been called
> by com.google.protobuf.UnsafeUtil |
> | protostream | 6.0.9 | sun.misc.Unsafe::staticFieldOffset has been called by
> org.infinispan.protostream.impl.StringUtil |
> | pulsar-client | 4.2.3 | sun.misc.Unsafe::allocateMemory has been called by
> org.apache.pulsar.shade.io.netty.util.internal.PlatformDependent0$2 |
> | robotframework | 4.1.2 | sun.misc.Unsafe::objectFieldOffset has been called
> by org.python.google.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper
> |
> | truffle-api | 25.2.4 | sun.misc.Unsafe::objectFieldOffset has been called
> by com.oracle.truffle.api.nodes.NodeClassImpl$NodeFieldData |
> | undertow-core | 2.4.2.Final | sun.misc.Unsafe::invokeCleaner has been
> called by io.undertow.server.DirectByteBufferDeallocator |
> https://redhat.atlassian.net/browse/UNDERTOW-2788 |
> | xstream | 1.4.21 | sun.misc.Unsafe::objectFieldOffset has been called by
> com.thoughtworks.xstream.converters.reflection.SunUnsafeReflectionProvider |
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
