Escaping Maven dependency hell
Blog post from Stainless
Stainless encountered unexpected challenges while generating Java SDKs due to differences in how Gradle and Maven resolve dependency versions, specifically with Jackson, a widely-used JSON library. The issue arose when OpenAI's updated API led to deserialization errors in older SDKs that depended on outdated Jackson versions, revealing the limitations of Maven's dependency resolution. Stainless explored various solutions, including using version ranges, shading, and downgrading dependencies, but each had drawbacks. Ultimately, they rewrote a feature to ensure compatibility with Jackson 2.13.4, maintained their declared version as 2.18.1 for security, and implemented runtime checks to alert users of incompatible versions, effectively resolving the problem and satisfying their requirements for minimal forced upgrades, immediate error detection, and no degradation in developer experience.