Skip to content

[improve][build] Upgrade Gson to 2.14.0 and json-smart to 2.6.0 - #26355

Merged
nodece merged 2 commits into
apache:masterfrom
lhotari:lh-improve-gson-json-smart
Aug 18, 2026
Merged

[improve][build] Upgrade Gson to 2.14.0 and json-smart to 2.6.0#26355
nodece merged 2 commits into
apache:masterfrom
lhotari:lh-improve-gson-json-smart

Conversation

@lhotari

@lhotari lhotari commented Aug 17, 2026

Copy link
Copy Markdown
Member

Motivation

Gson and json-smart are behind. Gson 2.14.0 in particular contains behaviour changes that are worth
landing on their own, separately from other dependency updates, so they are easy to bisect and
revert.

Modifications

gradle/libs.versions.toml:

library from to
gson 2.13.2 2.14.0
json-smart 2.5.2 2.6.0

Plus the corresponding jar names in the server and shell distribution LICENSE.bin.txt files.

Gson 2.14.0 behaviour changes — please review with these in mind

Gson parses externally supplied JSON in several places in Pulsar (function and connector
configuration, admin CLI input, the Kubernetes runtime), so these are the changes that matter:

  1. Duplicate member names in a JSON object are now rejected. Input such as
    {"foo": 1, "foo": 2} previously parsed with last-key-wins and now throws.
  2. Strings parsed as integers must consist of ASCII characters.
  3. java.time types now have built-in adapters. Gson no longer reflects into the private fields
    of Instant, Duration and friends. This removes the need for --add-opens for those classes,
    and can change the serialized form of any such field that previously went through reflection.
  4. The internal nested types in GsonTypes (ParameterizedTypeImpl, GenericArrayTypeImpl,
    WildcardTypeImpl) are no longer Serializable, and the unreleased com.google.gson.graph
    package was removed.

Neither library changes its Java 8 baseline.

Jackson is not part of this change

Jackson stays on the 2.21 LTS line (2.21.6 / annotations 2.21). 2.22 was tried in #26101 and reverted
in #26166.

Verifying this change

  • Make sure that the change passes the CI checks.

This change is already covered by existing tests. Verified locally:

  • ./gradlew sanityCheck and ./gradlew checkBinaryLicense
  • pulsar-functions-utils full test suite (154 tests) — green
  • pulsar-client-admin-original full test suite (64 tests) — green

Both of those modules are heavy Gson users.

Does this pull request potentially affect one of the following parts:

  • Dependencies (add or upgrade a dependency)
  • The public API
  • The schema
  • The default values of configurations
  • The threading model
  • The binary protocol
  • The REST endpoints
  • The admin CLI options
  • The metrics
  • Anything that affects deployment

Not a schema change in the Pulsar sense, but note the JSON parsing behaviour changes listed above.

- gson        2.13.2 -> 2.14.0
- json-smart  2.5.2  -> 2.6.0

Gson 2.14.0 contains behavior changes worth calling out for reviewers, since Gson parses
externally supplied JSON in several places (function and connector configuration, admin
CLI input, the Kubernetes runtime):

- Duplicate member names in a JSON object are now rejected. Input such as
  {"foo": 1, "foo": 2} used to parse with last-key-wins and now throws.
- Strings parsed as integers must consist of ASCII characters.
- java.time types (Instant, Duration and friends) now have built-in adapters, so Gson no
  longer reflects into their private fields. This removes the need for --add-opens for
  those classes, and changes the serialized form for any field that previously went
  through reflection.
- The internal nested types in GsonTypes (ParameterizedTypeImpl, GenericArrayTypeImpl,
  WildcardTypeImpl) are no longer Serializable, and the unreleased com.google.gson.graph
  package was removed.

jackson is deliberately left on the 2.21 LTS line and is not part of this change.

Neither Gson nor json-smart changes its Java 8 baseline.

Assisted-by: Claude Code (Opus 5)
@lhotari lhotari added this to the 5.0.0-M2 milestone Aug 17, 2026
@lhotari lhotari added the area/dependency Pull requests that update a dependency file label Aug 17, 2026
@nodece
nodece merged commit 81722ee into apache:master Aug 18, 2026
42 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/dependency Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants