Incompatible woodstox-core and stax2-api dependencies

2.9.9 upgraded to woodstox-core 5.1 which depends on stax2-api 4.1 but it still depends directly on stax2-api 3.1.4. As a result, when using Maven, a dependency on jackson-dataformat-xml results in an incompatible combination of versions of woodstox-core and stax2-api and a NoSuchMethodError results when also using Hibernate:

…
Caused by: java.lang.NoSuchMethodError: org.codehaus.stax2.ri.SingletonIterator.create(Ljava/lang/Object;)Lorg/codehaus/stax2/ri/SingletonIterator;
	at com.ctc.wstx.util.DataUtil.singletonIterator(DataUtil.java:41)
	at com.ctc.wstx.evt.CompactStartElement.getAttributes(CompactStartElement.java:100)
	at org.hibernate.boot.jaxb.internal.stax.JpaOrmXmlEventReader.existingXmlAttributesIterator(JpaOrmXmlEventReader.java:112)
	at org.hibernate.boot.jaxb.internal.stax.JpaOrmXmlEventReader.mapAttributes(JpaOrmXmlEventReader.java:100)
	at org.hibernate.boot.jaxb.internal.stax.JpaOrmXmlEventReader.wrap(JpaOrmXmlEventReader.java:84)
	at org.hibernate.boot.jaxb.internal.stax.JpaOrmXmlEventReader.wrap(JpaOrmXmlEventReader.java:74)
	at org.hibernate.boot.jaxb.internal.stax.JpaOrmXmlEventReader.peek(JpaOrmXmlEventReader.java:63)
	at org.dom4j.io.STAXEventReader.readElement(STAXEventReader.java:315)
	at org.dom4j.io.STAXEventReader.readNode(STAXEventReader.java:198)
	at org.hibernate.boot.jaxb.internal.MappingBinder$1.readNode(MappingBinder.java:104)
	at org.dom4j.io.STAXEventReader.readDocument(STAXEventReader.java:275)
	at org.hibernate.boot.jaxb.internal.MappingBinder.toDom4jDocument(MappingBinder.java:108)
	at org.hibernate.boot.jaxb.internal.MappingBinder.doBind(MappingBinder.java:71)
	at org.hibernate.boot.jaxb.internal.AbstractBinder.doBind(AbstractBinder.java:102)
	at org.hibernate.boot.jaxb.internal.AbstractBinder.bind(AbstractBinder.java:57)
	at org.hibernate.boot.jaxb.internal.InputStreamXmlSource.doBind(InputStreamXmlSource.java:43)
	at org.hibernate.boot.jaxb.internal.InputStreamXmlSource.doBind(InputStreamXmlSource.java:38)
	at org.hibernate.boot.spi.XmlMappingBinderAccess.bind(XmlMappingBinderAccess.java:79)
	at org.hibernate.boot.model.process.internal.ScanningCoordinator.applyScanResultsToManagedResources(ScanningCoordinator.java:220)
	at org.hibernate.boot.model.process.internal.ScanningCoordinator.coordinateScan(ScanningCoordinator.java:82)
	at org.hibernate.boot.model.process.spi.MetadataBuildingProcess.prepare(MetadataBuildingProcess.java:98)
	at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.<init>(EntityManagerFactoryBuilderImpl.java:234)
	at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.<init>(EntityManagerFactoryBuilderImpl.java:167)
	at org.springframework.orm.jpa.vendor.SpringHibernateJpaPersistenceProvider.createContainerEntityManagerFactory(SpringHibernateJpaPersistenceProvider.java:51)
	at org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean.createNativeEntityManagerFactory(LocalContainerEntityManagerFactoryBean.java:365)
	at org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.buildNativeEntityManagerFactory(AbstractEntityManagerFactoryBean.java:390)
	at org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.afterPropertiesSet(AbstractEntityManagerFactoryBean.java:377)
	at org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean.afterPropertiesSet(LocalContainerEntityManagerFactoryBean.java:341)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1842)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1779)
	... 72 more

[usulkies]

Temporary workaround: use mvn dependency:tree to make sure Jackson-dataformat-xml is the only user of the stax2-api After assuring that, add this to dependency management section in your pom.xml:

<dependency> <!-- Workaround for jackson-dataformat-xml issue #340 of forgetting to update stax2-api  -->  
  <groupId>org.codehaus.woodstox</groupId>  
  <artifactId>stax2-api</artifactId>  
  <version>4.1</version>  
</dependency>

[baharclerode]

@dadoonet FYI, dependencyConvergence won’t catch this because jackson-dataformat-xml does actually specify a version, so the versions do converge. What would’ve caught this is the requireUpperBounds enforcer rule, which will prevent a module from pulling in an older version than one of its dependencies (unless explicitly excluded)