`ThinJarWrapper` can not run when project indirect dependencies from `nimbus-jose-jwt` which depended by `spring-security-oauth2-client`

It can not run with ThinJarWrapper when project indirect dependencies like this from nimbus-jose-jwt which depended by spring-security-oauth2-client

<dependency>
  <groupId>net.minidev</groupId>
  <artifactId>json-smart</artifactId>
  <version>[1.3.1,2.3]</version>
</dependency>
<dependency>
  <groupId>org.bouncycastle</groupId>
  <artifactId>bcprov-jdk15on</artifactId>
  <version>[1.52,)</version>
  <optional>true</optional>
</dependency>
<dependency>
  <groupId>org.bouncycastle</groupId>
  <artifactId>bcpkix-jdk15on</artifactId>
  <version>[1.52,)</version>
  <optional>true</optional>
</dependency>

dependencies dir resolve like this:

json-smart
  1.3.1
  2.0
  2.0-RC1
  2.0-RC2
  2.0-RC3
  2.1.0
  2.1.1
  2.2
  2.2.1
  2.3
  maven-metadata-alimaven.xml
  maven-metadata-alimaven.xml.sha1
  maven-metadata-central.xml
  maven-metadata-central.xml.sha1
  maven-metadata-spring-snapshots.xml
  maven-metadata-spring-snapshots.xml.sha1
  resolver-status.properties

cause by:

Exception in thread "main" java.lang.reflect.InvocationTargetException
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.springframework.boot.loader.wrapper.ThinJarWrapper.launch(ThinJarWrapper.java:139)
	at org.springframework.boot.loader.wrapper.ThinJarWrapper.main(ThinJarWrapper.java:107)
Caused by: java.lang.RuntimeException: Cannot access alimaven (https://maven.aliyun.com/repository/public) in offline mode and the artifact net.minidev:json-smart:jar:2.3 has not been downloaded from it before.
Cannot access alimaven (https://maven.aliyun.com/repository/public) in offline mode and the artifact com.nimbusds:lang-tag:jar:1.5 has not been downloaded from it before.
	at org.springframework.boot.loader.thin.DependencyResolver.dependencies(DependencyResolver.java:222)
	at org.springframework.boot.loader.thin.PathResolver.extract(PathResolver.java:259)
	at org.springframework.boot.loader.thin.PathResolver.resolve(PathResolver.java:105)
	at org.springframework.boot.loader.thin.ThinJarLauncher.getClassPathArchives(ThinJarLauncher.java:343)
	at org.springframework.boot.loader.thin.ThinJarLauncher.getClassPathArchives(ThinJarLauncher.java:330)
	at org.springframework.boot.loader.Launcher.launch(Launcher.java:49)
	at org.springframework.boot.loader.thin.ThinJarLauncher.launch(ThinJarLauncher.java:187)
	at org.springframework.boot.loader.thin.ThinJarLauncher.main(ThinJarLauncher.java:140)
	... 6 more

[dsyer]

I raised this with the nimbus team some time ago, and I thought they had fixed it (https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/283/dependency-failing-when-used-with-latest). They shouldn’t be using version ranges in a library like that - it will cause unstable builds for other projects. But I guess we can maybe do something here. Can you make a minimal sample app and paste a link to a github repo here?

[PC-Chiu]

Yeh, I tried to update and combine multiple versions of the JDK, Spring Boot, It only happens Spring Boot version below 2.3.x with spring-boot-starter-oauth2-client, As I use 2.2.10.RELEASE, the oauth2-oidc-sdk version 6.14 using version ranges in the library like this:

<dependency>
	<groupId>net.minidev</groupId>
	<artifactId>json-smart</artifactId>
	<version>[1.3.1,2.3]</version>
</dependency>
<dependency>
	<groupId>com.nimbusds</groupId>
	<artifactId>lang-tag</artifactId>
	<version>[1.4.3,)</version>
</dependency>
<dependency>
	<groupId>com.nimbusds</groupId>
	<artifactId>nimbus-jose-jwt</artifactId>
	<version>[6.0.1,)</version>
</dependency>

dependencies dir resolve like this:

json-smart
  1.3.1
  2.0
  2.0-RC1
  2.0-RC2
  2.0-RC3
  2.1.0
  2.1.1
  2.2
  2.2.1
  2.3
  maven-metadata-alimaven.xml
  maven-metadata-alimaven.xml.sha1
  maven-metadata-central.xml
  maven-metadata-central.xml.sha1
  maven-metadata-spring-snapshots.xml
  maven-metadata-spring-snapshots.xml.sha1
  resolver-status.properties

When I upgraded to Spring Boot 2.3/2.4 with spring-boot-starter-oauth2-client, all problem go away.

Thanks a lot, I will upgrade to Spring Boot 2.3 or 2.4 to solve the problem.