Javaassist dependencies conflict potentially breaks frontend build

[mcollovati]

When building for production, Flow plugins use an implementation of ClassFinder based on the org.reflections:reflections library, that in turn depends on org.javassist:javassist.
The javaassist version required at runtime is pinned by the plugin itself.

However, if javassist is also defined as project dependency, it could happen that class scan silently ignores some JARs because of Java version incompatibilities.

This may lead to the build succeeding, but the application not working properly at runtime because of missing frontend resource.

ERROR c.v.f.c.internal.UIInternals - The component class com.vaadin.flow.component.UI includes '@vaadin/common-frontend/ConnectionIndicator.js' but this file was not included when creating the production bundle. The component will not work properly. Check that you have a reference to the component and that you are not using it only through reflection. If needed add a @Uses(UI.class) where it is used.

The error could happen in Reflections.scan() when classes are loaded from the JAR files, and unfortunately, errors are logged at TRACE level and not visible during a Maven build even if the debug flag is on (-X)

} catch (Exception e) {
    if (log != null) log.trace("could not scan file {} with scanner {}", file.getRelativePath(), scanner.getClass().getSimpleName(), e);
}

There are two possible incompatibilities causes:

• the project defined org.javassist:javassist dependency is older than the one expected by the Flow plugin
• the project defines the dependency with using a deprecated groupId: javassist:javassist.

In the first case, the incompatibility is printed to the console during build.
However, in the second case, no warnings are provided because the artifact coordinates are different.

The Flow plugin should always use its own defined version of org.javassist:javassist, and ignore the javassist:javassist dependency when building the class loader used for class scan.

[Artur-]

Maybe time for Classgraph instead of reflections, or does it also use javassist? See #19543