Loading application.yml fails with NoSuchMethodError when using SnakeYAML 2.0

[flashvayne]

When I upgrade snakeyaml from 1.33 to 2.0 version, Springboot Application run failed as below.
I have tried springboot 2.7.4 and 3.0.0, neither works.
Also I have tried JDK 8,11 and 17, none works.

• snakeyaml dependency

<dependency>
    <groupId>org.yaml</groupId>
    <artifactId>snakeyaml</artifactId>
    <version>2.0</version>
</dependency>

• Error log

11:28:31.187 [main] ERROR org.springframework.boot.SpringApplication - Application run failed
java.lang.NoSuchMethodError: org.yaml.snakeyaml.representer.Representer: method 'void <init>()' not found
    at org.springframework.boot.env.OriginTrackedYamlLoader.createYaml(OriginTrackedYamlLoader.java:76)
    at org.springframework.boot.env.OriginTrackedYamlLoader.createYaml(OriginTrackedYamlLoader.java:71)
    at org.springframework.beans.factory.config.YamlProcessor.process(YamlProcessor.java:164)
    at org.springframework.boot.env.OriginTrackedYamlLoader.load(OriginTrackedYamlLoader.java:84)
    at org.springframework.boot.env.YamlPropertySourceLoader.load(YamlPropertySourceLoader.java:50)
    at org.springframework.boot.context.config.StandardConfigDataLoader.load(StandardConfigDataLoader.java:54)
    at org.springframework.boot.context.config.StandardConfigDataLoader.load(StandardConfigDataLoader.java:36)
    at org.springframework.boot.context.config.ConfigDataLoaders.load(ConfigDataLoaders.java:107)
    at org.springframework.boot.context.config.ConfigDataImporter.load(ConfigDataImporter.java:128)
    at org.springframework.boot.context.config.ConfigDataImporter.resolveAndLoad(ConfigDataImporter.java:86)
    at org.springframework.boot.context.config.ConfigDataEnvironmentContributors.withProcessedImports(ConfigDataEnvironmentContributors.java:116)
    at org.springframework.boot.context.config.ConfigDataEnvironment.processInitial(ConfigDataEnvironment.java:240)
    at org.springframework.boot.context.config.ConfigDataEnvironment.processAndApply(ConfigDataEnvironment.java:227)
    at org.springframework.boot.context.config.ConfigDataEnvironmentPostProcessor.postProcessEnvironment(ConfigDataEnvironmentPostProcessor.java:102)
    at org.springframework.boot.context.config.ConfigDataEnvironmentPostProcessor.postProcessEnvironment(ConfigDataEnvironmentPostProcessor.java:94)
    at org.springframework.boot.env.EnvironmentPostProcessorApplicationListener.onApplicationEnvironmentPreparedEvent(EnvironmentPostProcessorApplicationListener.java:102)
    at org.springframework.boot.env.EnvironmentPostProcessorApplicationListener.onApplicationEvent(EnvironmentPostProcessorApplicationListener.java:87)
    at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:176)
    at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:169)
    at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:143)
    at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:131)
    at org.springframework.boot.context.event.EventPublishingRunListener.environmentPrepared(EventPublishingRunListener.java:85)
    at org.springframework.boot.SpringApplicationRunListeners.lambda$environmentPrepared$2(SpringApplicationRunListeners.java:66)
    at java.base/java.util.ArrayList.forEach(ArrayList.java:1541)
    at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:120)
    at org.springframework.boot.SpringApplicationRunListeners.doWithListeners(SpringApplicationRunListeners.java:114)
    at org.springframework.boot.SpringApplicationRunListeners.environmentPrepared(SpringApplicationRunListeners.java:65)
    at org.springframework.boot.SpringApplication.prepareEnvironment(SpringApplication.java:343)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:301)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1317)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1306)
    at cc.vayne.Application.main(Application.java:10)

[wilkinsona]

As far as we know, the problem above should only occur with Spring Boot 2.7. While not officially supported, the failure above should not occur with SnakeYAML 2.0 and Spring Boot 3.0. Can you please provide a minimal sample that shows a failure with Spring Boot 3.0.3 and SnakeYAML 2.0?

[DRoppelt]

@wilkinsona would you consider supporting a backport of this change to the 2.7.X line? bf5bd4f#diff-07741e308f54bc7fc66aabb0a1594c1ff8a9785103fb8cdf4c930ad3b44ed2c6

I would submit a PR?

It appears to be both compatible with snakeyaml 1.30 and 2.0

I cannot chime in for reproducing this with spring boot 3.0, we also have this issue with some services that are stuck on 2.7.X (tested with 2.7.9), but would like to upgrade to snakeyaml 2.0 due to the safe defaults it is bringing (not related to spring, but just usage within the app).

[flashvayne]

It seems I made a mistake while test with SnakeYAML 2.0 and Spring Boot 3.0. It actually works with Spring Boot 3.0.
Also would you consider supporting SnakeYAML 2.0 in Spring Boot 2.7.X?

[wilkinsona]

@DRoppelt Yes, that's a change that we're considering: wilkinsona@6aa1ce7. It will require further testing and we'll also have to decide how much support we want to add for SnakeYAML 2.0 in maintenance releases.

[dvag-joerg-winter]

@wilkinsona Hi !
"... While not officially supported, the failure above should not occur with SnakeYAML 2.0 and Spring Boot 3.0"

Since there is a Secuurity-Alert for snakeyaml (and we'd like to upgrade to snakeyaml 2.0 by including it top-level dependencies to fix the alert), could you elaborate a bit, what Spring's recommendation is in this regard ?