GitLab gemnasium-maven analyzer v3.11.1 fails dependency scan due to unsupported class file major version 61

Question

I'm attempting to setup GitLab dependency scanning for a repository in my self-hosted GitLab server. I have included the job template and the test stage since I have overridden the stage clause. The job starts, but it fails soon after. When I set the variable SECURE_LOG_LEVEL to debug I see the following output.

$ /analyzer run
Using java version 'adoptopenjdk-17.0.2+8'
[INFO] [gemnasium-maven] [2023-01-28T15:21:00Z] [/go/src/app/cmd/gemnasium-maven/main.go:55] ▶ GitLab gemnasium-maven analyzer v3.11.1
[DEBU] [gemnasium-maven] [2023-01-28T15:21:00Z] [/go/src/app/finder/finder.go:64] ▶ inspect directory: .
[DEBU] [gemnasium-maven] [2023-01-28T15:21:00Z] [/go/src/app/finder/finder.go:96] ▶ skip ignored directory: .git
[DEBU] [gemnasium-maven] [2023-01-28T15:21:00Z] [/go/src/app/finder/detect.go:84] ▶ Selecting gradle for maven because this is the first match
[INFO] [gemnasium-maven] [2023-01-28T15:21:00Z] [/go/src/app/finder/finder.go:116] ▶ Detected supported dependency files in '.'. Dependency files detected in this directory will be processed. Dependency files in other directories will be skipped.
[DEBU] [gemnasium-maven] [2023-01-28T15:21:00Z] [/go/src/app/cmd/gemnasium-maven/main.go:234] ▶ Exporting dependencies for /path/to/my/app/build.gradle
[DEBU] [gemnasium-maven] [2023-01-28T15:21:05Z] [/go/src/app/builder/gradle/gradle.go:85] ▶ /path/to/my/app/gradlew --init-script /gemnasium-gradle-plugin-init.gradle gemnasiumDumpDependencies
Downloading https://services.gradle.org/distributions/gradle-7.1.1-bin.zip
..........10%...........20%...........30%..........40%...........50%...........60%..........70%...........80%...........90%...........100%
Welcome to Gradle 7.1.1!
Here are the highlights of this release:

- Faster incremental Java compilation
- Easier source set configuration in the Kotlin DSL
  For more details see https://docs.gradle.org/7.1.1/release-notes.html
  Starting a Gradle Daemon (subsequent builds will be faster)
  FAILURE: Build failed with an exception.

* Where:
  Initialization script '/gemnasium-gradle-plugin-init.gradle'
* What went wrong:
  Could not compile initialization script '/gemnasium-gradle-plugin-init.gradle'.

  > startup failed:
  > General error during conversion: Unsupported class file major version 61

  java.lang.IllegalArgumentException: Unsupported class file major version 61
  at groovyjarjarasm.asm.ClassReader.<init>(ClassReader.java:189)
  at groovyjarjarasm.asm.ClassReader.<init>(ClassReader.java:170)
  at groovyjarjarasm.asm.ClassReader.<init>(ClassReader.java:156)
  at groovyjarjarasm.asm.ClassReader.<init>(ClassReader.java:277)
  ...

How can I resolve this issue? I am using GitLab server v15.7.5.

Answer 1

I found a StackOverflow thread that is very similar to the issue I'm having.

It appears the version of ASM bundled with GitLab gemnasium-maven analyzer v3.11 does not support class files version 61 in Java v17.0.2+8.

I was able to get this working by downgrading GitLab gemnasium-maven analyzer to v2.31.0 and have filed a support request with GitLab to notify them of the issue.

To downgrade the dependency scanner, add the following block of code to your CICD template

.ds-analyzer:
  variables:
    DS_MAJOR_VERSION: 2