DEV Community

Serguey Asael Shinder
Serguey Asael Shinder

Posted on

Your Java Dependencies Still Call sun.misc.Unsafe and the JDK Has Started Saying So

You moved to Java 25,
mostly for the long term support.

The tests passed.

The service started.

And the first lines of the log
were not yours.

WARNING:
A terminally deprecated method
in sun.misc.Unsafe
has been called.

Then the name of a class
in a library you never chose,
three levels down
in the dependency tree.

Somebody filed a ticket
to silence the warning.

That is the wrong ticket.

sun.misc.Unsafe
was never a public API.

It is a back door into the JVM
that lets code read and write memory
directly,
with no bounds checks,
and for two decades
serialisers, buffer pools,
caches and fast collections
used it,
because nothing else was as fast.

Now there are proper replacements.

VarHandle, since Java 9,
for fields and arrays.

The Foreign Function and Memory API,
final since Java 22,
for memory outside the heap.

So the JDK is closing the door
in stages.

JDK 23 deprecated
the memory access methods
for removal.

JDK 24 started printing that warning
the first time one is called.

The plan after that
is to throw an exception by default,
and then
to remove the methods altogether.

The warning prints once,
for the first caller,
so it tells you
there is at least one problem,
not how many.

You can see the next stage today.

Run your test suite with
--sun-misc-unsafe-memory-access=deny.

On my machine, on JDK 26,
a small program
that stores forty two
in eight bytes allocated through Unsafe
prints forty two
and a warning
under the default.

Under deny
it stops with
an UnsupportedOperationException.

Every one of those failures
in your suite
is a Java upgrade
you will not be able to take
until something changes.

Then work down the list.

Many popular libraries
have moved, or are moving,
to the supported APIs,
so the fix is often
a newer version.

Where a library is abandoned,
that is worth knowing now,
while it is a warning
and not an outage.

The flag that allows it
will buy you time.

Not forever.

The JVM is choosing integrity
over the shortcuts
your dependencies took.

Find out which of them
are still taking them.

– Serguey Asael Shinder

Top comments (0)