Found multiple occurrences of org.json.JSONObject on the class path: [duplicate]

Question

I have a basic SpringBoot 2.1.5.RELEASE app. Using Spring Initializer, JPA, embedded Tomcat, Thymeleaf template engine, and package as an executable JAR. When I init the app I see this message:

Found multiple occurrences of org.json.JSONObject on the class path:

        jar:file:/Users/nunito/.m2/repository/com/vaadin/external/google/android-json/0.0.20131108.vaadin1/android-json-0.0.20131108.vaadin1.jar!/org/json/JSONObject.class
        jar:file:/Users/nunito/.m2/repository/org/json/json/20160810/json-20160810.jar!/org/json/JSONObject.class

I have delete all the repositoy folders and start from scracth, but I still have the problem and I can't figure out when it comes from looking at my pom.xml:

<dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>       

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-devtools</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-jdbc</artifactId>
        </dependency> 

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-mail</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>


        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
         </dependency>

         <dependency>
            <groupId>com.h2database</groupId>
            <artifactId>h2</artifactId>
        </dependency>

        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <scope>runtime</scope>
        </dependency>

        <dependency>
            <groupId>com.googlecode.libphonenumber</groupId>
            <artifactId>libphonenumber</artifactId>
            <version>8.9.0</version>
        </dependency>


        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-annotations</artifactId>
        </dependency>

        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
        </dependency>

        <!-- Spring Security -->

        <!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-test -->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>





        <!-- https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient -->
        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
            <artifactId>httpclient</artifactId>
           <!--  <version>4.5.4</version> -->
        </dependency>

        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
            <version>0.9.1</version>
        </dependency>

           <!-- https://mvnrepository.com/artifact/javax.ws.rs/javax.ws.rs-api -->
       <dependency>
          <groupId>javax.ws.rs</groupId>
          <artifactId>javax.ws.rs-api</artifactId>
          <version>2.1.1</version>
       </dependency>


        <!-- Firebase dependencies -->
       <dependency>
            <groupId>com.google.firebase</groupId>
            <artifactId>firebase-admin</artifactId>
            <version>5.4.0</version>
        </dependency>

        <dependency>
            <groupId>com.google.cloud</groupId>
            <artifactId>google-cloud-firestore</artifactId>
            <version>0.26.0-beta</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/com.google.guava/guava -->
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>23.0</version>
        </dependency>

    </dependencies>

and

[INFO] 
[INFO] --- maven-dependency-plugin:3.1.1:tree (default-cli) @ bonanssa-api ---
[INFO] io.bonanssa:bonanssa-api:jar:0.0.1-SNAPSHOT
[INFO] +- org.springframework.boot:spring-boot-starter:jar:2.1.5.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot:jar:2.1.5.RELEASE:compile
[INFO] |  |  \- org.springframework:spring-context:jar:5.1.7.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-autoconfigure:jar:2.1.5.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter-logging:jar:2.1.5.RELEASE:compile
[INFO] |  |  +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.11.2:compile
[INFO] |  |  |  \- org.apache.logging.log4j:log4j-api:jar:2.11.2:compile
[INFO] |  |  \- org.slf4j:jul-to-slf4j:jar:1.7.26:compile
[INFO] |  +- javax.annotation:javax.annotation-api:jar:1.3.2:compile
[INFO] |  +- org.springframework:spring-core:jar:5.1.7.RELEASE:compile
[INFO] |  |  \- org.springframework:spring-jcl:jar:5.1.7.RELEASE:compile
[INFO] |  \- org.yaml:snakeyaml:jar:1.23:runtime
[INFO] +- org.springframework.boot:spring-boot-starter-web:jar:2.1.5.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter-json:jar:2.1.5.RELEASE:compile
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.9.8:compile
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.9.8:compile
[INFO] |  |  \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.9.8:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter-tomcat:jar:2.1.5.RELEASE:compile
[INFO] |  |  +- org.apache.tomcat.embed:tomcat-embed-core:jar:9.0.19:compile
[INFO] |  |  +- org.apache.tomcat.embed:tomcat-embed-el:jar:9.0.19:compile
[INFO] |  |  \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:9.0.19:compile
[INFO] |  +- org.hibernate.validator:hibernate-validator:jar:6.0.16.Final:compile
[INFO] |  |  +- javax.validation:validation-api:jar:2.0.1.Final:compile
[INFO] |  |  +- org.jboss.logging:jboss-logging:jar:3.3.2.Final:compile
[INFO] |  |  \- com.fasterxml:classmate:jar:1.4.0:compile
[INFO] |  +- org.springframework:spring-web:jar:5.1.7.RELEASE:compile
[INFO] |  |  \- org.springframework:spring-beans:jar:5.1.7.RELEASE:compile
[INFO] |  \- org.springframework:spring-webmvc:jar:5.1.7.RELEASE:compile
[INFO] |     \- org.springframework:spring-expression:jar:5.1.7.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-starter-actuator:jar:2.1.5.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-actuator-autoconfigure:jar:2.1.5.RELEASE:compile
[INFO] |  |  \- org.springframework.boot:spring-boot-actuator:jar:2.1.5.RELEASE:compile
[INFO] |  \- io.micrometer:micrometer-core:jar:1.1.4:compile
[INFO] |     +- org.hdrhistogram:HdrHistogram:jar:2.1.9:compile
[INFO] |     \- org.latencyutils:LatencyUtils:jar:2.0.3:compile
[INFO] +- org.springframework.boot:spring-boot-devtools:jar:2.1.5.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-starter-test:jar:2.1.5.RELEASE:test
[INFO] |  +- org.springframework.boot:spring-boot-test:jar:2.1.5.RELEASE:test
[INFO] |  +- org.springframework.boot:spring-boot-test-autoconfigure:jar:2.1.5.RELEASE:test
[INFO] |  +- com.jayway.jsonpath:json-path:jar:2.4.0:test
[INFO] |  |  \- net.minidev:json-smart:jar:2.3:test
[INFO] |  |     \- net.minidev:accessors-smart:jar:1.2:test
[INFO] |  |        \- org.ow2.asm:asm:jar:5.0.4:test
[INFO] |  +- junit:junit:jar:4.12:test
[INFO] |  +- org.assertj:assertj-core:jar:3.11.1:test
[INFO] |  +- org.mockito:mockito-core:jar:2.23.4:test
[INFO] |  |  +- net.bytebuddy:byte-buddy:jar:1.9.12:compile
[INFO] |  |  +- net.bytebuddy:byte-buddy-agent:jar:1.9.12:test
[INFO] |  |  \- org.objenesis:objenesis:jar:2.6:test
[INFO] |  +- org.hamcrest:hamcrest-core:jar:1.3:test
[INFO] |  +- org.hamcrest:hamcrest-library:jar:1.3:test
[INFO] |  +- org.skyscreamer:jsonassert:jar:1.5.0:test
[INFO] |  |  \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test
[INFO] |  +- org.springframework:spring-test:jar:5.1.7.RELEASE:test
[INFO] |  \- org.xmlunit:xmlunit-core:jar:2.6.2:test
[INFO] +- org.springframework.boot:spring-boot-starter-jdbc:jar:2.1.5.RELEASE:compile
[INFO] |  +- com.zaxxer:HikariCP:jar:3.2.0:compile
[INFO] |  \- org.springframework:spring-jdbc:jar:5.1.7.RELEASE:compile
[INFO] |     \- org.springframework:spring-tx:jar:5.1.7.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-starter-mail:jar:2.1.5.RELEASE:compile
[INFO] |  +- org.springframework:spring-context-support:jar:5.1.7.RELEASE:compile
[INFO] |  \- com.sun.mail:javax.mail:jar:1.6.2:compile
[INFO] |     \- javax.activation:activation:jar:1.1:compile
[INFO] +- org.springframework.boot:spring-boot-starter-data-jpa:jar:2.1.5.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter-aop:jar:2.1.5.RELEASE:compile
[INFO] |  |  \- org.aspectj:aspectjweaver:jar:1.9.4:compile
[INFO] |  +- javax.transaction:javax.transaction-api:jar:1.3:compile
[INFO] |  +- javax.xml.bind:jaxb-api:jar:2.3.1:compile
[INFO] |  |  \- javax.activation:javax.activation-api:jar:1.2.0:compile
[INFO] |  +- org.hibernate:hibernate-core:jar:5.3.10.Final:compile
[INFO] |  |  +- javax.persistence:javax.persistence-api:jar:2.2:compile
[INFO] |  |  +- org.javassist:javassist:jar:3.23.2-GA:compile
[INFO] |  |  +- antlr:antlr:jar:2.7.7:compile
[INFO] |  |  +- org.jboss:jandex:jar:2.0.5.Final:compile
[INFO] |  |  +- org.dom4j:dom4j:jar:2.1.1:compile
[INFO] |  |  \- org.hibernate.common:hibernate-commons-annotations:jar:5.0.4.Final:compile
[INFO] |  +- org.springframework.data:spring-data-jpa:jar:2.1.8.RELEASE:compile
[INFO] |  |  +- org.springframework.data:spring-data-commons:jar:2.1.8.RELEASE:compile
[INFO] |  |  \- org.springframework:spring-orm:jar:5.1.7.RELEASE:compile
[INFO] |  \- org.springframework:spring-aspects:jar:5.1.7.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-starter-security:jar:2.1.5.RELEASE:compile
[INFO] |  +- org.springframework:spring-aop:jar:5.1.7.RELEASE:compile
[INFO] |  +- org.springframework.security:spring-security-config:jar:5.1.5.RELEASE:compile
[INFO] |  \- org.springframework.security:spring-security-web:jar:5.1.5.RELEASE:compile
[INFO] +- ch.qos.logback:logback-classic:jar:1.2.3:compile
[INFO] |  +- ch.qos.logback:logback-core:jar:1.2.3:compile
[INFO] |  \- org.slf4j:slf4j-api:jar:1.7.26:compile
[INFO] +- com.h2database:h2:jar:1.4.199:compile
[INFO] +- mysql:mysql-connector-java:jar:8.0.16:runtime
[INFO] +- com.googlecode.libphonenumber:libphonenumber:jar:8.9.0:compile
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.9.0:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.9.8:compile
[INFO] |  \- com.fasterxml.jackson.core:jackson-core:jar:2.9.8:compile
[INFO] +- org.springframework.security:spring-security-test:jar:5.1.5.RELEASE:test
[INFO] |  \- org.springframework.security:spring-security-core:jar:5.1.5.RELEASE:compile
[INFO] +- org.apache.httpcomponents:httpclient:jar:4.5.8:compile
[INFO] |  +- org.apache.httpcomponents:httpcore:jar:4.4.11:compile
[INFO] |  \- commons-codec:commons-codec:jar:1.11:compile
[INFO] +- io.jsonwebtoken:jjwt:jar:0.9.1:compile
[INFO] +- javax.ws.rs:javax.ws.rs-api:jar:2.1.1:compile
[INFO] +- com.google.firebase:firebase-admin:jar:5.4.0:compile
[INFO] |  +- com.google.api-client:google-api-client:jar:1.22.0:compile
[INFO] |  |  +- com.google.oauth-client:google-oauth-client:jar:1.22.0:compile
[INFO] |  |  \- com.google.http-client:google-http-client-jackson2:jar:1.22.0:compile
[INFO] |  +- com.google.api-client:google-api-client-gson:jar:1.22.0:compile
[INFO] |  |  \- com.google.http-client:google-http-client-gson:jar:1.22.0:compile
[INFO] |  |     \- com.google.code.gson:gson:jar:2.8.5:compile
[INFO] |  +- com.google.http-client:google-http-client:jar:1.22.0:compile
[INFO] |  +- com.google.api:api-common:jar:1.1.0:compile
[INFO] |  +- com.google.auth:google-auth-library-oauth2-http:jar:0.8.0:compile
[INFO] |  |  \- com.google.auth:google-auth-library-credentials:jar:0.8.0:compile
[INFO] |  +- com.google.cloud:google-cloud-storage:jar:1.2.1:compile
[INFO] |  |  \- com.google.apis:google-api-services-storage:jar:v1-rev100-1.22.0:compile
[INFO] |  \- org.json:json:jar:20160810:compile
[INFO] +- com.google.cloud:google-cloud-firestore:jar:0.26.0-beta:compile
[INFO] |  +- io.netty:netty-tcnative-boringssl-static:jar:2.0.25.Final:compile
[INFO] |  +- com.google.cloud:google-cloud-core:jar:1.8.0:compile
[INFO] |  |  +- joda-time:joda-time:jar:2.10.2:compile
[INFO] |  |  +- com.google.api:gax:jar:1.9.0:compile
[INFO] |  |  +- com.google.protobuf:protobuf-java-util:jar:3.3.1:compile
[INFO] |  |  +- com.google.api.grpc:proto-google-common-protos:jar:0.1.21:compile
[INFO] |  |  \- com.google.api.grpc:proto-google-iam-v1:jar:0.1.21:compile
[INFO] |  +- com.google.cloud:google-cloud-core-grpc:jar:1.8.0:compile
[INFO] |  |  +- com.google.protobuf:protobuf-java:jar:3.3.1:compile
[INFO] |  |  +- io.grpc:grpc-protobuf:jar:1.6.1:compile
[INFO] |  |  |  \- io.grpc:grpc-protobuf-lite:jar:1.6.1:compile
[INFO] |  |  \- io.grpc:grpc-context:jar:1.6.1:compile
[INFO] |  +- com.google.api:gax-grpc:jar:0.26.0:compile
[INFO] |  |  +- com.google.auto.value:auto-value:jar:1.2:compile
[INFO] |  |  \- org.threeten:threetenbp:jar:1.3.3:compile
[INFO] |  +- com.google.cloud:google-cloud-core-http:jar:1.8.0:compile
[INFO] |  |  +- com.google.http-client:google-http-client-appengine:jar:1.22.0:compile
[INFO] |  |  \- com.google.http-client:google-http-client-jackson:jar:1.22.0:compile
[INFO] |  |     \- org.codehaus.jackson:jackson-core-asl:jar:1.9.11:compile
[INFO] |  +- com.google.api.grpc:proto-google-cloud-firestore-v1beta1:jar:0.1.21:compile
[INFO] |  +- io.grpc:grpc-netty:jar:1.6.1:compile
[INFO] |  |  +- io.grpc:grpc-core:jar:1.6.1:compile (version selected from constraint [1.6.1,1.6.1])
[INFO] |  |  |  +- com.google.instrumentation:instrumentation-api:jar:0.4.3:compile
[INFO] |  |  |  \- io.opencensus:opencensus-api:jar:0.5.1:compile
[INFO] |  |  +- io.netty:netty-codec-http2:jar:4.1.36.Final:compile
[INFO] |  |  |  +- io.netty:netty-common:jar:4.1.36.Final:compile
[INFO] |  |  |  +- io.netty:netty-buffer:jar:4.1.36.Final:compile
[INFO] |  |  |  +- io.netty:netty-transport:jar:4.1.36.Final:compile
[INFO] |  |  |  |  \- io.netty:netty-resolver:jar:4.1.36.Final:compile
[INFO] |  |  |  +- io.netty:netty-codec:jar:4.1.36.Final:compile
[INFO] |  |  |  +- io.netty:netty-handler:jar:4.1.36.Final:compile
[INFO] |  |  |  \- io.netty:netty-codec-http:jar:4.1.36.Final:compile
[INFO] |  |  \- io.netty:netty-handler-proxy:jar:4.1.36.Final:compile
[INFO] |  |     \- io.netty:netty-codec-socks:jar:4.1.36.Final:compile
[INFO] |  +- io.grpc:grpc-stub:jar:1.6.1:compile
[INFO] |  \- io.grpc:grpc-auth:jar:1.6.1:compile
[INFO] \- com.google.guava:guava:jar:23.0:compile
[INFO]    +- com.google.code.findbugs:jsr305:jar:1.3.9:compile
[INFO]    +- com.google.errorprone:error_prone_annotations:jar:2.0.18:compile
[INFO]    +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
[INFO]    \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.650 s
[INFO] Finished at: 2019-06-12T14:16:18+02:00
[INFO] ------------------------------------------------------------------------

Answer 1

This is because of jar conflicts. It happens because of maven transitive dependencies.

Based on the dependency tree that you have posted here, below two jars are conflicting each other over JSONObject.class.

1) android-json.jar  (com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test)
2) json.jar   (org.json:json:jar:20160810:compile)

You can exclude one of these jars based on your requirement.

example:

<exclusions>
    <exclusion>
        <groupId>com.vaadin.external.google</groupId>
        <artifactId>android-json</artifactId>
    </exclusion>
</exclusions>