Proguard org.springframework.beans.BeanInstantiationException

[PaoloHi]

I am encountering an error during ProGuard compilation with Spring Boot using Java 11. The compilation of my obfuscated JAR file appears to complete without errors, but at runtime, I encounter the following issue:

The process works fine until bean initialization fails. I have already attempted boundary condition adjustments, such as adding -dontobfuscate or rules like:

text
-keep public class com.paymind.apiMerchants.** { public protected private *; }
to prevent obfuscation of specific classes. However, the problem persists.

Interestingly, if I remove the class where the BeanException occurs, the application seems to work correctly.

`cationContext. To display the conditions report re-run your application with 'debug' enabled.
2025-08-15T16:38:37,320 ERROR - ps-MacBook-Air.local - [main] o.s.b.SpringApplication: Application run failed
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is java.lang.VerifyError: Bad type on operand stack
Exception Details:
Location:
com/paymind/apiMerchants/shared/security/JwtAuthenticationFilter.attemptAuthentication(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;)Lorg/springframework/security/core/Authentication; @69: invokespecial
Reason:
Type 'java/lang/Object' (current frame, stack[2]) is not assignable to 'java/lang/Throwable'
Current Frame:
bci: @69
flags: { }
locals: { 'com/paymind/apiMerchants/shared/security/JwtAuthenticationFilter', top, top, 'com/paymind/apiMerchants/merchants/repository/entities/UserModel', 'java/lang/Object' }
stack: { uninitialized 63, uninitialized 63, 'java/lang/Object' }
Bytecode:
0000000: 014e bb00 0559 b700 262b b900 4001 0012
0000010: 06b6 0027 c000 064e 2ab4 0021 bb00 1d59
0000020: 2db6 002a 2db6 0029 bb00 1459 b700 3cb7
0000030: 003e b900 4502 00b0 3a04 2a2d b600 33bb
0000040: 0010 5919 04b7 003a bf
Exception Handler Table:
bci [2, 55] => handler: 56
bci [2, 55] => handler: 56
Stackmap Table:
full_frame(@56,{Object[#10],Top,Top,Object[#6]},{Object[#15]})

    at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:658)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:486)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1352)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1195)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:582)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:542)
    at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:335)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:333)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:322)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:953)
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:918)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:583)
    at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:145)
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:740)
    at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:415)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:303)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1312)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1301)
    at com.paymind.apiMerchants.ApiMerchantsApplication.main(ApiMerchantsApplication.java:26)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:569)
    at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:49)
    at org.springframework.boot.loader.Launcher.launch(Launcher.java:108)
    at org.springframework.boot.loader.Launcher.launch(Launcher.java:58)
    at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:88)

Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is java.lang.VerifyError: Bad type on operand stack
Exception Details:
Location:
com/paymind/apiMerchants/shared/security/JwtAuthenticationFilter.attemptAuthentication(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;)Lorg/springframework/security/core/Authentication; @69: invokespecial
Reason:
Type 'java/lang/Object' (current frame, stack[2]) is not assignable to 'java/lang/Throwable'
Current Frame:
bci: @69
flags: { }
locals: { 'com/paymind/apiMerchants/shared/security/JwtAuthenticationFilter', top, top, 'com/paymind/apiMerchants/merchants/repository/entities/UserModel', 'java/lang/Object' }
stack: { uninitialized 63, uninitialized 63, 'java/lang/Object' }
Bytecode:
0000000: 014e bb00 0559 b700 262b b900 4001 0012
0000010: 06b6 0027 c000 064e 2ab4 0021 bb00 1d59
0000020: 2db6 002a 2db6 0029 bb00 1459 b700 3cb7
0000030: 003e b900 4502 00b0 3a04 2a2d b600 33bb
0000040: 0010 5919 04b7 003a bf
Exception Handler Table:
bci [2, 55] => handler: 56
bci [2, 55] => handler: 56
Stackmap Table:
full_frame(@56,{Object[#10],Top,Top,Object[#6]},{Object[#15]})

    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:185)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
    ... 29 more

Caused by: java.lang.VerifyError: Bad type on operand stack
Exception Details:
Location:
com/paymind/apiMerchants/shared/security/JwtAuthenticationFilter.attemptAuthentication(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;)Lorg/springframework/security/core/Authentication; @69: invokespecial
Reason:
Type 'java/lang/Object' (current frame, stack[2]) is not assignable to 'java/lang/Throwable'
Current Frame:
bci: @69
flags: { }
locals: { 'com/paymind/apiMerchants/shared/security/JwtAuthenticationFilter', top, top, 'com/paymind/apiMerchants/merchants/repository/entities/UserModel', 'java/lang/Object' }
stack: { uninitialized 63, uninitialized 63, 'java/lang/Object' }
Bytecode:
0000000: 014e bb00 0559 b700 262b b900 4001 0012
0000010: 06b6 0027 c000 064e 2ab4 0021 bb00 1d59
0000020: 2db6 002a 2db6 0029 bb00 1459 b700 3cb7
0000030: 003e b900 4502 00b0 3a04 2a2d b600 33bb
0000040: 0010 5919 04b7 003a bf
Exception Handler Table:
bci [2, 55] => handler: 56
bci [2, 55] => handler: 56
Stackmap Table:
full_frame(@56,{Object[#10],Top,Top,Object[#6]},{Object[#15]})

    at com.paymind.apiMerchants.shared.configuration.WebSecurity.configure(WebSecurity.java:73)
    at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.getHttp(WebSecurityConfigurerAdapter.java:217)
    at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.init(WebSecurityConfigurerAdapter.java:315)
    at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.init(WebSecurityConfigurerAdapter.java:93)
    at com.paymind.apiMerchants.shared.configuration.WebSecurity$$EnhancerBySpringCGLIB$$9a814588.init(<generated>)
    at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.init(AbstractConfiguredSecurityBuilder.java:338)
    at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.doBuild(AbstractConfiguredSecurityBuilder.java:300)
    at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:38)
    at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain(WebSecurityConfiguration.java:127)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:569)
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:154)
    ... 30 more`

this is my configuration file

`-dontshrink
-dontoptimize
-useuniqueclassmembernames
-adaptclassstrings
-dontnote
-ignorewarnings

-keep @javax.persistence.* class * {*;}

-keep class * extends org.springframework.boot.web.support.SpringBootServletInitializer
-keep class * extends org.springframework.boot.loader.**
-keepclasseswithmembers public class * { public static void main(java.lang.String[]);}
-keepclassmembers class * {
@org.springframework.beans.factory.annotation.Autowired *;
@org.springframework.beans.factory.annotation.Qualifier *;
@org.springframework.beans.factory.annotation.Value *;
@org.springframework.beans.factory.annotation.Required *;
@org.springframework.context.annotation.Bean *;
@org.springframework.context.annotation.Primary *;
@org.springframework.boot.context.properties.ConfigurationProperties *;
@org.springframework.boot.context.properties.EnableConfigurationProperties *;

 ## thymeleaf (for html templates)
 *** get*();
 void set*(***);

}
-keep @org.springframework.cache.annotation.EnableCaching class *
-keep @org.springframework.context.annotation.Configuration class *
-keep @org.springframework.boot.context.properties.ConfigurationProperties class *
-keep @org.springframework.boot.autoconfigure.SpringBootApplication class *
-keep @org.springframework.stereotype.Repository class *
-allowaccessmodification
-keepattributes Exceptions,InnerClasses,Signature,Deprecated,SourceFile,LineNumberTable,Annotation,EnclosingMethod,RuntimeVisibleAnnotations
-keepdirectories org.springframework.boot.autoconfigure
-keepclassmembernames class * {
java.lang.Class class$(java.lang.String);
java.lang.Class class$(java.lang.String, boolean);
}
-keep class * implements java.io.Serializable
-keepclassmembers enum * { *; }

-keep public class com.paymind.apiMerchants.** {
public protected private *;
}

-repackageclasses com.paymind.apiMerchants.obf #move obfuscated class to
-classobfuscationdictionary proguard.txt #use these names while renaming classes
-obfuscationdictionary proguard.txt #use these names while renaming variables, methods etc.

`

[piazzesiNiccolo-GS]

Hi,

do you have a minimal reproduction of the issue you could share to investigate?

I have already attempted boundary condition adjustments, such as adding -dontobfuscate

Interesting, so it still fails when you have these rules if I am correct?

-dontshrink
-dontoptimize
-dontobufscate

Just to confirm, is it working at runtime if you don't enable proguard at all? If it's failing with 3 donts, It might be not fully related to proguard, or happenng during input reading.

[mrjameshamilton]

It could be related to preverify-ing as it still occurs with the three don'ts. In the error that you show, it looks like types are missing and Object it used instead e.g.

Stackmap Table:
 full_frame(@56,{Object[#10],Top,Top,Object[#6]},{Object[#15]})

Do you happen to see warnings in the log about missing classes? If so, you might be e.g. missing some library jars that you'll need to provide with the -libraryjar option.

You have -ignorewarnings in your configuration, can you remove that and try to resolve the warnings? You can be more specific with -dontwarn instead of ignoring all warnings.

It could be missing the javax servlet package since I think those are no longer included in Java 11 JDKs.

[piazzesiNiccolo-GS]

It could be related to preverify-ing as it still occurs with the three don'ts. In the error that you show, it looks like types are missing and Object it used instead e.g.

Ah indeed good catch, I think that's indeed what is happening here.

[PaoloHi]

i already could resolved this issue by correcting the path

-keepclassmembernames class com.paymind.apiMerchants.merchants.repository.jpa.** { *; }
-keep class com.paymind.apiMerchants.merchants.repository.jpa.** { *; } #Spring Data 

never the less, when im obfuscating my jar, my jpa repository methods are beeing obfuscating:

`

@repository
public interface JpaUserClosureRepository extends JpaRepository<UserClosure, Long>, JpaSpecificationExecutor {
List ZHgsdfleCx(Long paramLong);

List cbpJaLGIFq(Long paramLong);

@procedure(name = "usersThatTransactedInSubmerchant")
List ffyUbXipBD(@param("subMerchantId") Long paramLong, @param("startDate") Timestamp paramTimestamp1, @param("endDate") Timestamp paramTimestamp2);

@procedure(name = "usersThatTransactedInMerchant")
List PzHKbKynPU(@param("merchantId") Long paramLong, @param("startDate") Timestamp paramTimestamp1, @param("endDate") Timestamp paramTimestamp2);
}
`

i do have excatcly the same conifguration as this source code, https://github.com/ufukguler/book-portal/blob/reactive/proguard.conf , it obfuscates well on this projcets but not on mine

[PaoloHi]

i could fix the Jpa mapping but got the same error again on bean initialization