Removing GWT-RPC support from Guava

[Chris Povirk]

In the first Guava release of 2020, we plan to remove support for sending Guava types over GWT-RPC.

We plan to continue to release guava-gwt (without GWT-RPC support) beyond then, though we may increasingly need community help, as our past GWT experts have moved on or stopped keeping up to date on GWT changes.

We're dropping GWT-RPC support because, over time, it has cost more to maintain, and it's become less used as other RPC systems gain popularity. In more detail:

• GWT-RPC has been buggy, and we've had to spend time on workarounds. More generally, our GWT-RPC support has required significant maintenance, and it's delayed features like hash-flooding protection and Android optimizations.

• Even when it works correctly, it is fragile (examples, another example).

• Even GWT-RPC users who don't serialize Guava types are affected by Guava's GWT-RPC support, which can increase JavaScript size and last year had a denial-of-service vulnerability.

• Our current level of GWT-RPC support encourages users to use many Guava types on the client. This works well for some types, but others translate to bloated JavaScript, and instances of some are stored inefficiently in comparison to GWT-optimized classes.

• We suspect -- but do not have good numbers on this! -- that few Guava users are using GWT in general, fewer are using GWT-RPC, and still fewer are sending Guava types over GWT-RPC.

For advice on alternatives to GWT-RPC, we suggest discussing on the GWT mailing list. For other concerns, let us know here on guava-discuss@.