MSAL 8.3.2 missing R8 consumer rule for PolymorphicJsonAdapterFactory — Release builds fail with minification

[riegersan]

Describe the bug

MSAL 8.3.2 introduces a missing R8/ProGuard consumer rule for com.squareup.moshi.adapters.PolymorphicJsonAdapterFactory. This class is referenced by the transitive dependency com.microsoft.identity.deviceregistration but is not included as a runtime dependency, nor is a -dontwarn consumer rule shipped with the AAR.
This causes Release builds with R8 minification to fail. The issue does not occur with MSAL 8.3.0 and 8.3.1.

Smartphone (please complete the following information):

Device: All
Android Version: API 31+
MSAL Version: 8.3.2 (works fine with 8.3.0 or 8.3.1)

Build environment:
Android Gradle Plugin (AGP): 9.0.1
Gradle: 9.1.0

Stacktrace
AGPBI: {"kind":"error","text":"Missing classes detected while running R8. Please add the missing classes or apply additional keep rules that are generated in /Users/.../app/build/intermediates/mapping/fredAbnahmeRelease/minifyFredAbnahmeReleaseWithR8/missing_rules.txt.","sources":[{}]}
AGPBI: {"kind":"error","text":"Missing class com.squareup.moshi.adapters.PolymorphicJsonAdapterFactory (referenced from: void com.microsoft.identity.deviceregistration.java.protocol.packer.DeviceRegistrationProtocolMoshiSerializer.())","sources":[{}],"tool":"R8"}

Execution failed for task ':app:minifyFredAbnahmeReleaseWithR8'.

A failure occurred while executing com.android.build.gradle.internal.tasks.R8Task$R8Runnable
Compilation failed to complete

To Reproduce

Steps to reproduce the behavior:

Use com.microsoft.identity.client:msal:8.3.2 as a dependency
Enable R8 minification (isMinifyEnabled = true) for a release build type
Build a release variant (e.g. ./gradlew assembleRelease)
Build fails at minifyWithR8 task

Expected behavior

MSAL 8.3.2 should either:
Include com.squareup.moshi:moshi-adapters as a transitive runtime dependency, or
Ship a consumer ProGuard/R8 rule (-dontwarn com.squareup.moshi.adapters.PolymorphicJsonAdapterFactory) in the AAR's consumer-rules.pro

Additional context

Additional context
The issue is caused by com.microsoft.identity.deviceregistration.java.protocol.packer.DeviceRegistrationProtocolMoshiSerializer referencing PolymorphicJsonAdapterFactory in its static initializer ()
MSAL 8.3.1 does not have this issue — the problem was introduced in 8.3.2

[github-actions]

Thank you for opening this issue!

Labels Applied:
Bug: The reported issue is caused by a missing R8/ProGuard consumer rule for the com.squareup.moshi.adapters.PolymorphicJsonAdapterFactory class introduced in MSAL 8.3.2. This results in release builds failing during the minifyWithR8 task, which indicates an issue in the library that affects its usability in a specific environment/configuration. This is classified as a bug since it represents a regression introduced in MSAL 8.3.2..

🤖 AI Analysis

This issue is related to the missing R8/ProGuard rules for com.squareup.moshi.adapters.PolymorphicJsonAdapterFactory. As a workaround until the issue is resolved in the library itself, you can apply the following additional ProGuard rules to your project to prevent the build failure:

-keepnames class com.squareup.moshi.adapters.PolymorphicJsonAdapterFactory { *; }
-dontwarn com.squareup.moshi.adapters.PolymorphicJsonAdapterFactory

Steps to resolve temporarily:

1. Add the above rules to your proguard-rules.pro file.
2. Build your release variant again to confirm that the build proceeds successfully.

Long-term solution:

• The MSAL team should include appropriate consumer ProGuard rules in the library's consumer-rules.pro file for the dependencies required by com.microsoft.identity.deviceregistration, especially for com.squareup.moshi.adapters.PolymorphicJsonAdapterFactory.
• The user can open a GitHub pull request or create a separate issue requesting the MSAL maintainers to address this with an updated release.

See Common Issues Reference 5.3 for general ProGuard/R8 troubleshooting.

Related Issues: #1540, #1677, #1695, #2076, #2289, #2355

---

---

Need help? Comment with:

PING-COPILOT: <your question>

Privacy: Do not include credentials, tokens, or PII in PING-COPILOT requests.

[svarnik]

The same issue.

Just to be safe I have added this to dependencies to avoid possible ClassNotFound errors.

implementation 'com.squareup.moshi:moshi-adapters:1.15.2'

[WonderCsabo]

I added this rule:

-dontwarn com.squareup.moshi.adapters.PolymorphicJsonAdapterFactory

The app is working fine. I assume we do not use a that MSAL feature which requires this class. Or maybe MSAL does not use this anymore? But this should be definitely addressed in MSAL.

[ajdf24]

@WonderCsabo yes, that's a possible workaround, but you should definitely test your release build.
@svarnik works definitely but it's definitely not good practice to add a lib because of you included a lib