ClassNotFoundExcetion is thrown by library when class is present in the application's classpath

I have a Maven project with the following dependencies:

• org.apache.poi:poi-ooxml:4.1.0
• org.apache.poi:poi:4.1.0
• An internal dependency/library, lets call it Lib-A, which was built using Gradle. This internal library uses the above two libraries that is, on its own it has dependencies on the above POI libraries but with different version. This is verified from the library's gradle file in the project.

The application however throws a runtime exception:

java.lang.ClassNotFoundException: org.apache.poi.POIXMLTypeLoader
    at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
    at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:525)
    at org.openxmlformats.schemas.spreadsheetml.x2006.main.CTWorkbook$Factory.newInstance(Unknown Source)
    at org.apache.poi.xssf.usermodel.XSSFWorkbook.onWorkbookCreate(XSSFWorkbook.java:456)
    at org.apache.poi.xssf.usermodel.XSSFWorkbook.<init>(XSSFWorkbook.java:259)
    at org.apache.poi.xssf.usermodel.XSSFWorkbook.<init>(XSSFWorkbook.java:253)
    at org.apache.poi.xssf.usermodel.XSSFWorkbook.<init>(XSSFWorkbook.java:241)
    at <some line at Lib-A>
    ...<more logs>

The missing class org.apache.poi.POIXMLTypeLoader is actually available in org.apache.poi:poi:4.1.0. Why is ClassNotFoundException still thrown in the application? Is Lib-A not aware that the class is available in the classpath?

Ok org.apache.poi.POIXMLTypeLoader is an old classname. It was moved to a new package org.apache.poi.ooxml.POIXMLTypeLoader . If you are experiencing org.apache.poi.POIXMLTypeLoader ClassNotFoundException it's because an old version of the library exists on the classpath and it's requesting the older version of the fully qualified class name.

And while gradle dependencies may NOT be showing another version of it. The dependency could still be there if another jar packaged POI in its jar file. If your Lib-A has this dependency with POI I'd check it and make sure they didn't do something hinky like packaging other dependencies in their Jar.

You also want to make sure you are using the official POI jar files from Maven central. If you have other repos in your project they could be to blame. You don't want to get pwned by a supply chain attack. Something a dep that packages other libs "hinky" versions could signify.