Is it safe to use Project Lombok? [closed]

TL; DR:

Yes, it’s pretty safe to use and I’d recommend using it. (May 2022)

---

Original Answer

Just started using Lombok today. So far I like it, but one drawback I didn’t see mentioned was refactoring support.

If you have a class annotated with @Data, it will generate the getters and setters for you based on the field names. If you use one of those getters in another class, then decide the field is poorly named, it will not find usages of those getters and setters and replace the old name with the new name.

I would imagine this would have to be done via an IDE plug-in and not via Lombok.

UPDATE (Jan 22 ’13)
After using Lombok for 3 months, I still recommend it for most projects. I did, however, find another drawback that is similar to the one listed above.

If you have a class, say MyCompoundObject.java that has 2 members, both annotated with @Delegate, say myWidgets and myGadgets, when you call myCompoundObject.getThingies() from another class, it’s impossible to know if it’s delegating to the Widget or Gadget because you can no longer jump to source within the IDE.

Using the Eclipse “Generate Delegate Methods…” provides you with the same functionality, is just as quick and provides source jumping. The downside is it clutters your source with boilerplate code that take the focus off the important stuff.

UPDATE 2 (Feb 26 ’13)
After 5 months, we’re still using Lombok, but I have some other annoyances. The lack of a declared getter & setter can get annoying at times when you are trying to familiarize yourself with new code.

For example, if I see a method called getDynamicCols() but I don’t know what it’s about, I have some extra hurdles to jump to determine the purpose of this method. Some of the hurdles are Lombok, some are the lack of a Lombok smart plugin. Hurdles include:

• Lack of JavaDocs. If I javadoc the field, I would hope the getter and setter would inherit that javadoc through the Lombok compilation step.
• Jump to method definition jumps me to the class, but not the property that generated the getter. This is a plugin issue.
• Obviously you are not able to set a breakpoint in a getter/setter unless you generate or code the method.
• NOTE: This Reference Search is not an issue as I first thought it was. You do need to be using a perspective that enables the Outline view though. Not a problem for most developers. My problem was I am using Mylyn which was filtering my Outline view, so I didn’t see the methods. Lack of References search. If I want to see who’s calling getDynamicCols(args...), I have to generate or code the setter to be able to search for references.

UPDATE 3 (Mar 7 ’13)
Learning to use the various ways of doing things in Eclipse I guess. You can actually set a conditional breakpoint (BP) on a Lombok generated method. Using the Outline view, you can right-click the method to Toggle Method Breakpoint. Then when you hit the BP, you can use the debugging Variables view to see what the generated method named the parameters (usually the same as the field name) and finally, use the Breakpoints view to right-click the BP and select Breakpoint Properties... to add a condition. Nice.

UPDATE 4 (Aug 16 ’13)
Netbeans doesn’t like it when you update your Lombok dependencies in your Maven pom. The project still compiles, but files get flagged for having compilation errors because it can’t see the methods Lombok is creating. Clearing the Netbeans cache resolves the issue. Not sure if there is a “Clean Project” option like there is in Eclipse. Minor issue, but wanted to make it known.

UPDATE 5 (Jan 17 ’14)
Lombok doesn’t always play nice with Groovy, or at least the groovy-eclipse-compiler. You might have to downgrade your version of the compiler.
Maven Groovy and Java + Lombok

UPDATE 6 (Jun 26 ’14)
A word of warning. Lombok is slightly addictive and if you work on a project where you can’t use it for some reason, it will annoy the piss out of you. You may be better off just never using it at all.

UPDATE 7 (Jul 23 ’14)
This is a bit of an interesting update because it directly addresses the safety of adopting Lombok that the OP asked about.

As of v1.14, the @Delegate annotation has been demoted to an Experimental status. The details are documented on their site (Lombok Delegate Docs).

The thing is, if you were using this feature, your backout options are limited. I see the options as:

• Manually remove @Delegate annotations and generate/handcode the delegate code. This is a little harder if you were using attributes within the annotation.
• Delombok the files that have the @Delegate annotation and maybe add back in the annotations that you do want.
• Never update Lombok or maintain a fork (or live with using experiential features).
• Delombok your entire project and stop using Lombok.

As far as I can tell, Delombok doesn’t have an option to remove a subset of annotations; it’s all or nothing at least for the context of a single file. I opened a ticket to request this feature with Delombok flags, but I wouldn’t expect that in the near future.

UPDATE 8 (Oct 20 ’14)
If it’s an option for you, Groovy offers most of the same benefits of Lombok, plus a boat load of other features, including @Delegate. If you think you’ll have a hard time selling the idea to the powers that be, take a look at the @CompileStatic or @TypeChecked annotation to see if that can help your cause. In fact, the primary focus of the Groovy 2.0 release was static safety.

UPDATE 9 (Sep 1 ’15)
Lombok is still being actively maintained and enhanced, which bodes well to the safety level of adoption. The @Builder annotations is one of my favorite new features.

UPDATE 10 (Nov 17 ’15)
This may not seem directly related to the OP’s question, but worth sharing. If you’re looking for tools to help you reduce the amount of boilerplate code you write, you can also check out Google Auto – in particular AutoValue. If you look at their slide deck, the list Lombok as a possible solution to the problem they are trying to solve. The cons they list for Lombok are:

• The inserted code is invisible (you can’t “see” the the methods it generates) [ed note – actually you can, but it just requires a decompiler]
• The compiler hacks are non-standard and fragile
• “In our view, your code is no longer really Java”

I’m not sure how much I agree with their evaluation. And given the cons of AutoValue that are documented in the slides, I’ll be sticking with Lombok (if Groovy is not an option).

UPDATE 11 (Feb 8 ’16)
I found out Spring Roo has some similar annotations. I was a little surprised to find out Roo is still a thing and finding documentation for the annotations is a bit rough. Removal also doesn’t look as easy as de-lombok. Lombok seems like the safer choice.

UPDATE 12 (Feb 17 ’16)
While trying to come up with justifications for why it’s safe to bring in Lombok for the project I’m currently working on, I found a piece of gold that was added with v1.14 – The Configuration System! This is means you can configure a project to dis-allow certain features that your team deems unsafe or undesirable. Better yet, it can also create directory specific config with different settings. This is AWESOME.

UPDATE 13 (Oct 4 ’16)
If this kind of thing matters to you, Oliver Gierke felt it was safe to add Lombok to Spring Data Rest.

UPDATE 14 (Sep 26 ’17)
As pointed out by @gavenkoa in the comments on the OPs question, JDK9 compiler support isn’t yet available (Issue #985). It also sounds like it’s not going to be an easy fix for the Lombok team to get around.

UPDATE 15 (Mar 26 ’18)
The Lombok changelog indicates as of v1.16.20 “Compiling lombok on JDK1.9 is now possible” even though #985 is still open.

Changes to accommodate JDK9, however, necessitated some breaking changes; all isolated to changes in config defaults. It’s a little concerning that they introduced breaking changes, but the version only bumped the “Incremental” version number (going from v1.16.18 to v1.16.20). Since this post was about the safety, if you had a yarn/npm like build system that automatically upgraded to the latest incremental version, you might be in for a rude awakening.

UPDATE 16 (Jan 9 ’19)

It seems the JDK9 issues have been resolved and Lombok works with JDK10, and even JDK11 as far as I can tell.

One thing I noticed though that was concerning from a safety aspect is the fact that the change log going from v1.18.2 to v1.18.4 lists two items as BREAKING CHANGE!? I’m not sure how a breaking change happens in a semver “patch” update. Could be an issue if you use a tool that auto-updates patch versions.

UPDATE 17 (Mar 17 ’21)

There is some drama unfolding between the Lombok developers and an OpenJDK developer around JDK 16. The JDK developers argue that Lombok is taking advantage of unpublished JDK internals via loopholes the JDK team would like to close, but have intentionally left open for various reasons.

They have stated their concern (about the safety of Lombok) as such:

All access to internals will remain available as before, provided that
the client application explicitly allows it, acknowledging that it is
knowingly taking on any maintenance (or security) issue this might
entail.

While Lombok might think they’re deceiving OpenJDK, all they’re doing
is announcing that it is their intention to deceive their own users.

There may come a day soon where Lombok will not be able to find any more creative solutions around the JDK’s security restrictions. Even if they do, the safety of using Lombok in your project may be in question.

UPDATE 18 (May 11 ’22)

A recent comment asked for a summary, so I put that at the top.

The short answer is it’s perfectly safe to use and I’d highly recommend using it if we’re writing Java code.

Given that support for JDK 17 has been out for awhile and was released less than a month after the JDK was officially released, the safety of Lombok sticking around is high. And you can always de-lombok if you need to.

As a consultant, I get to see how a lot of different companies write code. Every client I’ve had for the past 5 years has used Lombok. These have all been Fortune 1000 companies. It speeds development and makes it less error prone.

That said, you still need to keep up on the latest features of the JDK. Consider using the Java record keyword to make your objects immutable instead of some Lombok feature. Use Lombok where it makes sense. Use the Lombok config options to prevent usage of it in ways you don’t agree with.

So unless something major happens, this will probably be my last update to this answer. Thanks for all the votes. I’m glad it helps.