[lahirumaramba]

Today, the SDK defaults to JacksonFactory for JSON parsing even though firebase-admin does not declare google-http-client-jackson2 as a direct dependency (it only enters the classpath transitively via google-cloud-storage). When an application excludes google-cloud-storage or google-http-client-jackson2, making an HTTP call triggers JVM bytecode verification of ApiClientUtils and fails with NoClassDefFoundError, even when the caller explicitly passes a custom JsonFactory via FirebaseOptions.

This change switches the default JsonFactory to GsonFactory (which firebase-admin, google-api-client, and google-auth-library already depend on directly) and moves default JsonFactory initialization into a lazy holder class so custom JsonFactory configurations never load the default implementation. The upstream GsonFactory leniency issues that prevented this migration in 2021 (googleapis/google-api-java-client#1779) are resolved in google-http-client-gson 2.x, where strict parsing (readLeniency = false) is the default.

Fixes #1231

Technical Details

• Lazy holder for JVM verification (ApiClientUtils): Previously, ApiClientUtils.getDefaultJsonFactory() returned JacksonFactory.getDefaultInstance() directly as a JsonFactory, forcing the JVM bytecode verifier to eagerly load JacksonFactory whenever ApiClientUtils was loaded (for example, inside ApiClientUtils.newAuthorizedRequestFactory(app)) to verify subtype assignability. Wrapping GsonFactory.getDefaultInstance() in private static class JsonFactoryInstanceHolder (matching TransportInstanceHolder) defers loading until getDefaultJsonFactory() is called.
• Compatibility: FirebaseOptions.getJsonFactory() exposes only the abstract JsonFactory type, and pom.xml dependencies are unchanged. Malformed JSON inputs continue to throw IOException (MalformedJsonException), untyped JSON numbers parse to BigDecimal, and floats serialize identically (0.2f -> "0.2"). Supplementary Unicode code points (such as emojis in Template.toJSON()) are serialized by GsonFactory as literal UTF-8 rather than UTF-16 surrogate pairs, both of which are valid RFC 8259 JSON.
• Tests (ApiClientUtilsTest, FirebaseOptionsTest): Added PackageBlockingClassLoader tests verifying that FCM requests and Remote Config Template serialization succeed when google-http-client-jackson2 and com.fasterxml.jackson.* are absent from the classpath, and that passing a custom JsonFactory does not load the default JsonFactory implementation class.

[gemini-code-assist]

Code Review

This pull request migrates the default JsonFactory implementation from JacksonFactory to GsonFactory in ApiClientUtils. It introduces a lazy-loaded JsonFactoryInstanceHolder to hold the singleton GsonFactory instance and adds Javadoc documentation to the utility methods. Additionally, the test suite is updated to assert that GsonFactory is used by default, and new integration tests are added using a custom class loader to verify that the SDK functions correctly even when Jackson2 is absent from the classpath. There are no review comments, and I have no additional feedback to provide.