google-oauth bundles WEB-INF/lib/gson-2.9.1.jar, which is bundled in GSON API. This creates the potential for class loading incompatibilities. To be safe, google-oauth should stop bundling this JAR and instead have a plugin-to-plugin dependency on GSON API, as described in the documentation.