Provider.initialize waits on a CompletableFuture with no timeout, so if the LaunchDarkly data source never reaches VALID or OFF (for example a network hang or a proxy that never answers), OpenFeatureAPI.setProviderAndWait never returns.
The OpenFeature provider spec (OFP) expects a positive configured start wait time to act as an initialization timeout. LDConfig does not expose its start wait value publicly, so implementing this requires either an accessor on the Java SDK config or a provider-level timeout parameter — the latter would need a naming decision consistent with the Ruby (wait_for_seconds) and JS (initTimeoutSeconds) providers.
Found during the weekly OpenFeature provider audit.
Written by Devin
Reactions are currently unavailable
Provider.initialize waits on a CompletableFuture with no timeout, so if the LaunchDarkly data source never reaches VALID or OFF (for example a network hang or a proxy that never answers), OpenFeatureAPI.setProviderAndWait never returns.
The OpenFeature provider spec (OFP) expects a positive configured start wait time to act as an initialization timeout. LDConfig does not expose its start wait value publicly, so implementing this requires either an accessor on the Java SDK config or a provider-level timeout parameter — the latter would need a naming decision consistent with the Ruby (wait_for_seconds) and JS (initTimeoutSeconds) providers.
Found during the weekly OpenFeature provider audit.
Written by Devin