Open
Conversation
stevecl5
force-pushed
the
scl/update-dependencies
branch
2 times, most recently
from
0792611 to
1ac3f53
Compare
build: clean up gradle configuration files Release-As: 6.0.2
stevecl5
force-pushed
the
scl/update-dependencies
branch
from
1ac3f53 to
03b4a1d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of Changes
Dependency Updates
Updated plugins and other dependencies, including:
5.x->6.1.02.x->3.0.24.5.13->4.5.14By updating Coppuccino to the latest version, plugin dependency constraints are automatically included to address known vulnerabilities introduced by the plugin. As a result, manually overriding the versions of
commons-lang3andlog4j-coreusingresolutionStrategy.eachDependencyis no longer needed. As an added benefit, the new constraints set a minimum version for the vulnerable dependencies, allowing them to resolve to newer versions when available.Dependency Cleanup & Fixes:
com.github.spotbugs:spotbugs-annotationsdependency from:common, as it is now natively provided by the updated Coppuccino plugin.org.apache.commons:commons-textto1.15.0instead of usinglatest.releaseto ensure deterministic builds and prevent breaking changes from being pulled in unintentionally.com.google.code.gson:gsonversion range (changed from[2.13.0,13.0.0)to[2.13.0,3.0.0)).org.projectlombok:lombokdependency from sub-projects, as it is already globally managed and provided by theio.freefair.lombokplugin.com.auth0:java-jwt dependencyto [4.5.1, 5.0.0) to establish a secure floor that natively resolves legacyjackson-databindvulnerabilities without requiring manual overrides.Gradle Project Improvements
In addition to the dependency changes, I also made significant improvements to the Gradle configuration files.
Root Project (
build.gradle)io.opentracingandorg.slf4j) intoextproperties to guarantee version alignment and simplify future upgrades.subprojectsblock, ensuring theplatformBOM publishes correctly usingcomponents.javaPlatform(previously re-defined in the platform project).afterEvaluatelogic forspotlessApplyandsubdependenciestasks with a more performant, lazy task configuration.sourceCompatibilityandtargetCompatibilityby enforcing Java 17 globally using the modernjava { toolchain { ... } }API.java { withSourcesJar(); withJavadocJar() }DSL.Sub-Projects (
common,gateway,http,messaging, etc.)gson,opentracing,httpclient,slf4j), allowing them to inherit coordinates natively from the root constraints.implementationfor internal tools andapifor exposed transitivescom.google.auto.service:auto-servicetocompileOnlytestImplementationdependency fororg.objenesis:objenesis:testingproject to exposemockito,spock, andjunitviaapiso consumers inherit the testing framework seamlessly.Platform BOM (
platform)java-platformplugin to cleanly exposepath-coreproject constraints to external consumers.Public API Additions/Changes
N/A
Downstream Consumer Impact
N/A
How Has This Been Tested?
Verified that vulnerabilities are resolved without manual overrides by running
snyk test --all-projects --exclude=build.Snyk scan results
Checklist: