Merged
Conversation
stevecl5
force-pushed
the
scl/update-dependencies
branch
5 times, most recently
from
ee50d44 to
90f612f
Compare
build: update plugins and dependencies build: clean up gradle configuration files
stevecl5
changed the title
stevecl5
force-pushed
the
scl/update-dependencies
branch
from
90f612f to
62aa68d
Compare
tessstoddard
approved these changes
Mar 3, 2026
|
Thanks for the detailed summary! That helped a lot |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of Changes
Security Patches
The following Snyk vulnerabilities are resolved by this PR:
The
pmdvulnerabilities were resolved by updating to coppuccino6.2.1which updates the PMD version to7.22.0.The
jackson-corevulnerability was resolved by setting a constraint inpath-core:utilities, sincecom.auth0:java-jwt:4.5.1(latest version) still usescom.fasterxml.jackson.core:jackson-core:2.21.0.Dependency Updates
Updated plugins and other dependencies, including:
5.x->6.2.12.x->3.0.24.5.13->4.5.14By updating Coppuccino to the latest version, plugin dependency constraints are automatically included to address known vulnerabilities introduced by the plugin. As a result, manually overriding the versions of
commons-lang3andlog4j-coreusingresolutionStrategy.eachDependencyis no longer needed. As an added benefit, the new constraints set a minimum version for the vulnerable dependencies, allowing them to resolve to newer versions when available.Dependency Cleanup & Fixes:
com.github.spotbugs:spotbugs-annotationsdependency from:common, as it is now natively provided by the updated Coppuccino plugin.org.apache.commons:commons-textto1.15.0instead of usinglatest.releaseto ensure deterministic builds and prevent breaking changes from being pulled in unintentionally.com.google.code.gson:gsonversion range (changed from[2.13.0,13.0.0)to[2.13.0,3.0.0)).org.projectlombok:lombokdependency from sub-projects, as it is already globally managed and provided by theio.freefair.lombokplugin.com.auth0:java-jwt dependencyto [4.5.1, 5.0.0) to establish a secure floor that natively resolves legacyjackson-databindvulnerabilities without requiring manual overrides.Gradle Project Improvements
In addition to the dependency changes, I also made significant improvements to the Gradle configuration files.
Root Project (
build.gradle)io.opentracingandorg.slf4j) intoextproperties to guarantee version alignment and simplify future upgrades.components.javainjections.afterEvaluatelogic forspotlessApplyandsubdependenciestasks with a more performant, lazy task configuration.sourceCompatibilityandtargetCompatibilityby enforcing Java 17 globally using the modernjava { toolchain { ... } }API.java { withSourcesJar(); withJavadocJar() }DSL.Sub-Projects (
common,gateway,http,messaging, etc.)gson,opentracing,httpclient,slf4j), allowing them to inherit coordinates natively from the root constraints.implementationfor internal tools andapifor exposed transitivescom.google.auto.service:auto-serviceto havecompileOnlyandannotationProcessorscopestestImplementationdependency fororg.objenesis:objenesis:testingproject to exposemockito,spock, andjunitviaapiso consumers inherit the testing framework seamlessly.Platform BOM (
platform)pom { ... }metadata blocks and manualsigninglogic, delegating those decoration responsibilities entirely to the centralized root configuration. The project now maintains a clean, minimaljava-platformstructure to strictly exposepath-coreconstraints.api(project(":common"))toapi project(":common")).Public API Additions/Changes
N/A
Downstream Consumer Impact
N/A
How Has This Been Tested?
Verified that vulnerabilities are resolved without manual overrides by running
snyk test --all-projects --exclude=build.Snyk scan results
Checklist: