[aarsilv]

🤖 Generated from Claude

Jira: FFESUPPORT-1065

Summary

Dependabot shows 0 alerts for this repo, because the GitHub dependency graph does not resolve Gradle dependencies. An OSV scan of every resolved Gradle configuration, on JDK 21 and JDK 8, finds advisories on the build classpath and on the test classpath. The Gradle wrapper (8.5) also has five Gradle advisories. The runtime classpath has none; for example, the SDK already declares jackson-databind 2.22.3 directly.

This PR closes every advisory that the scan found, except two groups (see Deferred): tika-core on the build classpath, and the dependencies of WireMock on the test classpath. It also applies or replaces the four open Dependabot PRs, each of which failed CI or needed more changes. There is no version bump, because 6.0.0 is not released yet.

Advisories

There is no lockfile. "Where" names the declaration or the dependency path that brings in each package.

Package	Advisories	Where	Before → after	Ships?
Gradle	GHSA-mqwm-5m85-gmcv, GHSA-w78c-w6vf-rw82, GHSA-j5m7-59rp-24f5, GHSA-xwqc-3h47-hg64, GHSA-mvvg-497x-hmj8 (high)	wrapper	8.5 → 8.14.6	No
bcprov, bcpg, bcpkix (jdk18on)	GHSA-574f-3g2m-x479, GHSA-9pwp-9qqc-pr26 (critical); GHSA-p93r-85wp-75v3, GHSA-qp49-qgx5-5m26, GHSA-cj8j-37rh-8475 (high); GHSA-c3fc-8qff-9hwx, GHSA-wg6q-6289-32hp (moderate)	through jreleaser	1.82 → 1.85	No
jackson-databind, jackson-core (build classpath)	15 advisories, including GHSA-j3rv-43j4-c7qm and GHSA-cxp5-3px4-pw24 (high)	through jreleaser	2.20.0 → 2.22.3	No
httpcore5-h2	GHSA-v3jc-474w-2wm6 (high)	through jreleaser 1.26.0 → httpclient5	5.4 → 5.4.3	No
httpclient5	GHSA-hjcp-jmpx-g3qm (moderate)	through jreleaser 1.26.0	5.6.1 → 5.6.3	No
plexus-utils	GHSA-6fmv-xxpf-w3cw (high)	through jreleaser	3.2.1 → 3.6.1	No
org.eclipse.jgit	GHSA-vrpq-qp53-qv56 (moderate)	through spotless 6.13.0	5.13.3 → 5.13.5	No
logback-core	GHSA-qqpg-mvqg-649v, GHSA-p47f-322f-whfh, GHSA-jhq6-gfmj-v8fx (low)	test, through logback-classic 1.3.16	removed	No

httpclient5 and httpcore5-h2 rows appear only after the jreleaser upgrade: jreleaser 1.21.0 does not pull them.

What changed

• Build classpath: jreleaser 1.21.0 → 1.26.0, the latest release (build(deps): bump org.jreleaser from 1.21.0 to 1.26.0 #163). This clears bouncycastle. It also lifts jgit to 5.13.5, because jreleaser 1.26.0 requests a newer jgit than spotless 6.13.0.
  • jreleaser 1.26.0 still pulls jackson 2.22.1, httpclient5 5.6.1 and plexus-utils 3.2.1. A new buildscript {} block above plugins {} adds constraints for the smallest fixed versions: jackson-databind 2.22.3, httpclient5 5.6.3 (which brings httpcore5-h2 5.4.3) and plexus-utils 3.6.1. All jackson modules align at 2.22.3 through jackson-bom.
  • A constraint only sets a minimum, so it stops having an effect after jreleaser pulls newer versions. The constraints apply to the whole build classpath, but in this build only jreleaser's dependencies include these libraries; spotless does not. sdk-common-jdk#278 adds the same constraints.
• Gradle wrapper: 8.5 → 8.14.6, the latest Gradle 8 release. build(deps): bump gradle-wrapper from 8.5 to 9.8.2 #160 proposes 9.8.2, but Gradle 9 requires Java 17 to run, and CI runs Gradle on Java 8 and 11. The wrapper task regenerated gradlew, gradlew.bat and the wrapper jar, and added networkTimeout=10000 and validateDistributionUrl=true to gradle-wrapper.properties. The wrapper jar matches the checksum that Gradle publishes. A new Dependabot ignore rule stops PRs for new Gradle major versions. Remove it when CI no longer runs Gradle on Java 8 and 11.
• JUnit: junit-bom 5.11.4 → 5.14.4 (build(deps): bump org.junit:junit-bom from 5.11.4 to 5.14.4 #162), plus testRuntimeOnly 'org.junit.platform:junit-platform-launcher'. build(deps): bump org.junit:junit-bom from 5.11.4 to 5.14.4 #162 failed because Gradle used its bundled launcher, which does not match JUnit Platform 1.14: OutputDirectoryCreator not available; probably due to unaligned versions of the junit-platform-engine and junit-platform-launcher jars.
• Test logging: logback-classic 1.3.16 → slf4j-simple 2.0.17. src/test/resources/simplelogger.properties replaces the two logback configs, logback.xml and logback-test.xml, which this PR deletes.
  • The logback fixes exist only in logback 1.5 and later, which require Java 11. That is why build(deps): bump ch.qos.logback:logback-classic from 1.3.16 to 1.6.6 #161 (logback 1.6.6) failed CI.
  • logback is only the test logging backend: no code refers to it. Fix up logging #140 already moved it from main to test.
  • slf4j-simple keeps the DEBUG level, the HH:mm:ss.SSS time format and the output to stdout.

How the tests and CI protect this change

• PR checks: lint-test-sdk runs ./gradlew check (tests and spotless) on JDK 8, 11, 17, and 21.
• Local results (executed), with fresh sdk-test-data:
  • main: 44 tests pass.
  • This branch: JDK 21 check and JDK 8 (eclipse-temurin:8-jdk in docker) clean check pass. 44 tests, and spotless passes.
  • Resolved graph, JDK 21 and JDK 8: OSV reports 0 advisories on the runtime classpath. The remaining rows are the two deferred groups.
  • The test runtime classpath has no logback. Test log output has 10,784 lines against 10,787 with logback, in the same format, with no SLF4J warnings.
• Publish path: no PR check runs a jreleaser task. I ran the jreleaser steps with a throwaway GPG key, on main (342d33c, jreleaser 1.21.0, Gradle 8.5) and on this branch's head (e6aba6d, jreleaser 1.26.0 with constraints, Gradle 8.14.6). The comparison is of file names and signatures, not file contents:
  • Release mode on JDK 8 (publish-sdk.yml), with the version set to 6.0.0 locally: jreleaserConfig, publish -Prelease and jreleaserDeploy --dryrun pass on both. The staged files (35) have the same names, and gpg --verify accepts all 5 signatures.
  • Snapshot mode on JDK 17 (publish-snapshot.yml): the steps pass on both. The staged files (40) have the same names, and all 5 signatures verify.

Not validated before merge

• A real deploy to Maven Central. --dryrun skips the network calls. On merge, publish-snapshot.yml deploys a snapshot with jreleaser 1.26.0 and the constraints for the first time. If that run fails, revert the jreleaser and constraints commits.
• The S3 deployer. Only jreleaser's S3 deployer uses httpclient5. This build does not configure an S3 deployer, so no dry run exercises it.

Deferred

• WireMock dependencies (33 advisory rows, test classpath only): Jetty 9.4.49, guava 31.1, handlebars 4.3.1, json-path 2.7.0, commons-fileupload 1.4, commons-io 2.11.0, json-smart 2.4.x, commons-lang3 3.12.0, httpclient5 and httpcore5 5.1.3, and xmlunit 2.9.0.
  • wiremock-jre8 2.35.2 is the last WireMock release for Java 8; WireMock 3 requires Java 11.
  • Constraints could fix part of the list, but not all of it. For example, Jetty 9.4.58, the last Jetty 9.4 release on Maven Central, fixes 13 of the 18 Jetty rows. The other 5 are fixed only in Jetty 12, or in later 9.4 releases that are not on Maven Central. Constraints would also force about ten versions under a test library.
  • Follow-up: replace WireMock with OkHttp MockWebServer in EppoClientTest after Prepare Java server SDK 6.0.0 with stable common v4 #158 merges, because Prepare Java server SDK 6.0.0 with stable common v4 #158 adds WireMock tests. That removes all 33 rows.
• tika-core 2.9.4 (GHSA-f58c-gq56-vjjf, critical), on the build classpath through jreleaser. The fix, 3.2.2, is a major upgrade that targets Java 11, and publish-sdk.yml runs on JDK 8. In jreleaser 1.26.0, ClientUtils calls Tika.detect(Path) to find a file's media type. Both deployers in this build read from build/staging-deploy, which this build writes. The publish jobs hold signing and Maven Central credentials, so this stays open until jreleaser moves to a fixed Tika.
• Released artifacts: eppo-server-sdk 5.3.4 declares jackson-databind 2.20.1 and sdk-common-jvm 3.13.2, which have runtime advisories. This PR does not change them. main already declares jackson-databind 2.22.3, so 6.0.0 ships a fixed runtime version.
• Dependency graph: a Gradle dependency-submission workflow would let Dependabot alert on these dependencies.

Dependabot PRs

• build(deps): bump org.junit:junit-bom from 5.11.4 to 5.14.4 #162 and build(deps): bump org.jreleaser from 1.21.0 to 1.26.0 #163: this PR applies them at the same versions. Dependabot should close them after merge.
• build(deps): bump gradle-wrapper from 8.5 to 9.8.2 #160 (Gradle 9.8.2): declined for 8.14.6. The ignore rule stops new PRs for Gradle major versions. Close build(deps): bump gradle-wrapper from 8.5 to 9.8.2 #160 after merge if Dependabot does not.
• build(deps): bump ch.qos.logback:logback-classic from 1.3.16 to 1.6.6 #161 (logback 1.6.6): declined. This PR removes logback, so Dependabot should close build(deps): bump ch.qos.logback:logback-classic from 1.3.16 to 1.6.6 #161.

Merge order

#158 (the 6.0.0 release) edits the build.gradle line next to the logback and junit lines. A test merge of the two branches (git merge-tree) conflicts in build.gradle. Merge this PR first and rebase #158, or the reverse. The runtime classpath does not depend on the order.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the build and test dependency updates.

No open issues 🎉

What changed in this PR

This PR addresses build and test dependency vulnerabilities while preserving Java 8 compatibility. Runtime SDK dependencies remain unchanged; Tika and WireMock dependency advisories are explicitly deferred.

Changes:

• Upgrade JReleaser and add minimum-version constraints for vulnerable build dependencies.
• Upgrade the Gradle wrapper to 8.14.6 and ignore major wrapper updates in Dependabot.
• Upgrade JUnit with an aligned platform launcher and replace test-only Logback with SLF4J Simple.

File	Description
src/​test/​resources/​simplelogger.properties	Configure DEBUG test logging with timestamps and stdout output.
src/​test/​resources/​logback.xml	Remove obsolete Logback configuration.
src/​test/​resources/​logback-test.xml	Remove obsolete test-specific Logback configuration.
gradlew.bat	Refresh the Windows wrapper launcher.
gradlew	Refresh the Unix wrapper launcher.
gradle/​wrapper/​gradle-wrapper.properties	Select Gradle 8.14.6 and add download settings.
build.gradle	Update build and test dependencies and add version constraints.
.github/​dependabot.yml	Ignore major Gradle wrapper updates to preserve older-JDK support.

_{Review effort: Balanced}

[aarsilv]

🤖 Response from codex:

Pre-push review of the branch: no blocking issues found. Two non-blocking notes:

• slf4j-simple writes to stderr by default, and the logback console appender wrote to stdout. Fixed: simplelogger.properties sets logFile=System.out.
• The regenerated gradlew has a template placeholder (optsEnvironmentVar) in a comment. Left as Gradle generates it.

Fact-check of this description, three rounds:

• Round 1 found two wrong claims: the "Where" column note, and "Users get these fixes with 6.0.0" (this PR changes no runtime dependency). It also found omissions: the deleted logback configs, the regenerated wrapper files, and the scope of the Dependabot ignore rule. All are fixed.
• Round 2 questioned the Jetty sentence. A check of the OSV data showed that Jetty 9.4.58 fixes 13 of the 18 Jetty rows, so the description now says that constraints could fix part of the WireMock list.
• Round 3 verdict: POST. No factual defect and no sensitive content.

Claims that rest on executed results (tests, OSV scans, dry runs) stay unverified by codex, because its sandbox runs nothing.

[aarsilv]

🤖 Context from Claude:

Gradle requires buildscript {} before plugins {}. Constraints here also apply to plugins that the plugins {} block resolves, such as jreleaser.

To check them, run ./gradlew buildEnvironment. Each constrained module shows an arrow, for example org.codehaus.plexus:plexus-utils:3.2.1 -> 3.6.1. When a jreleaser upgrade pulls a version at or above a constraint, that arrow goes away. Then delete that line.

PR CI does not run jreleaser tasks. After a change to this block, run the publish steps with --dryrun, or watch the next publish workflow.