[#2845] Bump Spring boot to 4.x

Notes:
1. (!) Eclipselink shall be migrated to 5.0 (in 4.0.8 there are incompatible classes, e.g EJBQueryImpl doesn't implement some newer methods). In the moment is with beta (5.0.0-B12) - JUST for testing!
2. (!) Ethlo plugin doesn't work with Eclipselink 5.0, it builds with Eclipselink 4.0.8 (could be a problem)
3. Dependencies - new starters, test starters changes, some dependencies refactoring
4. Auto-configs split - package changes, some properties classes changes
5. Spring nullable org.springframework.lang.Nullable/NonNull are depecated and replaced with jspcify -> org.jspecify.annotations.Nullable/NonNull (NullMarked)
6. Lombok config - adding lombok.addNullAnnotations=jspecify - to do not mess annotations
7. Distributed lock table changes - SP_LOCK table db migration
8. Spring Retry replaced with Spring Core Retry - does repace retry in hawkbit
9. Specifications -> added Update/Delete(/Predicate) Specifications and JpaSpecificationExecutor changed
10. HawkbitBaseRepositoryFactoryBean modified to register properly
11. Jackson - 2 -> 3, package migrations, finals are not deserialized by default(enable finals deserialization, consider make non-final), too ‘smart’ tries to set complex objects instead of using non args constructor (-> @JsonIgnore), some other default configs made

Signed-off-by: Avgustin Marinov <[email protected]>

Author: avgustinmm

hawkbit-artifact/hawkbit-artifact-api/pom.xml

@@ -27,26 +27,5 @@
             <artifactId>hawkbit-core</artifactId>
             <version>${project.version}</version>
         </dependency>
-
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-config</artifactId>
-        </dependency>
-
-        <dependency>
-            <groupId>jakarta.validation</groupId>
-            <artifactId>jakarta.validation-api</artifactId>
-        </dependency>
-
-        <!-- TEST -->
-        <dependency>
-            <groupId>io.github.classgraph</groupId>
-            <artifactId>classgraph</artifactId>
-            <scope>test</scope>
-        </dependency>
     </dependencies>
 </project>

hawkbit-artifact/hawkbit-artifact-fs/pom.xml

@@ -27,18 +27,5 @@
             <artifactId>hawkbit-artifact-api</artifactId>
             <version>${project.version}</version>
         </dependency>
-
-        <dependency>
-            <groupId>org.springframework</groupId>
-            <artifactId>spring-core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-autoconfigure</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>commons-io</groupId>
-            <artifactId>commons-io</artifactId>
-        </dependency>
     </dependencies>
 </project>

hawkbit-artifact/hawkbit-artifact-fs/src/main/java/org/eclipse/hawkbit/artifact/fs/FileArtifactStorage.java

@@ -19,7 +19,6 @@
 import java.nio.file.Path;
 import java.nio.file.Paths;
 
-import org.apache.commons.io.FileUtils;
 import org.eclipse.hawkbit.artifact.AbstractArtifactStorage;
 import org.eclipse.hawkbit.artifact.ArtifactStorage;
 import org.eclipse.hawkbit.artifact.exception.ArtifactBinaryNotFoundException;
@@ -47,7 +46,7 @@ public FileArtifactStorage(final FileArtifactProperties artifactResourceProperti
 
     @Override
     public void deleteBySha1(final String tenant, final String sha1) {
-        FileUtils.deleteQuietly(getFile(tenant, sha1));
+        deleteSilent(getFile(tenant, sha1));
     }
 
     @Override
@@ -65,7 +64,7 @@ public InputStream getBySha1(final String tenant, final String sha1) {
 
     @Override
     public void deleteByTenant(final String tenant) {
-        FileUtils.deleteQuietly(Paths.get(artifactResourceProperties.getPath(), sanitizeTenant(tenant)).toFile());
+        deleteSilent(Paths.get(artifactResourceProperties.getPath(), sanitizeTenant(tenant)).toFile());
     }
 
     @Override
@@ -78,7 +77,7 @@ protected void store(final String tenant, final ArtifactHashes base16Hashes, fin
             throws IOException {
         final File fileSHA1Naming = getFile(tenant, base16Hashes.sha1());
         if (fileSHA1Naming.exists()) {
-            FileUtils.deleteQuietly(tempFile);
+            deleteSilent(tempFile);
         } else {
             Files.move(tempFile.toPath(), fileSHA1Naming.toPath());
         }
@@ -107,4 +106,24 @@ private Path getSha1DirectoryPath(final String tenant, final String sha1) {
         final String folder2 = sha1.substring(length - 2, length);
         return Paths.get(artifactResourceProperties.getPath(), sanitizeTenant(tenant), folder1, folder2);
     }
+
+    @SuppressWarnings({ "java:S899", "java:S4042" }) // just ignore the result - silent
+    private static void deleteSilent(final File file) {
+        if (file.exists()) {
+            if (file.isDirectory()) {
+                // delete children
+                final File[] children = file.listFiles();
+                if (children != null) {
+                    for (final File child : children) {
+                        deleteSilent(child);
+                    }
+                }
+            }
+            try {
+                file.delete(); // silent
+            } catch (final Exception ignored) {
+                // ignore
+            }
+        }
+    }
 }

hawkbit-artifact/hawkbit-artifact-fs/src/test/java/org/eclipse/hawkbit/artifact/fs/FileArtifactStorageTest.java

@@ -15,11 +15,11 @@
 import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
 import java.util.Random;
 
 import lombok.extern.slf4j.Slf4j;
-import org.apache.commons.io.FileUtils;
-import org.apache.commons.io.IOUtils;
 import org.assertj.core.api.Assertions;
 import org.eclipse.hawkbit.artifact.AbstractArtifactStorage;
 import org.eclipse.hawkbit.artifact.exception.ArtifactBinaryNotFoundException;
@@ -54,7 +54,7 @@ static void setup() {
     static void afterClass() {
         if (new File(artifactResourceProperties.getPath()).exists()) {
             try {
-                FileUtils.deleteDirectory(new File(artifactResourceProperties.getPath()));
+                delete(new File(artifactResourceProperties.getPath()));
             } catch (final IOException | IllegalArgumentException e) {
                 log.warn("Cannot delete file-directory", e);
             }
@@ -69,9 +69,10 @@ void storeSuccessfully() throws IOException {
         final byte[] fileContent = randomBytes();
         final StoredArtifactInfo artifact = storeRandomArtifact(fileContent);
 
-        final byte[] readContent = new byte[fileContent.length];
-        IOUtils.read(artifactFilesystemRepository.getBySha1(TENANT, artifact.getHashes().sha1()), readContent);
-        assertThat(readContent).isEqualTo(fileContent);
+        try (final InputStream is = artifactFilesystemRepository.getBySha1(TENANT, artifact.getHashes().sha1())) {
+            final byte[] readContent = is.readAllBytes();
+            assertThat(readContent).isEqualTo(fileContent);
+        }
     }
 
     /**
@@ -141,4 +142,20 @@ private StoredArtifactInfo storeRandomArtifact(final byte[] fileContent) throws
             return artifactFilesystemRepository.store(TENANT, inputStream, "filename.tmp", "application/txt", null);
         }
     }
+
+    private static void delete(final File file) throws IOException {
+        if (file.exists()) {
+            if (file.isDirectory()) {
+                // delete children
+                final File[] children = file.listFiles();
+                if (children != null) {
+                    for (final File child : children) {
+                        delete(child);
+                    }
+                }
+            }
+
+            Files.delete(file.toPath());
+        }
+    }
 }

hawkbit-autoconfigure/pom.xml

@@ -44,13 +44,6 @@
             <artifactId>protostuff-core</artifactId>
             <optional>true</optional>
         </dependency>
-
-        <dependency>
-            <groupId>jakarta.servlet</groupId>
-            <artifactId>jakarta.servlet-api</artifactId>
-            <scope>provided</scope>
-        </dependency>
-
         <dependency>
             <groupId>io.protostuff</groupId>
             <artifactId>protostuff-runtime</artifactId>

hawkbit-autoconfigure/src/main/java/org/eclipse/hawkbit/autoconfigure/security/SecurityAutoConfiguration.java

@@ -18,8 +18,8 @@
 import org.eclipse.hawkbit.tenancy.TenantAwareUserProperties;
 import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.boot.autoconfigure.security.SecurityProperties;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.boot.security.autoconfigure.SecurityProperties;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;

hawkbit-autoconfigure/src/main/java/org/eclipse/hawkbit/autoconfigure/security/StaticUserManagementAutoConfiguration.java

@@ -11,8 +11,8 @@
 
 import org.eclipse.hawkbit.auth.StaticAuthenticationProvider;
 import org.eclipse.hawkbit.tenancy.TenantAwareUserProperties;
-import org.springframework.boot.autoconfigure.security.SecurityProperties;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.boot.security.autoconfigure.SecurityProperties;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.Ordered;
 import org.springframework.core.annotation.Order;

hawkbit-core/pom.xml

@@ -24,72 +24,43 @@
     <dependencies>
         <dependency>
             <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-config</artifactId>
+            <artifactId>spring-boot-starter-security</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-actuator-autoconfigure</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework</groupId>
-            <artifactId>spring-web</artifactId>
+            <artifactId>spring-boot-starter-security-oauth2-client</artifactId>
         </dependency>
         <dependency>
-            <groupId>org.springframework.data</groupId>
-            <artifactId>spring-data-commons</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework</groupId>
-            <artifactId>spring-context-support</artifactId>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-cache</artifactId>
         </dependency>
         <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-oauth2-core</artifactId>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-webmvc</artifactId>
+            <optional>true</optional>
         </dependency>
         <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-aspects</artifactId>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-data-jpa</artifactId>
+            <optional>true</optional>
         </dependency>
         <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-web</artifactId>
-            <!-- needed for web MDC filter -->
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
             <optional>true</optional>
         </dependency>
 
         <dependency>
-            <groupId>jakarta.validation</groupId>
-            <artifactId>jakarta.validation-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>jakarta.servlet</groupId>
-            <artifactId>jakarta.servlet-api</artifactId>
+            <groupId>tools.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
         </dependency>
         <dependency>
-            <groupId>io.micrometer</groupId>
-            <artifactId>micrometer-core</artifactId>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
         </dependency>
         <dependency>
             <groupId>com.github.ben-manes.caffeine</groupId>
             <artifactId>caffeine</artifactId>
         </dependency>
-
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-databind</artifactId>
-            <!-- needed for JSON context serialization -->
-            <optional>true</optional>
-        </dependency>
-
-        <!-- TEST -->
-        <dependency>
-            <groupId>io.github.classgraph</groupId>
-            <artifactId>classgraph</artifactId>
-            <scope>test</scope>
-        </dependency>
     </dependencies>
 </project>

hawkbit-core/src/main/java/org/eclipse/hawkbit/HawkbitAutoConfiguration.java

@@ -0,0 +1,26 @@
+/**
+ * Copyright (c) 2025 Contributors to the Eclipse Foundation
+ *
+ * This program and the accompanying materials are made
+ * available under the terms of the Eclipse Public License 2.0
+ * which is available at https://www.eclipse.org/legal/epl-2.0/
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ */
+package org.eclipse.hawkbit;
+
+import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Import;
+import org.springframework.context.annotation.PropertySource;
+
+/**
+ * The {@link HawkbitAutoConfiguration} brings some default configurations needed for hawkbit. It does:
+ * <ul>
+ *     <li>Import {@link JacksonAutoConfiguration} and applies hawkbit-jackson-defaults.properties in order to configure the {@link tools.jackson.databind.json.JsonMapper}.</li>
+ * </ul>
+ */
+@Configuration
+@Import(JacksonAutoConfiguration.class)
+@PropertySource("classpath:/hawkbit-jackson-defaults.properties")
+public class HawkbitAutoConfiguration {}

hawkbit-core/src/main/java/org/eclipse/hawkbit/auth/StaticAuthenticationProvider.java

@@ -20,7 +20,7 @@
 import org.eclipse.hawkbit.tenancy.TenantAwareAuthenticationDetails;
 import org.eclipse.hawkbit.tenancy.TenantAwareUser;
 import org.eclipse.hawkbit.tenancy.TenantAwareUserProperties;
-import org.springframework.boot.autoconfigure.security.SecurityProperties;
+import org.springframework.boot.security.autoconfigure.SecurityProperties;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
 import org.springframework.security.core.Authentication;