PR for v1.5.9 #387
PR for v1.5.9 #387
Conversation
WalkthroughUpgrades Gradle wrapper, Gradle plugins and many dependencies; sets Java source/target to 17; switches wrapper scripts to use Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer / CI
participant Wrapper as gradlew / gradlew.bat
participant Java as java runtime
participant WrapperJar as gradle/wrapper/gradle-wrapper.jar
participant GradleDist as Gradle distribution
Dev->>Wrapper: run ./gradlew <task>
Wrapper->>Java: exec "java -jar $APP_HOME/gradle/wrapper/gradle-wrapper.jar" <args>
Java->>WrapperJar: start GradleWrapperMain inside JAR
WrapperJar->>GradleDist: download/bootstrap Gradle distribution if missing
GradleDist->>Dev: execute requested build task / return status
note right of GradleDist `#D6EAF8`: Wrapper updated → Gradle 9.2.1
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Points to review closely:
Possibly related PRs
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…mbok-8.x Update plugin io.freefair.lombok to v8.12.2.1
…ework-spring-messaging-6.x Update dependency org.springframework:spring-messaging to v6.2.4
…ven-publish-java-8.x Update plugin io.freefair.maven-publish-java to v8.13
…mbok-8.x Update plugin io.freefair.lombok to v8.13
…ush-action-digest Update docker/build-push-action digest to 84ad562
…ework.data-spring-data-elasticsearch-5.x Update dependency org.springframework.data:spring-data-elasticsearch to v5.4.4
…ction-digest Update docker/login-action digest to 74a5d14
…lix-eureka-client to v4.2.1
…ven-publish-java-8.x Update plugin io.freefair.maven-publish-java to v8.13.1
Update springDocVersion to v2.8.6
…ework.boot-3.x Update plugin org.springframework.boot to v3.4.4
…ework-spring-messaging-6.x Update dependency org.springframework:spring-messaging to v6.2.5
…ework.cloud-spring-cloud-starter-netflix-eureka-client-4.x Update dependency org.springframework.cloud:spring-cloud-starter-netflix-eureka-client to v4.2.1
…ring-cloud-gateway-mvc-4.x
…ework.cloud-spring-cloud-gateway-mvc-4.x Update dependency org.springframework.cloud:spring-cloud-gateway-mvc to v4.2.1
…ven-publish-java-9.x Update plugin io.freefair.maven-publish-java to v9.1.0
…mbok-9.x Update plugin io.freefair.lombok to v9.1.0
…imbus-jose-jwt-10.x Update dependency com.nimbusds:nimbus-jose-jwt to v10.6
…a-action-digest Update docker/metadata-action digest to 8d8c7c1
…ework-spring-messaging-6.x Update dependency org.springframework:spring-messaging to v6.2.13
…ndencycheck-12.x Update plugin org.owasp.dependencycheck to v12.1.9
…ework-spring-messaging-7.x Update dependency org.springframework:spring-messaging to v7
…ework.data-spring-data-elasticsearch-6.x Update dependency org.springframework.data:spring-data-elasticsearch to v6
Downgrade spring-data-elasticsearch version from 6.0.0 to 5.5.5. 6.0.0 seems to be targeted for Spring Boot 4.0 and currently won't build.
…ework.data-spring-data-elasticsearch-5.x Update dependency org.springframework.data:spring-data-elasticsearch to v5.5.6
…ework.boot-3.x Update plugin org.springframework.boot to v3.5.8
Update dependency gradle to v9.2.1
…gradle-git-properties-2.x Update plugin com.gorylenko.gradle-git-properties to v2.5.4
…a-action-digest Update docker/metadata-action digest to c299e40
…ework-spring-messaging-7.x Update dependency org.springframework:spring-messaging to v7.0.1
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
build.gradle (1)
35-37: UpdatespringBootVersionproperty to match the plugin.The build now applies
org.springframework.boot3.5.8 (line 2), but thespringBootVersionproperty still advertises 3.2.1. Downstream modules or dependency management imports that consume this property will continue pulling the 3.2.x BOM, creating a version split from the Gradle plugin and the managed dependencies you just upgraded. This was flagged in the previous review and remains unresolved.Please bump the property to 3.5.8 (or remove it if truly unused) so all consumers stay aligned.
Apply this diff to fix the version mismatch:
- set('springBootVersion', "3.2.1") + set('springBootVersion', "3.5.8")
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/workflows/docker-publish.yml(2 hunks)build.gradle(5 hunks)gradle/wrapper/gradle-wrapper.properties(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- gradle/wrapper/gradle-wrapper.properties
🔇 Additional comments (3)
build.gradle (2)
2-2: Plugin version updates look good.The plugin upgrades (Spring Boot 3.5.8, Lombok 9.1.0, Maven Publish 9.1.0, dependency-check 12.1.9, Asciidoctor 4.0.5, git-properties 2.5.4) are coordinated and align with the Gradle 9.2.1 upgrade mentioned in the PR.
Also applies to: 4-9
25-28: Java 17 source/target compatibility aligns with Gradle and plugin upgrades.The addition of Java 17 compatibility is well-placed and consistent with the modern dependency versions in this build.
.github/workflows/docker-publish.yml (1)
35-35: actions/checkout@v5 is compatible with this workflow.The v5 upgrade requires GitHub Actions runner v2.327.1+, which is provided by the
ubuntu-latestmatrix. No breaking changes affect the downstream Docker login/build steps in this workflow.
| # Once published, the packages are scoped to the account defined here. | ||
| - name: Log in to the Container registry | ||
| uses: docker/login-action@327cd5a69de6c009b9ce71bce8395f28e651bf99 | ||
| uses: docker/login-action@28fdb31ff34708d19615a74d67103ddc2ea9725c |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/docker-publish.yml | head -70Repository: kit-data-manager/base-repo
Length of output: 3360
🏁 Script executed:
#!/bin/bash
# Verify Docker action commit hashes against official GitHub releases
# We'll check the releases and tags for each Docker action repository
echo "=== Verifying docker/login-action commit hash ==="
# Hash: 28fdb31ff34708d19615a74d67103ddc2ea9725c
echo "=== Verifying docker/metadata-action commit hash ==="
# Hash: c299e40c65443455700f0fdfc63efafe5b349051
echo "=== Verifying docker/build-push-action commit hash ==="
# Hash: 9e436ba9f2d7bcd1d038c8e55d039d37896ddc5d
# Try to get release information from GitHub API for each action
for action in "login-action" "metadata-action" "build-push-action"; do
repo="docker/${action}"
echo ""
echo "=== Checking releases for $repo ==="
curl -s "https://api.github.com/repos/${repo}/releases?per_page=10" | jq -r '.[] | "\(.tag_name): \(.published_at) - Draft: \(.draft), Prerelease: \(.prerelease)"' 2>/dev/null | head -5
doneRepository: kit-data-manager/base-repo
Length of output: 1339
🏁 Script executed:
#!/bin/bash
# Get detailed release information with commit hashes
for action in "login-action" "metadata-action" "build-push-action"; do
repo="docker/${action}"
echo ""
echo "=== Release details for $repo ==="
# Get releases with tag names and their commit info
curl -s "https://api.github.com/repos/${repo}/releases?per_page=20" | jq -r '.[] | "\(.tag_name): commit SHA information available"' 2>/dev/null
done
# Now let's try to find specific commits in the tags
echo ""
echo "=== Checking specific commit hashes ==="
# For login-action: 28fdb31ff34708d19615a74d67103ddc2ea9725c
echo "docker/login-action commit 28fdb31..."
curl -s "https://api.github.com/repos/docker/login-action/commits/28fdb31ff34708d19615a74d67103ddc2ea9725c" | jq -r '.commit.message, .author.date' 2>/dev/null | head -2
# For metadata-action: c299e40c65443455700f0fdfc63efafe5b349051
echo ""
echo "docker/metadata-action commit c299e40c..."
curl -s "https://api.github.com/repos/docker/metadata-action/commits/c299e40c65443455700f0fdfc63efafe5b349051" | jq -r '.commit.message, .author.date' 2>/dev/null | head -2
# For build-push-action: 9e436ba9f2d7bcd1d038c8e55d039d37896ddc5d
echo ""
echo "docker/build-push-action commit 9e436ba9..."
curl -s "https://api.github.com/repos/docker/build-push-action/commits/9e436ba9f2d7bcd1d038c8e55d039d37896ddc5d" | jq -r '.commit.message, .author.date' 2>/dev/null | head -2Repository: kit-data-manager/base-repo
Length of output: 3110
🏁 Script executed:
#!/bin/bash
# Find which releases contain these commits
echo "=== Finding release versions for pinned commits ==="
# Get all tags for each repo and their commit SHAs
echo ""
echo "docker/login-action - finding version for 28fdb31ff34708d19615a74d67103ddc2ea9725c"
curl -s "https://api.github.com/repos/docker/login-action/git/matching-refs/tags/v" | jq -r '.[] | "\(.ref): \(.object.sha)"' 2>/dev/null | grep -E "v3|v2" | head -20
echo ""
echo "docker/metadata-action - finding version for c299e40c65443455700f0fdfc63efafe5b349051"
curl -s "https://api.github.com/repos/docker/metadata-action/git/matching-refs/tags/v" | jq -r '.[] | "\(.ref): \(.object.sha)"' 2>/dev/null | grep -E "v5|v4" | head -20
echo ""
echo "docker/build-push-action - finding version for 9e436ba9f2d7bcd1d038c8e55d039d37896ddc5d"
curl -s "https://api.github.com/repos/docker/build-push-action/git/matching-refs/tags/v" | jq -r '.[] | "\(.ref): \(.object.sha)"' 2>/dev/null | grep -E "v6|v5" | head -20Repository: kit-data-manager/base-repo
Length of output: 3435
🏁 Script executed:
#!/bin/bash
# Get detailed commit information for the pinned commits
echo "=== Commit details for pinned hashes ==="
echo ""
echo "docker/login-action@28fdb31ff34708d19615a74d67103ddc2ea9725c"
curl -s "https://api.github.com/repos/docker/login-action/commits/28fdb31ff34708d19615a74d67103ddc2ea9725c" | jq -r '.commit | "\(.author.date): \(.message)"' 2>/dev/null
echo ""
echo "docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051"
curl -s "https://api.github.com/repos/docker/metadata-action/commits/c299e40c65443455700f0fdfc63efafe5b349051" | jq -r '.commit | "\(.author.date): \(.message)"' 2>/dev/null
echo ""
echo "docker/build-push-action@9e436ba9f2d7bcd1d038c8e55d039d37896ddc5d"
curl -s "https://api.github.com/repos/docker/build-push-action/commits/9e436ba9f2d7bcd1d038c8e55d039d37896ddc5d" | jq -r '.commit | "\(.author.date): \(.message)"' 2>/dev/null
# Now check if there are any advisories or security issues
echo ""
echo "=== Checking for security advisories ==="
for action in "login-action" "metadata-action" "build-push-action"; do
repo="docker/${action}"
echo ""
echo "$repo:"
curl -s "https://api.github.com/repos/${repo}/security/advisories" | jq -r '.[] | "\(.ghsa_id): \(.summary)"' 2>/dev/null | head -3
doneRepository: kit-data-manager/base-repo
Length of output: 898
Update Docker action pins to use released versions instead of unreleased commits.
Two of the three Docker action commits do not correspond to any official release:
-
Line 40 (
docker/login-action@28fdb31ff...): Pinned to an unreleased commit from October 17, 2025, which is after the latest stable release v3.6.0 (September 29, 2025). This commit should be pinned to v3.6.0 or verified as a release candidate. -
Line 59 (
docker/build-push-action@9e436ba9f2d...): Pinned to an unreleased commit from September 29, 2025. The latest stable release is v6.18.0 (May 27, 2025). This commit is significantly newer than any released version and should be replaced with a stable release tag. -
Line 52 (
docker/metadata-action@c299e40c...): ✓ Correctly pinned to v5.10.0 (latest stable release as of November 27, 2025).
Using unreleased commits bypasses the official release review process and introduces unnecessary risk. Pin to stable release versions (e.g., v3.6.0, v6.18.0) instead.
🤖 Prompt for AI Agents
.github/workflows/docker-publish.yml around line 40: the docker actions are
pinned to unreleased commit SHAs which bypass release review and add risk;
replace docker/login-action@28fdb31ff34708d19615a74d67103ddc2ea9725c with the
released tag docker/[email protected], and replace
docker/build-push-action@9e436ba9f2d... (line 59) with
docker/[email protected]; leave docker/[email protected] as-is and
verify workflow still works after updating these tags.
| implementation 'org.springframework.data:spring-data-elasticsearch:5.5.6' | ||
|
|
||
| implementation "org.springframework:spring-messaging:6.2.2" | ||
| implementation "org.springframework:spring-messaging:7.0.1" | ||
|
|
||
| // cloud support | ||
| implementation "org.springframework.cloud:spring-cloud-starter-config:4.2.0" | ||
| implementation "org.springframework.cloud:spring-cloud-starter-netflix-eureka-client:4.2.0" | ||
| implementation "org.springframework.cloud:spring-cloud-gateway-mvc:4.2.0" | ||
| implementation 'de.codecentric:spring-boot-admin-starter-client:3.4.1' | ||
| implementation "org.springframework.cloud:spring-cloud-starter-config:4.3.0" | ||
| implementation "org.springframework.cloud:spring-cloud-starter-netflix-eureka-client:4.3.0" | ||
| implementation "org.springframework.cloud:spring-cloud-gateway-mvc:4.3.2" | ||
| implementation 'de.codecentric:spring-boot-admin-starter-client:3.5.6' |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, locate the build.gradle file
find . -name "build.gradle" -type fRepository: kit-data-manager/base-repo
Length of output: 84
🏁 Script executed:
# Check file size and read the build.gradle file
wc -l ./build.gradle && echo "---" && cat -n ./build.gradleRepository: kit-data-manager/base-repo
Length of output: 6508
🏁 Script executed:
# Check if springBootVersion property is used elsewhere in gradle files
grep -r "springBootVersion" . --include="*.gradle" 2>/dev/null
# Also check the referenced gradle profile files
echo "--- Checking profile-minimal.gradle ---"
cat ./gradle/profile-minimal.gradle 2>/dev/null || echo "File not found"
echo "--- Checking profile-complete.gradle ---"
cat ./gradle/profile-complete.gradle 2>/dev/null || echo "File not found"Repository: kit-data-manager/base-repo
Length of output: 815
🏁 Script executed:
# Search for any usage of springBootVersion variable in code or documentation
rg "springBootVersion" --type gradle --type java 2>/dev/null | grep -v "set('springBootVersion"
# Also check if there are any imports or references in other build files
find . -name "*.gradle" -o -name "*.properties" | xargs grep -l "springBootVersion" 2>/dev/nullRepository: kit-data-manager/base-repo
Length of output: 84
Remove the unused springBootVersion property and verify dependency compatibility.
The dependency versions (Spring Data Elasticsearch 5.5.6, Spring Messaging 7.0.1, Spring Cloud modules 4.3.x, Spring Boot Admin 3.5.6, repo-core 1.2.6, service-base 1.3.6, nimbus-jose-jwt 10.6, PostgreSQL 42.7.8, H2 2.4.240, spring-restdocs-mockmvc 3.0.5, and Jacoco 0.8.14) align with Spring Boot 3.5.8. However, the ext block defines an unused springBootVersion property set to "3.2.1" (line 36) that should be removed to avoid confusion. The effective Spring Boot version is 3.5.8 from the plugin declaration.
Summary by CodeRabbit
Chores
Tests
Documentation
✏️ Tip: You can customize this high-level summary in your review settings.