MLE-23405 - Force Spring Framework to v6 in tests. #208
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This also forces the use of Java 17 for tests.
BillFarber
requested review from
anu3990,
Copilot,
rjrudin and
stevebio
and removed request for
anu3990 and
stevebio
BillFarber
changed the title
rjrudin
requested changes
Aug 7, 2025
| java { | ||
| sourceCompatibility = 1.8 | ||
| targetCompatibility = 1.8 | ||
| sourceCompatibility = 17 |
There was a problem hiding this comment.
These need to stay on Java 8 so that the 1.11.0 release still supports Java 8.
The way to do this is to use a toolchain:
java {
// Must use Java 17 as Spring 6 requires Java 17.
toolchain {
languageVersion = JavaLanguageVersion.of(17)
}
}
That forces users - i.e. us and Jenkins - to use Java 17 or later to build and run the tests. But this block ensures that the connector still runs on Java 8.
| // upgrading ml-app-deployer to 6.0.0, which we are not ready to do yet. | ||
| force 'org.apache.commons:commons-lang3:3.18.0' | ||
|
|
||
| // Force Spring Framework v6 to avaoid CVEs in v5.3.9 and earlier. |
There was a problem hiding this comment.
Use a configurations block instead - it avoids the brittleness of trying to list every Spring dependency, and it also allows for explaining what's going on - e.g.
configurations.all {
resolutionStrategy.eachDependency { DependencyResolveDetails details ->
if (details.requested.group.startsWith('org.springframework')) {
details.useVersion '6.2.9'
details.because 'Forcing usage of Spring 6 to minimize vulnerabilities.'
}
}
}
|
Closing since Spring is also a dependency of ml-app-deployer, which would force the runtime to also be Java 17 and we don't want that yet. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This also forces the use of Java 17 for tests.
This clears up all the Spring Framework risks in BlackDuck.