Skip to content

Commit 91fcd8e

Browse files
codefromthecryptcodefromthecrypt
authored
spring-beans: uses version with CVEs only via invoker (#1417)
Similar to #1413, this hides the intentionally not updated version in an invoker test. Signed-off-by: Adrian Cole <adrian@tetrate.io>
1 parent 6224d3f commit 91fcd8e

File tree

12 files changed

+215
-30
lines changed

12 files changed

+215
-30
lines changed

‎context/log4j12/pom.xml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@
2929
<!-- Matches Export-Package in bnd.bnd -->
3030
<module.name>brave.context.log4j12</module.name>
3131

32-
<log4j12.version>1.2.17</log4j12.version>
3332
<main.basedir>${project.basedir}/../..</main.basedir>
3433
</properties>
3534

‎context/log4j12/src/it/log4j12/src/test/resources/log4j.properties‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,3 @@
1-
#
2-
# Copyright 2013-2024 The OpenZipkin Authors
3-
#
4-
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
5-
# in compliance with the License. You may obtain a copy of the License at
6-
#
7-
# http://www.apache.org/licenses/LICENSE-2.0
8-
#
9-
# Unless required by applicable law or agreed to in writing, software distributed under the License
10-
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
11-
# or implied. See the License for the specific language governing permissions and limitations under
12-
# the License.
13-
#
14-
151
log4j.rootLogger=INFO, console
162
log4j.appender.console=org.apache.log4j.ConsoleAppender
173
log4j.appender.console.layout=org.apache.log4j.PatternLayout

‎instrumentation/spring-web/pom.xml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@
4141
<dependency>
4242
<groupId>org.springframework</groupId>
4343
<artifactId>spring-web</artifactId>
44+
<!-- TODO: revlocked at spring 5. We may need a new module for v6 -->
4445
<version>${spring5.version}</version>
4546
<scope>provided</scope>
4647
</dependency>
@@ -109,7 +110,7 @@
109110
<DynamicDependency>
110111
<groupId>org.springframework</groupId>
111112
<artifactId>spring-web</artifactId>
112-
<version>${spring.version}</version>
113+
<version>${spring3.version}</version>
113114
<repositoryType>MAIN</repositoryType>
114115
<type>jar</type>
115116
</DynamicDependency>

‎instrumentation/spring-web/src/it/spring3/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
33
4-
Copyright 2013-2023 The OpenZipkin Authors
4+
Copyright 2013-2024 The OpenZipkin Authors
55
66
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
77
in compliance with the License. You may obtain a copy of the License at
@@ -36,7 +36,7 @@
3636
<dependency>
3737
<groupId>org.springframework</groupId>
3838
<artifactId>spring-web</artifactId>
39-
<version>@spring.version@</version>
39+
<version>@spring3.version@</version>
4040
<scope>provided</scope>
4141
</dependency>
4242

‎instrumentation/spring-webmvc/pom.xml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,9 +68,48 @@
6868

6969
<build>
7070
<plugins>
71+
<!-- Test org.springframework:spring-beans dep via invoker -->
7172
<plugin>
7273
<artifactId>maven-invoker-plugin</artifactId>
7374
</plugin>
75+
<plugin>
76+
<groupId>de.qaware.maven</groupId>
77+
<artifactId>go-offline-maven-plugin</artifactId>
78+
<executions>
79+
<execution>
80+
<phase>package</phase>
81+
<goals>
82+
<goal>resolve-dependencies</goal>
83+
</goals>
84+
</execution>
85+
</executions>
86+
<configuration>
87+
<!-- Add dependencies specific to invoker tests so that they cache on go-offline -->
88+
<dynamicDependencies>
89+
<DynamicDependency>
90+
<groupId>org.eclipse.jetty</groupId>
91+
<artifactId>jetty-servlet</artifactId>
92+
<version>${jetty-servlet25.version}</version>
93+
<repositoryType>MAIN</repositoryType>
94+
<type>jar</type>
95+
</DynamicDependency>
96+
<DynamicDependency>
97+
<groupId>org.springframework</groupId>
98+
<artifactId>spring-webmvc</artifactId>
99+
<version>${spring25.version}</version>
100+
<repositoryType>MAIN</repositoryType>
101+
<type>jar</type>
102+
</DynamicDependency>
103+
<DynamicDependency>
104+
<groupId>org.springframework</groupId>
105+
<artifactId>spring-webmvc</artifactId>
106+
<version>${spring3.version}</version>
107+
<repositoryType>MAIN</repositoryType>
108+
<type>jar</type>
109+
</DynamicDependency>
110+
</dynamicDependencies>
111+
</configuration>
112+
</plugin>
74113
</plugins>
75114
</build>
76115

‎instrumentation/spring-webmvc/src/it/servlet25/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
33
4-
Copyright 2013-2023 The OpenZipkin Authors
4+
Copyright 2013-2024 The OpenZipkin Authors
55
66
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
77
in compliance with the License. You may obtain a copy of the License at
@@ -40,7 +40,7 @@
4040
<dependency>
4141
<groupId>org.springframework</groupId>
4242
<artifactId>spring-webmvc</artifactId>
43-
<version>@spring.version@</version>
43+
<version>@spring3.version@</version>
4444
<scope>provided</scope>
4545
</dependency>
4646

‎instrumentation/spring-webmvc/src/it/spring25/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
33
4-
Copyright 2013-2023 The OpenZipkin Authors
4+
Copyright 2013-2024 The OpenZipkin Authors
55
66
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
77
in compliance with the License. You may obtain a copy of the License at
@@ -40,7 +40,7 @@
4040
<dependency>
4141
<groupId>org.springframework</groupId>
4242
<artifactId>spring-webmvc</artifactId>
43-
<version>2.5.6</version>
43+
<version>@spring25.version@</version>
4444
<scope>provided</scope>
4545
</dependency>
4646

‎pom.xml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,13 @@
8787
<!-- to test @Inject annotations. Note 7.x is for jakarta annotations! -->
8888
<guice.version>6.0.0</guice.version>
8989

90+
<!-- Note: Spring 6 is JDK 17 bytecode, so we can't update to it until we
91+
stop supporting Java 6 compilation target, or change our release to
92+
use multiple tool chains. -->
93+
<spring5.version>5.3.32</spring5.version>
9094
<!-- Ensure older versions of spring still work -->
91-
<spring5.version>5.3.31</spring5.version>
92-
<spring.version>3.2.18.RELEASE</spring.version>
95+
<spring25.version>2.5.6</spring25.version>
96+
<spring3.version>3.2.18.RELEASE</spring3.version>
9397

9498
<!-- Apis used, but not in Jetty 7.6* imply duplication in servlet25 test fixtures -->
9599
<jetty.version>9.4.53.v20231009</jetty.version>
@@ -103,12 +107,14 @@
103107
<kafka.version>3.6.1</kafka.version>
104108
<activemq.version>5.18.3</activemq.version>
105109
<activemq.artemis.version>2.31.2</activemq.artemis.version>
106-
<!-- TODO: reflection drift after this version -->
110+
<!-- TODO: reflection drift after this version. Make changes as necessary
111+
and add an invoker test that 2.3.6 still works. -->
107112
<spring-rabbit.version>2.3.6</spring-rabbit.version>
108113

109114
<!-- TODO: update and fix drift or remove the FinagleContextInteropTest -->
110115
<finagle.version>20.12.0</finagle.version>
111-
<log4j.version>2.22.1</log4j.version>
116+
<log4j.version>2.23.0</log4j.version>
117+
<log4j12.version>1.2.17</log4j12.version>
112118
<okhttp.version>4.12.0</okhttp.version>
113119
<httpclient.version>4.5.14</httpclient.version>
114120

@@ -123,9 +129,9 @@
123129
<httpasyncclient.version>4.1.5</httpasyncclient.version>
124130

125131
<!-- Test only dependencies -->
126-
<junit-jupiter.version>5.10.1</junit-jupiter.version>
127-
<assertj.version>3.25.1</assertj.version>
128-
<mockito.version>5.8.0</mockito.version>
132+
<junit-jupiter.version>5.10.2</junit-jupiter.version>
133+
<assertj.version>3.25.3</assertj.version>
134+
<mockito.version>5.10.0</mockito.version>
129135
<jersey.version>2.41</jersey.version>
130136
<testcontainers.version>1.19.3</testcontainers.version>
131137

@@ -501,6 +507,7 @@
501507
<excludes>
502508
<exclude>**/jetty-logging.properties</exclude>
503509
<exclude>**/log4j2.properties</exclude>
510+
<exclude>**/log4j.properties</exclude>
504511
<exclude>.editorconfig</exclude>
505512
<exclude>.gitattributes</exclude>
506513
<exclude>.gitignore</exclude>

‎spring-beans/pom.xml‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,11 @@
5454
<artifactId>brave-instrumentation-rpc</artifactId>
5555
<version>${project.version}</version>
5656
</dependency>
57+
<!-- Use latest spring dep to avoid CVE warnings in main -->
5758
<dependency>
5859
<groupId>org.springframework</groupId>
5960
<artifactId>spring-beans</artifactId>
60-
<version>2.5.6</version>
61+
<version>${spring5.version}</version>
6162
<scope>provided</scope>
6263
</dependency>
6364
<dependency>
@@ -68,6 +69,46 @@
6869
</dependency>
6970
</dependencies>
7071

72+
<build>
73+
<plugins>
74+
<!-- Test org.springframework:spring-beans dep via invoker -->
75+
<plugin>
76+
<artifactId>maven-invoker-plugin</artifactId>
77+
</plugin>
78+
<plugin>
79+
<groupId>de.qaware.maven</groupId>
80+
<artifactId>go-offline-maven-plugin</artifactId>
81+
<executions>
82+
<execution>
83+
<phase>package</phase>
84+
<goals>
85+
<goal>resolve-dependencies</goal>
86+
</goals>
87+
</execution>
88+
</executions>
89+
<configuration>
90+
<!-- Add dependencies specific to invoker tests so that they cache on go-offline -->
91+
<dynamicDependencies>
92+
<DynamicDependency>
93+
<groupId>log4j</groupId>
94+
<artifactId>log4j</artifactId>
95+
<version>${log4j12.version}</version>
96+
<repositoryType>MAIN</repositoryType>
97+
<type>jar</type>
98+
</DynamicDependency>
99+
<DynamicDependency>
100+
<groupId>org.springframework</groupId>
101+
<artifactId>spring-beans</artifactId>
102+
<version>${spring25.version}</version>
103+
<repositoryType>MAIN</repositoryType>
104+
<type>jar</type>
105+
</DynamicDependency>
106+
</dynamicDependencies>
107+
</configuration>
108+
</plugin>
109+
</plugins>
110+
</build>
111+
71112
<profiles>
72113
<profile>
73114
<id>release</id>

‎spring-beans/src/it/spring25/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# spring25
2+
This tests that the brave.spring.beans package does not rely on Spring 3+ APIs.

0 commit comments

Comments
 (0)