Repository navigation
chore: upgrade to Spring Boot 4.1.1 - #31
Merged
Merged
Conversation
Spring Boot 3.5 and Spring Framework 6.2 no longer get OSS releases, and GHSA-j9f9-w8pj-32f8 / GHSA-pc63-qcmh-9cmg are only fixed in Framework 7.0.9. - Spring Boot 4.1.1 (Framework 7.0.9, Security 7.1, Hibernate 7.4, Flyway 12, Jackson 3, Tomcat 11) - Override Tomcat 11.0.27 and Jackson 3.1.7, because the Boot-managed 11.0.24 / 3.1.5 have critical and high advisories - Use the Boot 4 starters, including spring-boot-starter-flyway; without it Boot 4 silently skips migrations. Add a regression test for this. - Exclude the unused AWS netty-nio-client and pin the Maven plugin versions - Migrate to the Jackson 3 exception API, the CSRF cookie customizer, the new RestTemplateBuilder package, @MockitoBean and the Boot 4 test modules
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the API off the end-of-life Spring Boot 3.5 line to Spring Boot 4.1.1. Its Spring Framework 7.0.9 fixes GHSA-j9f9-w8pj-32f8 and GHSA-pc63-qcmh-9cmg, which have no 6.2.x fix.
Supersedes #30. This PR includes all of #30's dependency fixes. It also clears the two
spring-webmvccriticals that keep #30's Trivy check failing. Close #30 once this merges.spring-boot-starter-flywayreplacesflyway-core. Without it, Boot 4 silently skips migrations. Adds a regression test.netty-nio-client. Pinsspring-boot-maven-plugin, which the Docker build was resolving to 4.2.0-M2.RestTemplateBuilderpackage. Tests now use@MockitoBeanand the Boot 4 test modules.mvn packagepasses locally: 126 tests. Not yet tested: Neon/Postgres (Hibernatevalidate, Flyway history), a real Google login, and the Docker image build.