Skip to content

Mockito should be a test dependency#1851

Merged
evnm merged 1 commit intodropwizard:masterfrom
umcodemonkey:mockito-test-dep
Dec 9, 2016
Merged

Mockito should be a test dependency#1851
evnm merged 1 commit intodropwizard:masterfrom
umcodemonkey:mockito-test-dep

Conversation

@umcodemonkey
Copy link
Copy Markdown
Contributor

@umcodemonkey umcodemonkey commented Dec 9, 2016

Mockito is being exposed as a compile dependency to dependents of dropwizard, which may force them to upgrade to Mockito 2 before they are ready.

@coveralls
Copy link
Copy Markdown

coveralls commented Dec 9, 2016

Coverage Status

Coverage remained the same at 81.721% when pulling 34679de on umcodemonkey:mockito-test-dep into 61b16fd on dropwizard:master.

@evnm evnm added this to the 1.0.6 milestone Dec 9, 2016
@evnm
Copy link
Copy Markdown
Member

evnm commented Dec 9, 2016

Thanks for taking care of this. This change is fine, but I question how much of a problem the issue in reality.

Neither dropwizard-testing nor dropwizard-example should be imported within an application's compile scope. Dropwizard's root pom and dropwizard-bom/pom.xml both put Mockito in the test scope, so applications depending on dropwizard-core shouldn't be affected.

@evnm evnm merged commit 7d9df2f into dropwizard:master Dec 9, 2016
@joschi
Copy link
Copy Markdown
Member

joschi commented Dec 10, 2016

@umcodemonkey @evnm I vote for reverting this change.

In a correct Dropwizard project, dropwizard-testing will only be imported in test scope and so will Mockito.

With the applied change of this PR, you now will always have to explicitly add a dependency to Mockito in all projects using dropwizard-test, which was pulled in automatically before.

@joschi
Copy link
Copy Markdown
Member

joschi commented Dec 10, 2016

After checking the actual code, this PR seems correct. Sorry for the noise. 😉

@umcodemonkey
Copy link
Copy Markdown
Contributor Author

umcodemonkey commented Dec 12, 2016

To clarify for anyone coming later (thanks @joschi for validating), prior to this change, if you import the dropwizard-bom, and depend on both dropwizard-testing and mockito in test scope, the dependency management in the bom would force your dependency of mocktio to Mockito 2. IMO, the bom should not be managing this dependency, as the point of the bom is to manage dependencies of end users, not for internal usage. Also, dropwizard-test does not need to have a compile dependency on mockito, as it's only used for it's internal tests, and is not required to use any of the classes from dropwizard-test.

@joschi is correct that after this change users will no longer get a transitive dependency on mockito, but since it a best practice with Maven to explicitly depend on artifacts that you use, this is a net positive to impacted users in any case.

@nickbabcock nickbabcock mentioned this pull request Feb 13, 2017
Closed
ckalista added a commit to alphagov/pay-publicapi that referenced this pull request Feb 13, 2018
@ckalista
PP-3312 Upgrade dropwizard to 1.2.x for PublicAPI
15c0792 
* Upgraded Dropwizard from 1.0.6 to version 1.2.2:
	* Since version 1.1.0, Dropwizard dropped dependency to `org.mockito`intentional.
	  The Mockito dependency was only accidentally Maven's "compile" scope and has since
	  moved into the correct "test" scope. See dropwizard/dropwizard#1851
	  for more details. Dropwizard itself has no dependency on Mockito anymore except for its
	  internal tests, a dependency to the latest stable version 2.15.0 had therefore been added to the
	  project explicitly.  Same goes for Guava which was explicitly added at version 24.0-jre.

* Removed explicit dependency of jersey version 2.25.1 which is not anymore needed since
   Dropwizard 1.2.2 which is already ships at that version. Note: jersey 2.25.1 is reported to have a
   medium vulnerability “XML Entity Expansion (XEE)” which has not yet been addressed in
   any subsequent version.

* Pinned Jackson to version 2.9.4 which has a fix to address a vulnerability detected in version
   2.9.1 which would otherwise be pulled by Dropwizard 1.2.2.

* Hibernate Validator version 5.4.1.Final pulled down with Dropwizard 1.2.2 is reported to
  have a “Privilege Escalation” vulnerability issue. Upgrading to 6.0.7.Final as recommended
  breaks the build due to api incompatibilities. The security issue has to do with Java
  Security manager which is not been used therefore we are safe to leave it as it is.
ckalista added a commit to alphagov/pay-publicapi that referenced this pull request Feb 13, 2018
@ckalista
PP-3312 Upgrade dropwizard to 1.2.x for PublicAPI
36554bd 
* Upgraded Dropwizard from 1.0.6 to version 1.2.2:
	* Since version 1.1.0, Dropwizard dropped dependency to `org.mockito`intentional.
	  The Mockito dependency was only accidentally Maven's "compile" scope and has since
	  moved into the correct "test" scope. See dropwizard/dropwizard#1851
	  for more details. Dropwizard itself has no dependency on Mockito anymore except for its
	  internal tests, a dependency to the latest stable version 2.15.0 had therefore been added to the
	  project explicitly.  Same goes for Guava which was explicitly added at version 24.0-jre.

* Removed explicit dependency of jersey version 2.25.1 which is not anymore needed since
   Dropwizard 1.2.2 which is already ships at that version. Note: jersey 2.25.1 is reported to have a
   medium vulnerability “XML Entity Expansion (XEE)” which has not yet been addressed in
   any subsequent version.

* Pinned Jackson to version 2.9.4 which has a fix to address a vulnerability detected in version
   2.9.1 which would otherwise be pulled by Dropwizard 1.2.2.

* Hibernate Validator version 5.4.1.Final pulled down with Dropwizard 1.2.2 is reported to
  have a “Privilege Escalation” vulnerability issue. Upgrading to 6.0.7.Final as recommended
  breaks the build due to api incompatibilities. The security issue has to do with Java
  Security manager which is not been used therefore we are safe to leave it as it is.
@ckalista ckalista mentioned this pull request Feb 13, 2018
Merged
ckalista added a commit to alphagov/pay-publicapi that referenced this pull request Feb 13, 2018
@ckalista
PP-3312 Upgrade dropwizard to 1.2.x for PublicAPI
55fb37f 
* Upgraded Dropwizard from 1.0.6 to version 1.2.2:
	* Since version 1.1.0, Dropwizard dropped dependency to `org.mockito`intentional.
	  The Mockito dependency was only accidentally Maven's "compile" scope and has since
	  moved into the correct "test" scope. See dropwizard/dropwizard#1851
	  for more details. Dropwizard itself has no dependency on Mockito anymore except for its
	  internal tests, a dependency to the latest stable version 2.15.0 had therefore been added to the
	  project explicitly.  Same goes for Guava which was explicitly added at version 24.0-jre.

* Removed explicit dependency of jersey version 2.25.1 which is not anymore needed since
   Dropwizard 1.2.2 which is already ships at that version. Note: jersey 2.25.1 is reported to have a
   medium vulnerability “XML Entity Expansion (XEE)” which has not yet been addressed in
   any subsequent version.

* Pinned Jackson to version 2.9.4 which has a fix to address a vulnerability detected in version
   2.9.1 which would otherwise be pulled by Dropwizard 1.2.2.

* Hibernate Validator version 5.4.1.Final pulled down with Dropwizard 1.2.2 is reported to
  have a “Privilege Escalation” vulnerability issue. Upgrading to 6.0.7.Final as recommended
  breaks the build due to api incompatibilities. The security issue has to do with Java
  Security manager which is not been used therefore we are safe to leave it as it is.
@ckalista ckalista mentioned this pull request Feb 15, 2018
Merged
ckalista added a commit to alphagov/pay-publicauth that referenced this pull request Feb 15, 2018
@ckalista
PP-3350 Upgrade dropwizard to 1.2.x for Public Auth
5fae4fd 
* Upgraded Dropwizard to version 1.2.2:
	* Since version 1.1.0, Dropwizard dropped dependency to `org.mockito`intentional.
	  The Mockito dependency was only accidentally Maven's "compile" scope and has
	  since moved into the correct "test" scope.
	  See dropwizard/dropwizard#1851 for details.
	  Since Dropwizard itself has no dependency on Mockito except for its internal tests,
	  a dependency to the latest stable version 2.15.0 had to be added to the project explicitly.

* Removed explicit dependency of jersey version 2.25.1 which is not anymore needed since
   Dropwizard 1.2.2 already ships with that version. Note: jersey 2.25.1 is reported to have a
   medium vulnerability “XML Entity Expansion (XEE)” which has not yet been addressed in
   any subsequent version.

* Pinned Jackson to version 2.9.4 which has a fix to address a vulnerability detected in
   version 2.9.1 which would otherwise be pulled by Dropwizard 1.2.2.

* Note: Hibernate Validator version 5.4.1.Final pulled down with Dropwizard 1.2.2 is reported
   to have a “Privilege Escalation” vulnerability issue. Upgrading to 6.0.7.Final as recommended
   breaks the build due to api incompatibilities. The security issue has to do with Java Security
   manager which is not been used therefore we are safe to leave it as it is.
@ckalista ckalista mentioned this pull request Feb 15, 2018
Merged
ckalista added a commit to alphagov/pay-connector that referenced this pull request Feb 20, 2018
@ckalista
PP-3347 Upgrade dropwizard to 1.2.x
e9ff21c 
* Upgraded Dropwizard to latest version 1.2.2:
	* Since version 1.1.0, Dropwizard dropped dependency to `org.mockito`intentional.
	  The Mockito dependency was only accidentally Maven's "compile" scope and has
	  since moved into the correct "test" scope.
	  See dropwizard/dropwizard#1851 for details. Since Dropwizard
	  itself has no dependency on Mockito anymore, a dependency had to be added to the project explicitly.

* Removed explicit dependency of jersey version 2.25.1 which is not anymore needed since
   Dropwizard 1.2.2 already ships with that version. Note: jersey 2.25.1 is reported to have a
   medium vulnerability “XML Entity Expansion (XEE)” which has not yet been addressed in any
   subsequent version.

* Pinned Jackson to version 2.9.4 which has a fix to address a vulnerability detected in version
   2.9.1 which would otherwise be pulled by Dropwizard 1.2.2.

* Upgraded jetty-util to latest version 9.4.8.v20171121 which addresses VULNERABILITY
   ARTIFACT SID-4247 (Timing Attack)

* NOTE: Hibernate Validator version 5.4.1.Final pulled down with Dropwizard 1.2.2 is reported to have
   a “Privilege Escalation” vulnerability issue. Upgrading to 6.0.7.Final as recommended breaks
   the build due to api incompatibilities. The security issue has to do with Java Security manager
   which is not been used therefore we are safe to leave it as it is.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

1.0.6

Development

Successfully merging this pull request may close these issues.

4 participants

@umcodemonkey @coveralls @evnm @joschi