Bump org.springframework:spring-core from 4.3.30.RELEASE to 6.0.6 #11349
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [org.springframework:spring-core](https://github.com/spring-projects/spring-framework) from 4.3.30.RELEASE to 6.0.6. - [Release notes](https://github.com/spring-projects/spring-framework/releases) - [Commits](spring-projects/spring-framework@v4.3.30.RELEASE...v6.0.6) --- updated-dependencies: - dependency-name: org.springframework:spring-core dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
|
@chadlwilson , Is there any progress on the spring upgrade? I read your blog post GoCD project status in 2023 and since I have always been a fan thought I would see if I could address any of the "not-so-good" news regarding EOL packages. Just checking in. Setup my environment and have started looking at the situation and was wondering if anything has already been started down those paths. --Pete |
|
Hi @pshiner - thanks for saying hello! I could probably do a better job in summarising the path/epic for getting Spring upgraded separate to these dependabot PRs which get closed and opened on new point releases all the time (or at least what I know about it). I have addressed some other blockers to Spring upgrades such as #10577 and some general clean-ups to reduce surface area, however I haven't actually "tried" anything. The relationship with Spring Security and GoCD's custom security filters is also a potential area of challenge with Spring upgrade. I think that a core blocker that needs to be done first is up upgrade Hibernate to at least v5.x since our current ancient Hibernate version is not supported by even Spring 5, let alone Spring 6. However I haven't validated or dug into how much GoCD relies on Spring to support or mediate its Hibernate integration, so the assumption of a dependency here could be validated better. If it does turn out to be a blocker, my initial summary of the Hibernate upgrade is at #10262 but I wouldn't say I have "started" anything in this area, and nor do I have any historical background from the team on the blockers in this area, or whether it was attempted at some point. If you have experience with Hibernate (especially in non-JPA, more legacy |
|
Superseded by #11416. |
dependabot
bot
deleted the
dependabot/gradle/org.springframework-spring-core-6.0.6
branch
Bumps org.springframework:spring-core from 4.3.30.RELEASE to 6.0.6.
Release notes
Sourced from org.springframework:spring-core's releases.
... (truncated)
Commits
68537d6Release v6.0.657b838dUpgrade to spring-asciidoctor-backends 0.0.58c78408Update copyright datesc0a1e17Polishingfe29e73Revise documentation for@AspectJargument name resolution algorithm50c3a62Upgrade to Reactor Netty 2022.0.4a936a6aJavadoc-only reference to SubscribeMapping from simp package (-> package depe...8d112b8Test for explicit URI decoding in convertClassLoaderURLf8cb0faCustom resolution of preferred constructors for createBean(Class)c56c16dPolishing contributionDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)