chore: upgrade versions in pom files#173
Conversation
brettchaldecott
requested review from
DaveOrDead and
rairaman
as code owners
WalkthroughAll modules and examples update Maven versions from 2.1.0 to 2.2.0. The root parent POM and dependencyManagement entries are aligned. Some example modules add a parent relativePath. No code or plugin logic changes. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (8)
kinde-test-utils/pom.xml (1)
21-23: Add explicit Guice version to kinde-test-utils POM
Thecom.google.inject:guicedependency isn’t managed by any parent POM; pin its version to avoid relying on Maven’s default or transitive resolutions.
File: kinde-test-utils/pom.xml (lines 21–23)<dependency> <groupId>com.google.inject</groupId> <artifactId>guice</artifactId> + <version>7.0.0</version> </dependency>playground/kinde-accounts-example/pom.xml (1)
71-76: Fix misconfigured skipTests under maven-compiler-plugin.
skipTests is not a compiler plugin option; move/remove it to avoid confusion. Tests are already skipped in surefire below.<plugin> <groupId>org.apache.maven.plugins</groupId> <artifactId>maven-compiler-plugin</artifactId> <version>3.14.0</version> <configuration> <source>17</source> <target>17</target> - <skipTests>true</skipTests> </configuration> </plugin>kinde-management/pom.xml (1)
93-101: Scope JUnit Jupiter API to test and add the engine.
junit-jupiter-api is currently a compile dependency; also the engine is missing, so JUnit 5 tests may not run.Apply:
<dependency> <groupId>org.junit.jupiter</groupId> <artifactId>junit-jupiter-api</artifactId> - <version>5.13.4</version> + <version>5.13.4</version> + <scope>test</scope> </dependency> +<dependency> + <groupId>org.junit.jupiter</groupId> + <artifactId>junit-jupiter-engine</artifactId> + <version>5.13.4</version> + <scope>test</scope> +</dependency>kinde-core/pom.xml (1)
17-53: Remove duplicated dependencies to reduce noise and potential conflicts.
oauth2-oidc-sdk, nimbus-jose-jwt, and JUnit deps appear twice.Apply:
@@ - <dependency> - <groupId>com.nimbusds</groupId> - <artifactId>oauth2-oidc-sdk</artifactId> - </dependency> - <dependency> - <groupId>com.nimbusds</groupId> - <artifactId>nimbus-jose-jwt</artifactId> - </dependency> - <dependency> - <groupId>junit</groupId> - <artifactId>junit</artifactId> - <scope>test</scope> - </dependency> - <!-- JUnit 5 API and Engine --> - <dependency> - <groupId>org.junit.jupiter</groupId> - <artifactId>junit-jupiter-api</artifactId> - <scope>test</scope> - </dependency> - <dependency> - <groupId>org.junit.jupiter</groupId> - <artifactId>junit-jupiter-engine</artifactId> - <scope>test</scope> - </dependency> @@ - <!-- https://mvnrepository.com/artifact/com.nimbusds/oauth2-oidc-sdk --> - <dependency> - <groupId>com.nimbusds</groupId> - <artifactId>oauth2-oidc-sdk</artifactId> - </dependency> - <dependency> - <groupId>com.nimbusds</groupId> - <artifactId>nimbus-jose-jwt</artifactId> - </dependency> + <!-- keep single declarations for Nimbus and test deps above -->Also applies to: 54-74
kinde-springboot/kinde-springboot-core/pom.xml (3)
56-59: Duplicate spring-boot-starter-security dependencyDeclared twice, which is unnecessary and noisy.
<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> <version>3.5.5</version> </dependency> @@ - <dependency> - <groupId>org.springframework.boot</groupId> - <artifactId>spring-boot-starter-security</artifactId> - <version>3.5.5</version> - </dependency>Also applies to: 76-81
103-107: Duplicate mockito-core (test) entriesmockito-core appears twice with the same version.
<dependency> <groupId>org.mockito</groupId> <artifactId>mockito-core</artifactId> <scope>test</scope> <version>5.19.0</version> </dependency> @@ - <dependency> - <groupId>org.mockito</groupId> - <artifactId>mockito-core</artifactId> - <version>5.19.0</version> - <scope>test</scope> - </dependency>Also applies to: 145-150
117-134: JUnit 4 present without Vintage engineIf the project runs JUnit 5 (Jupiter), JUnit 4 tests won’t execute without junit-vintage-engine. Either drop JUnit 4 or add Vintage.
Option A (drop JUnit 4):
- <dependency> - <groupId>junit</groupId> - <artifactId>junit</artifactId> - <version>4.13.2</version> - <scope>test</scope> - </dependency>Option B (keep JUnit 4 tests runnable):
+ <dependency> + <groupId>org.junit.vintage</groupId> + <artifactId>junit-vintage-engine</artifactId> + <version>5.13.4</version> + <scope>test</scope> + </dependency>pom.xml (1)
238-252: Remove duplicate dependencies inkinde-springboot/kinde-springboot-core/pom.xml
- No lingering 2.1.0 versions detected.
spring-boot-starter-securityis declared twice (lines 55–59 & 77–81).mockito-coreis declared twice (lines 102–106 & 145–149).Remove the duplicate entries so each dependency appears only once.
🧹 Nitpick comments (19)
kinde-springboot/pom.xml (2)
23-27: Remove empty dependencyManagement block.
It’s noise and may confuse readers.Apply:
- <dependencyManagement> - <dependencies> - - </dependencies> - </dependencyManagement>
14-14: Use HTTPS for project URL.
Minor polish and avoids mixed-content flags in some tooling.- <url>http://maven.apache.org</url> + <url>https://maven.apache.org</url>playground/kinde-accounts-example/pom.xml (1)
79-85: Single source of truth for skipping tests.
You already set true in surefire; consider driving this via -DskipTests or <maven.test.skip> property for consistency across plugins.- <configuration> - <parallel>none</parallel> - <skipTests>true</skipTests> - </configuration> + <configuration> + <parallel>none</parallel> + </configuration>Then run with -DskipTests or define:
<properties> <maven.test.skip>true</maven.test.skip> </properties>kinde-report-aggregate/pom.xml (1)
24-24: Use the property for dependency versions to avoid repetition.
You already define ; reuse it in dependent entries.- <version>2.2.0</version> + <version>${kinde-version}</version>(Apply to kinde-core and kinde-management dependencies.)
Also applies to: 35-35, 45-45
playground/kinde-management-example/pom.xml (1)
76-79: Avoid masking failing tests.
testFailureIgnore=true hides failures; prefer keeping it false and using -DtestFailureIgnore on demand.- <testFailureIgnore>true</testFailureIgnore> + <testFailureIgnore>false</testFailureIgnore>If intentional for playgrounds, acknowledge and leave as-is; otherwise apply the diff.
kinde-j2ee/pom.xml (1)
13-44: Consider centralizing Guice/Guava versions via parent BOM.
You exclude Guava from Guice and add Guava separately without an explicit version here. Ensure the parent manages both to avoid drift across modules.playground/kinde-springboot-starter-example/pom.xml (1)
17-46: Use Spring Boot BOM to avoid pinning starter versions.
Import spring-boot-dependencies and drop explicit versions on starters to prevent dependency divergence.Apply:
<dependencies> <dependency> <groupId>com.kinde.spring</groupId> <artifactId>kinde-springboot-core</artifactId> - <version>2.2.0</version> + <version>2.2.0</version> </dependency> - <dependency> - <groupId>org.springframework.boot</groupId> - <artifactId>spring-boot-starter-data-rest</artifactId> - <version>3.5.5</version> - </dependency> + <dependency> + <groupId>org.springframework.boot</groupId> + <artifactId>spring-boot-starter-data-rest</artifactId> + </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> - <version>3.5.5</version> + </dependency> + <dependency> + <groupId>org.springframework.boot</groupId> + <artifactId>spring-boot-starter-actuator</artifactId> </dependency> - <dependency> - <groupId>org.springframework.boot</groupId> - <artifactId>spring-boot-starter-actuator</artifactId> - <version>3.5.5</version> - </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> - <version>3.5.5</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-thymeleaf</artifactId> - <version>3.5.5</version> </dependency> @@ <build> + <dependencyManagement> + <dependencies> + <dependency> + <groupId>org.springframework.boot</groupId> + <artifactId>spring-boot-dependencies</artifactId> + <version>3.5.5</version> + <type>pom</type> + <scope>import</scope> + </dependency> + </dependencies> + </dependencyManagement> <pluginManagement>Also applies to: 79-83, 87-97
kinde-management/pom.xml (1)
76-84: Confirm need for both jakarta.annotation and javax.annotation APIs.
Having both can cause confusion; prefer one unless you truly target both namespaces.Also applies to: 161-164
playground/kinde-core-example/pom.xml (1)
18-35: Optional: rely on parent-managed versions where available.
If the parent manages Nimbus versions, you can omit explicit versions here to simplify maintenance.playground/kinde-springboot-thymeleaf-full-example/pom.xml (2)
50-58: Avoid mixing MVC and WebFlux accidentallyBoth spring-boot-starter-web (MVC) and spring-webflux are present. Unless this example intentionally uses both stacks, remove one to prevent classpath/auto-config surprises.
Apply one of:
- <dependency> - <groupId>org.springframework</groupId> - <artifactId>spring-webflux</artifactId> - <version>6.2.10</version> - </dependency>or (if reactive is desired):
- <dependency> - <groupId>org.springframework.boot</groupId> - <artifactId>spring-boot-starter-web</artifactId> - <version>3.5.5</version> - </dependency> + <dependency> + <groupId>org.springframework.boot</groupId> + <artifactId>spring-boot-starter-webflux</artifactId> + <version>3.5.5</version> + </dependency>
28-48: Optional: manage Spring versions via a BOM to drop per-dependency versionsConsider importing spring-boot-dependencies in the parent and omit individual versions here for simpler upgrades.
Also applies to: 82-97
playground/kinde-j2ee-app/pom.xml (2)
66-69: Remove TODO-style comment in committed POMInline “Update this to the latest stable version” invites churn in source control. Track via issue, not POM comments.
- <version>3.4.0</version> <!-- Update this to the latest stable version --> + <version>3.4.0</version>
17-26: Version duplication with parent dependencyManagementoauth2-oidc-sdk and nimbus-jose-jwt versions appear also managed in the parent; you can omit local to inherit, reducing drift.
kinde-springboot/kinde-springboot-core/pom.xml (2)
152-155: Scope byte-buddy to tests (or remove)Mockito already brings Byte Buddy transitively; pin only if needed and restrict to test scope.
- <dependency> - <groupId>net.bytebuddy</groupId> - <artifactId>byte-buddy</artifactId> - <version>1.17.7</version> <!-- Replace with the latest version --> - </dependency> + <dependency> + <groupId>net.bytebuddy</groupId> + <artifactId>byte-buddy</artifactId> + <version>1.17.7</version> + <scope>test</scope> + </dependency>
29-41: Optional: manage Spring via BOMImport spring-boot-dependencies in parent to avoid repeating versions for Boot starters here.
pom.xml (1)
187-213: Let the Jackson BOM control versionsYou import jackson-bom but still hardcode versions for jackson-core/annotations/databind/datatypes. Drop the version tags to inherit from the BOM; also normalize annotations to 2.20.0.
- <dependency> + <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-core</artifactId> - <version>2.20.0</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-annotations</artifactId> - <version>2.20</version> + <!-- version from jackson-bom --> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> - <version>2.20.0</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.datatype</groupId> <artifactId>jackson-datatype-joda</artifactId> - <version>2.20.0</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.datatype</groupId> <artifactId>jackson-datatype-jsr310</artifactId> - <version>2.20.0</version> </dependency>kinde-springboot/kinde-springboot-starter/pom.xml (3)
27-35: Avoid pinning Spring Security versions in a starter; delegate to BOM or parent dependencyManagement.Pinning
spring-security-*versions in a starter can force conflicts for applications that already manage Spring versions (e.g., via Spring Boot BOM). Prefer:
- omit if a BOM/depMgmt supplies it, or
- centralize via a property to ease future bumps.
If you keep explicit versions, consider this property-based tweak:
<dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-web</artifactId> - <version>6.5.3</version> + <version>${spring-security.version}</version> </dependency> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-crypto</artifactId> - <version>6.5.3</version> + <version>${spring-security.version}</version> </dependency>Then add (if not already inherited):
<!-- in this POM or preferably the parent --> <properties> <spring-security.version>6.5.3</spring-security.version> </properties>Alternatively, import the Spring Boot BOM or manage these under the parent’s and drop the versions here.
14-14: Nit: Update to the project’s homepage or repository.Current value points to maven.apache.org; replace with your SDK’s site or GitHub repo for better metadata.
38-42: Optional: add enforcer (and optionally flatten) to keep dependency hygiene.Consider
maven-enforcer-plugin(e.g., RequireUpperBoundDeps, ban duplicates) in the parent, andflatten-maven-pluginfor clean published POMs. Low effort, long-term hygiene.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (16)
kinde-core/pom.xml(1 hunks)kinde-j2ee/pom.xml(1 hunks)kinde-management/pom.xml(2 hunks)kinde-report-aggregate/pom.xml(2 hunks)kinde-springboot/kinde-springboot-core/pom.xml(3 hunks)kinde-springboot/kinde-springboot-starter/pom.xml(1 hunks)kinde-springboot/pom.xml(1 hunks)kinde-test-utils/pom.xml(1 hunks)playground/kinde-accounts-example/pom.xml(1 hunks)playground/kinde-core-example/pom.xml(2 hunks)playground/kinde-j2ee-app/pom.xml(2 hunks)playground/kinde-management-example/pom.xml(2 hunks)playground/kinde-springboot-pkce-client-example/pom.xml(1 hunks)playground/kinde-springboot-starter-example/pom.xml(2 hunks)playground/kinde-springboot-thymeleaf-full-example/pom.xml(2 hunks)pom.xml(2 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**/*
⚙️ CodeRabbit configuration file
**/*: Please focus on:
- Code quality and best practices
- Security considerations
- Performance implications
- Test coverage and quality
- API design and consistency
- Error handling and edge cases
For Java code specifically:
- Check for proper exception handling
- Verify async method implementations
- Review builder pattern usage
- Validate test coverage
- Check for memory leaks in async operations
Ignore:
- Generated code files
- Build artifacts
- Configuration files
- Documentation formatting
Files:
playground/kinde-core-example/pom.xmlplayground/kinde-springboot-starter-example/pom.xmlplayground/kinde-management-example/pom.xmlkinde-test-utils/pom.xmlplayground/kinde-springboot-thymeleaf-full-example/pom.xmlkinde-core/pom.xmlkinde-j2ee/pom.xmlkinde-report-aggregate/pom.xmlkinde-springboot/kinde-springboot-core/pom.xmlkinde-management/pom.xmlplayground/kinde-springboot-pkce-client-example/pom.xmlkinde-springboot/kinde-springboot-starter/pom.xmlplayground/kinde-j2ee-app/pom.xmlplayground/kinde-accounts-example/pom.xmlkinde-springboot/pom.xmlpom.xml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
🔇 Additional comments (16)
kinde-springboot/pom.xml (1)
7-7: Version bumps to 2.2.0 look consistent.
Parent and module versions align with the PR objective.Also applies to: 11-11
kinde-test-utils/pom.xml (2)
9-9: Parent version bump LGTM.
Aligned with 2.2.0 across modules.
27-30: Confirm JUnit version is managed by parent POM
This module omits the junit:junit version—verify the parent POM’s dependencyManagement pins it (e.g., 4.13.2).playground/kinde-accounts-example/pom.xml (1)
9-11: Approve version bump and relativePath
Confirmed that../../pom.xmlexists fromplayground/kinde-accounts-example.kinde-report-aggregate/pom.xml (1)
20-20: All 2.2.0 bumps are consistent.
Parent, property, module, and dependencies align to 2.2.0.Also applies to: 24-24, 29-29, 35-35, 45-45
playground/kinde-management-example/pom.xml (1)
8-8: Version bumps LGTM.
Parent, module, and dependency versions updated consistently.Also applies to: 15-15, 38-38, 43-43
kinde-j2ee/pom.xml (1)
5-9: Version alignment to 2.2.0 looks good.
Parent update is consistent with the repo-wide bump.playground/kinde-springboot-starter-example/pom.xml (1)
4-14: Project and parent versions updated correctly.
No functional changes; aligns with 2.2.0 release.kinde-management/pom.xml (1)
5-24: Parent and module version bumps are consistent.
Matches the 2.2.0 rollout.kinde-core/pom.xml (1)
5-14: Core module and parent versions updated correctly.
Consistent with the repo-wide change.playground/kinde-core-example/pom.xml (1)
5-16: Example module versions updated to 2.2.0.
Looks consistent with the rest of the repo.Also applies to: 36-39
playground/kinde-springboot-pkce-client-example/pom.xml (1)
8-9: LGTM on parent linkage and version bumpThe parent 2.2.0 and added relativePath look correct; module version aligns.
Also applies to: 12-12
pom.xml (3)
167-185: LGTM on managed Kinde artifact versions at 2.2.0The managed coordinates are consistently bumped; aligns modules.
256-260: Ack: nexus-staging removalNoted and appropriate if Central Publishing is the path.
314-339: Reasonable JaCoCo configIncludes/excludes look sane for SDK modules.
kinde-springboot/kinde-springboot-starter/pom.xml (1)
7-7: Versions aligned to 2.2.0 — looks good.Parent and module versions are consistently bumped to 2.2.0.
Also applies to: 12-12
1 participant
Explain your changes
V2.2.0 branch merge to main
Checklist
🛟 If you need help, consider asking for advice over in the Kinde community.
Summary by CodeRabbit