Skip to content

Conversation

BillFarber
Copy link
Contributor

NOTE - This PR is an either/or with PR #225. I'll wait to see comments to decide which one to use.

Upgrades the project to use Spring 6 to address vulnerabilities in Spring 5.

This includes:

  • Updating sourceCompatibility and targetCompatibility to Java 17.
  • Excluding Spring dependencies from marklogic-junit5 to avoid conflicts.
  • Adding Spring 6 modules for testing.

@BillFarber BillFarber requested a review from rjrudin as a code owner October 3, 2025 14:50
@Copilot Copilot AI review requested due to automatic review settings October 3, 2025 14:50
Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Copy link

github-actions bot commented Oct 3, 2025

Copyright Validation Results
Total: 1 | Passed: 0 | Failed: 0 | Skipped: 1 | at: 2025-10-03 14:50:33 UTC | commit: a1901a9

⏭️ Skipped (Excluded) Files

  • build.gradle

✅ All files have valid copyright headers!

// Add back all required Spring 6 modules for tests, since junit5 and test code need more than just spring-test
testImplementation "org.springframework:spring-test:6.2.11"
testImplementation "org.springframework:spring-context:6.2.11"
testImplementation "org.springframework:spring-beans:6.2.11"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You don't need this, spring-context will bring it in.

sourceCompatibility = 1.8
targetCompatibility = 1.8
sourceCompatibility = JavaVersion.VERSION_17
targetCompatibility = JavaVersion.VERSION_17
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was going to say - just specify the toolchain - but Copilot notes that it's best to specify both the toolchain and the source target compatibility. So do this, and we'll eventually do this in all our repositories:

java {
    toolchain {
      languageVersion = JavaLanguageVersion.of(17)
    }
  }

sourceCompatibility = JavaVersion.VERSION_17
targetCompatibility = JavaVersion.VERSION_17

// Use the Java Client declared above.
exclude module: "marklogic-client-api"

// Use the Spring dependencies from ml-app-deployer 6 to avoid vulnerabilities in Spring 5.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I definitely prefer this because it's explicit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants