Skip to content

Commit 2badca4

Browse files
prasantakumar82prasantakumar82
authored
Merge pull request #3311 from aurbroszniowski/TDB-19854-upgrade-dependencies-main
TDB-19854 - Remove vulnerable dependencies
2 parents b6df7aa + d532bbc commit 2badca4

37 files changed

Lines changed: 315 additions & 199 deletions

File tree

‎build-logic/src/main/java/org/ehcache/build/conventions/CheckstyleConvention.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,28 @@ public void apply(Project project) {
1313
project.getPlugins().apply(CheckstylePlugin.class);
1414

1515
project.getExtensions().configure(CheckstyleExtension.class, checkstyle -> {
16+
checkstyle.setToolVersion("10.18.1");
1617
checkstyle.setConfigFile(project.getRootProject().file("config/checkstyle.xml"));
1718
Map<String, Object> properties = checkstyle.getConfigProperties();
1819
properties.put("projectDir", project.getProjectDir());
1920
properties.put("rootDir", project.getRootDir());
2021
});
22+
23+
project.getConfigurations().named("checkstyle", config -> {
24+
config.getResolutionStrategy().dependencySubstitution(subs -> {
25+
subs.substitute(subs.module("org.codehaus.plexus:plexus-utils:3.1.1"))
26+
.using(subs.module("org.codehaus.plexus:plexus-utils:3.3.0"))
27+
.because("Checkstyle 10.18.1 pulls mismatched plexus-utils versions");
28+
subs.substitute(subs.module("org.apache.commons:commons-lang3:3.7"))
29+
.using(subs.module("org.apache.commons:commons-lang3:3.8.1"))
30+
.because("Checkstyle transitives mix commons-lang3 versions");
31+
subs.substitute(subs.module("org.apache.httpcomponents:httpcore:4.4.13"))
32+
.using(subs.module("org.apache.httpcomponents:httpcore:4.4.14"))
33+
.because("Align httpcore to latest bugfix release");
34+
subs.substitute(subs.module("commons-codec:commons-codec:1.11"))
35+
.using(subs.module("commons-codec:commons-codec:1.15"))
36+
.because("Checkstyle transitive dependencies depend on different commons-codec versions");
37+
});
38+
});
2139
}
2240
}

‎build-logic/src/main/java/org/ehcache/build/conventions/JavaConvention.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ public void apply(Project project) {
2222

2323
dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "junit:junit:" + project.property("junitVersion"));
2424
dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.assertj:assertj-core:" + project.property("assertjVersion"));
25+
dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "net.bytebuddy:byte-buddy:" + project.property("byteBuddyVersion"));
26+
dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "net.bytebuddy:byte-buddy-agent:" + project.property("byteBuddyVersion"));
2527
dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.hamcrest:hamcrest:" + project.property("hamcrestVersion"));
2628
dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.mockito:mockito-core:" + project.property("mockitoVersion"));
2729
ModuleDependency md = (ModuleDependency)dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.terracotta:terracotta-utilities-test-tools:" + project.property("terracottaUtilitiesVersion"));
@@ -35,6 +37,14 @@ public void apply(Project project) {
3537
subs.substitute(subs.module("org.hamcrest:hamcrest-library:1.3")).with(subs.module("org.hamcrest:hamcrest-library:" + project.property("hamcrestVersion")));
3638
subs.substitute(subs.module("junit:junit:4.12")).using(subs.module("junit:junit:4.13.1"));
3739
});
40+
config.getResolutionStrategy().eachDependency(details -> {
41+
String group = details.getRequested().getGroup();
42+
String name = details.getRequested().getName();
43+
if ("net.bytebuddy".equals(group) && ("byte-buddy".equals(name) || "byte-buddy-agent".equals(name))) {
44+
details.useVersion(project.property("byteBuddyVersion").toString());
45+
details.because("Align Byte Buddy family versions across AssertJ and Mockito");
46+
}
47+
});
3848
});
3949
}
4050
}

‎build-logic/src/main/java/org/ehcache/build/conventions/SpotbugsConvention.java‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ public void apply(Project project) {
1717
SpotBugsExtension spotbugs = project.getExtensions().getByType(SpotBugsExtension.class);
1818

1919
spotbugs.getIgnoreFailures().set(false);
20-
// Later versions of Spotbugs have stupid heuristics for EI_EXPOSE_REP*
21-
spotbugs.getToolVersion().set("4.2.3");
20+
spotbugs.getToolVersion().set("4.9.8");
21+
spotbugs.getOmitVisitors().addAll("FindReturnRef", "ConstructorThrow");
2222

2323
project.getPlugins().withType(JavaBasePlugin.class).configureEach(plugin -> {
2424

@@ -46,6 +46,12 @@ public void apply(Project project) {
4646
subs.substitute(subs.module("org.apache.commons:commons-lang3:3.11"))
4747
.using(subs.module("org.apache.commons:commons-lang3:3.12.0"))
4848
.because("Spotbugs has dependency divergences");
49+
subs.substitute(subs.module("org.apache.commons:commons-lang3:3.18.0"))
50+
.using(subs.module("org.apache.commons:commons-lang3:3.19.0"))
51+
.because("Spotbugs 4.9.8 has dependency divergences");
52+
subs.substitute(subs.module("org.apache.logging.log4j:log4j-core:2.25.2"))
53+
.using(subs.module("org.apache.logging.log4j:log4j-core:2.25.3"))
54+
.because("Security vulnerability fix");
4955
});
5056
});
5157

‎clustered/ehcache-client/src/test/java/org/ehcache/clustered/client/internal/service/DefaultClusteringServiceDestroyTest.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@
5555
import static org.mockito.Mockito.when;
5656
import static org.mockito.Mockito.withSettings;
5757

58+
import org.mockito.quality.Strictness;
59+
5860
/**
5961
* DefaultClusteringServiceDestroyTest
6062
*/
@@ -194,7 +196,7 @@ public void testDestroyOnPartialDestroyState() throws Exception {
194196

195197
private void mockLockForWriteLockSuccess() throws org.terracotta.exception.EntityNotProvidedException, org.terracotta.exception.EntityNotFoundException, org.terracotta.exception.EntityVersionMismatchException {
196198
when(connection.<VoltronReadWriteLockClient, Object, Void>getEntityRef(same(VoltronReadWriteLockClient.class), eq(1L), any())).thenReturn(lockEntityRef);
197-
VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().lenient());
199+
VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().strictness(Strictness.LENIENT));
198200
when(lockEntityRef.fetchEntity(null)).thenReturn(lockClient);
199201

200202
when(lockClient.tryLock(LockMessaging.HoldType.WRITE)).thenReturn(true);
@@ -203,7 +205,7 @@ private void mockLockForWriteLockSuccess() throws org.terracotta.exception.Entit
203205

204206
private void mockLockForReadLockSuccess() throws org.terracotta.exception.EntityNotProvidedException, org.terracotta.exception.EntityNotFoundException, org.terracotta.exception.EntityVersionMismatchException {
205207
when(connection.<VoltronReadWriteLockClient, Object, Void>getEntityRef(same(VoltronReadWriteLockClient.class), eq(1L), any())).thenReturn(lockEntityRef);
206-
VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().lenient());
208+
VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().strictness(Strictness.LENIENT));
207209
when(lockEntityRef.fetchEntity(null)).thenReturn(lockClient);
208210

209211
when(lockClient.tryLock(LockMessaging.HoldType.READ)).thenReturn(true);

‎clustered/ehcache-common-api/src/main/java/org/ehcache/clustered/common/internal/store/ValueWrapper.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@
2525
/**
2626
* ValueWrapper
2727
*/
28-
@SuppressFBWarnings("EI_EXPOSE_REP")
2928
public class ValueWrapper implements Serializable {
3029

3130
private static final long serialVersionUID = -4794738044295644587L;

‎clustered/integration-test/build.gradle‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,15 @@ configurations.all {
9292
.because('CVE-2020-15250')
9393
.with(module('junit:junit:4.13.1'))
9494
}
95+
eachDependency { details ->
96+
if (details.requested.group == 'ch.qos.logback' &&
97+
(details.requested.name == 'logback-classic' || details.requested.name == 'logback-core')) {
98+
def enforcedLogbackVersion = project.property('logbackVersion').toString()
99+
if (!details.requested.version || details.requested.version < enforcedLogbackVersion) {
100+
details.useVersion enforcedLogbackVersion
101+
details.because 'Force logback >= ' + enforcedLogbackVersion
102+
}
103+
}
104+
}
95105
}
96106
}
97-

‎clustered/osgi-test/build.gradle‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,10 @@ configurations.all {
6565
substitute(module('org.ops4j.pax.url:pax-url-link:2.6.8'))
6666
.using(module('org.ops4j.pax.url:pax-url-link:2.6.11'))
6767
substitute(module('org.ops4j.pax.url:pax-url-aether:2.6.8'))
68-
// the 2 line has CVE-2025-48924 which is preventing build
69-
.using(module('org.ops4j.pax.url:pax-url-aether:3.0.1'))
68+
.using(module('org.ops4j.pax.url:pax-url-aether:3.0.2'))
69+
substitute(module('org.apache.commons:commons-lang3:3.12.0'))
70+
.using(module('org.apache.commons:commons-lang3:3.18.0'))
71+
.because('CVE-2025-48924')
7072
substitute(module('org.osgi:org.osgi.util.function:1.1.0'))
7173
.using(module('org.osgi:org.osgi.util.function:1.2.0'))
7274
.because('Dependency divergence in org.osgi:org.osgi.util.promise:1.2.0')

‎config/checkstyle.xml‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!DOCTYPE module PUBLIC
3-
"-//Puppy Crawl//DTD Check Configuration 1.3//EN"
4-
"http://www.puppycrawl.com/dtds/configuration_1_3.dtd">
3+
"-//Puppy Crawl//DTD Check Configuration 1.3//EN"
4+
"http://www.puppycrawl.com/dtds/configuration_1_3.dtd">
55
<module name="Checker">
66
<property name="charset" value="UTF-8"/>
77

@@ -22,14 +22,23 @@
2222
<module name="Header">
2323
<property name="headerFile" value="${rootDir}/config/java.header"/>
2424
<property name="fileExtensions" value="java"/>
25+
<!-- Allow Checkstyle to skip the IBM line so the regex check below can enforce it -->
26+
<property name="ignoreLines" value="3"/>
27+
</module>
28+
29+
<!-- Allow both 2025 and later IBM copyright lines -->
30+
<module name="RegexpSingleline">
31+
<property name="format" value="^ \\* Copyright IBM Corp\\. 2024, 202[5-9]$"/>
32+
<property name="message" value="IBM copyright line must use 2024, 2025 or later"/>
33+
<property name="fileExtensions" value="java"/>
2534
</module>
2635

2736
<module name="SuppressionFilter">
2837
<property name="file" value="${projectDir}/config/checkstyle-suppressions.xml"/>
2938
</module>
3039

3140
<module name="TreeWalker">
32-
<!-- Allow suppression tags in the code e.g. CSOFF: AvoidStaticImport -->
41+
<!-- Allow suppression tags in the code e.g. CSOFF: AvoidStaticImport -->
3342
<module name="SuppressionCommentFilter">
3443
<property name="offCommentFormat" value="CSOFF\: ([\w\|]+)"/>
3544
<property name="onCommentFormat" value="CSON\: ([\w\|]+)"/>

‎core-spi-test/src/main/java/org/ehcache/internal/store/SPIStoreTester.java‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@
1818
package org.ehcache.internal.store;
1919

2020
import org.ehcache.core.spi.store.Store;
21+
import org.ehcache.spi.resilience.StoreAccessException;
22+
import org.ehcache.spi.test.LegalSPITesterException;
2123
import org.ehcache.spi.test.SPITester;
2224

2325
/**
@@ -30,10 +32,39 @@
3032

3133
public class SPIStoreTester<K, V> extends SPITester {
3234

35+
protected static final String SPI_WARNING = "Warning, an exception is thrown due to the SPI test";
36+
3337
protected final StoreFactory<K,V> factory;
3438

3539
public SPIStoreTester(final StoreFactory<K,V> factory) {
3640
this.factory = factory;
3741
}
3842

43+
@FunctionalInterface
44+
protected interface StoreRunnable {
45+
void run() throws StoreAccessException;
46+
}
47+
48+
protected <T extends Throwable> T expectException(Class<T> expected, StoreRunnable action)
49+
throws LegalSPITesterException {
50+
try {
51+
action.run();
52+
} catch (Throwable throwable) {
53+
if (expected.isInstance(throwable)) {
54+
return expected.cast(throwable);
55+
}
56+
if (throwable instanceof StoreAccessException) {
57+
throw new LegalSPITesterException(SPI_WARNING, throwable);
58+
}
59+
if (throwable instanceof RuntimeException) {
60+
throw (RuntimeException) throwable;
61+
}
62+
if (throwable instanceof Error) {
63+
throw (Error) throwable;
64+
}
65+
throw new AssertionError("Unexpected checked exception", throwable);
66+
}
67+
throw new AssertionError("Expected " + expected.getSimpleName() + " to be thrown");
68+
}
69+
3970
}

‎core-spi-test/src/main/java/org/ehcache/internal/store/StoreContainsKeyTest.java‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -73,14 +73,7 @@ public void nullKeyThrowsException()
7373

7474
K key = null;
7575

76-
try {
77-
kvStore.containsKey(key);
78-
throw new AssertionError("Expected NullPointerException because the key is null");
79-
} catch (NullPointerException e) {
80-
// expected
81-
} catch (StoreAccessException e) {
82-
throw new LegalSPITesterException("Warning, an exception is thrown due to the SPI test");
83-
}
76+
expectException(NullPointerException.class, () -> kvStore.containsKey(key));
8477
}
8578

8679
@SPITest

0 commit comments

Comments
 (0)