chore: upgrade to Jetty 12.1 EE11, Spring 7, and Jackson 3

- Jetty 12.0.x EE10 → 12.1.0 EE11 across core, server, and dashboard
- Spring MVC 6.2.6 → 7.0.6 in jgit-proxy-dashboard
- Jackson 2.x (com.fasterxml.jackson) → 3.1.1 (tools.jackson) in core and dashboard
- Update SpringWebConfig to use HttpMessageConverters.ServerBuilder and JacksonJsonHttpMessageConverter
- Replace addXForwardedHeaders override with addProxyHeaders (Jetty 12.1 API change)

Author: coopernetes

jgit-proxy-core/build.gradle

@@ -62,9 +62,8 @@ dependencies {
 
 
     // Jackson for JSON — BOM pins all jackson-* modules to the same version
-    api platform("com.fasterxml.jackson:jackson-bom:2.18.6")
-    api "com.fasterxml.jackson.core:jackson-annotations"
-    implementation "com.fasterxml.jackson.core:jackson-databind"
+    api platform('tools.jackson:jackson-bom:3.1.1')
+    api "tools.jackson.core:jackson-databind"
 
     // Logging
     implementation "ch.qos.logback:logback-core:${logbackVersion}"

jgit-proxy-core/src/main/java/org/finos/gitproxy/git/GitleaksRunner.java

@@ -4,8 +4,6 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -24,6 +22,8 @@
 import lombok.Data;
 import lombok.extern.slf4j.Slf4j;
 import org.finos.gitproxy.config.CommitConfig;
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
 
 /**
  * Runs the gitleaks secret scanner against a unified diff and returns structured findings.
@@ -476,7 +476,7 @@ private static List<Finding> readFindings(Path reportFile) {
             if (json.isBlank() || json.trim().equals("null")) {
                 return Collections.emptyList();
             }
-            return OBJECT_MAPPER.readValue(json, new TypeReference<List<Finding>>() {});
+            return OBJECT_MAPPER.readValue(json, new TypeReference<>() {});
         } catch (Exception e) {
             log.warn("Failed to parse gitleaks JSON report: {}", e.getMessage());
             return Collections.emptyList();

jgit-proxy-core/src/main/java/org/finos/gitproxy/servlet/GitProxyServlet.java

@@ -43,8 +43,8 @@ protected void addViaHeader(HttpServletRequest clientRequest, Request proxyReque
     // TODO: Allow X-Forwarded-* headers to be sent if configured (enabled via opt-in)
     // TODO: Allow X-Forwarded-* headers to be customized
     @Override
-    protected void addXForwardedHeaders(HttpServletRequest clientRequest, Request proxyRequest) {
-        // no-op - don't send "X-Forwarded-*" headers to upstream
+    protected void addProxyHeaders(HttpServletRequest clientRequest, Request proxyRequest) {
+        // no-op - don't send proxy headers (X-Forwarded-*, Forwarded) to upstream
     }
 
     @Override

jgit-proxy-dashboard/build.gradle

@@ -51,9 +51,8 @@ dependencies {
     // Spring MVC for the REST API and dashboard
     implementation 'org.springframework:spring-webmvc:7.0.6'
 
-    // Jackson JSR310 module for Instant serialisation
-    implementation platform('com.fasterxml.jackson:jackson-bom:2.18.6')
-    implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310'
+    // Jackson JSON processing
+    implementation "tools.jackson.core:jackson-databind"
 
     // Database drivers at runtime (whichever store is configured)
     runtimeOnly 'com.h2database:h2:2.4.240'

jgit-proxy-dashboard/src/main/java/org/finos/gitproxy/dashboard/SpringWebConfig.java

@@ -1,37 +1,27 @@
 package org.finos.gitproxy.dashboard;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
-import com.fasterxml.jackson.databind.SerializationFeature;
-import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
-import java.util.List;
-import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.ComponentScan;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.http.converter.HttpMessageConverter;
-import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
-import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
+import org.springframework.http.converter.HttpMessageConverters;
+import org.springframework.http.converter.json.JacksonJsonHttpMessageConverter;
 import org.springframework.web.servlet.config.annotation.EnableWebMvc;
 import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+import tools.jackson.databind.json.JsonMapper;
 
 @Configuration
 @EnableWebMvc
 @ComponentScan("org.finos.gitproxy.dashboard.controller")
 public class SpringWebConfig implements WebMvcConfigurer {
 
     @Override
-    public void configureMessageConverters(List<HttpMessageConverter<?>> converters) {
-        converters.add(new MappingJackson2HttpMessageConverter(
-                jackson2ObjectMapperBuilder().build()));
-    }
-
-    @Bean
-    public Jackson2ObjectMapperBuilder jackson2ObjectMapperBuilder() {
-        return new Jackson2ObjectMapperBuilder()
-                .serializationInclusion(JsonInclude.Include.NON_NULL)
-                .featuresToDisable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
-                .modules(new JavaTimeModule());
+    public void configureMessageConverters(HttpMessageConverters.ServerBuilder builder) {
+        builder.withJsonConverter(new JacksonJsonHttpMessageConverter(JsonMapper.builder()
+                .changeDefaultPropertyInclusion(incl -> incl.withValueInclusion(JsonInclude.Include.NON_NULL))
+                .changeDefaultPropertyInclusion(incl -> incl.withContentInclusion(JsonInclude.Include.NON_NULL))
+                .build()));
     }
 
     @Override