Update Maven dependencies (major)#5603
Conversation
|
Renovate Jira issue ID: SONARJAVA-6355 |
Summary
This PR updates four major Maven dependencies across two pom files:
These are all major version bumps generated by Renovate. The changes are isolated to dependency declarations only—no code changes yet. What reviewers should knowWatch for breaking changes: All four updates are major version upgrades. JUnit 6 and Spring Framework 7 in particular introduce significant breaking changes and API modifications. Review the release notes for each dependency to understand compatibility impact. Critical verification:
Focus areas:
JUnit 6 modernization may require additional code changes beyond version bumps depending on what JUnit features are actively used in the codebase.
|
![sonar-review-alpha[bot]](https://avatars.githubusercontent.com/in/3025063?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR will break the java-jsp module due to a namespace incompatibility introduced by the Tomcat upgrade. The other three dependency bumps (spring-expression, junit-bom, javaee-web-api) look reasonable on the surface, but require verification as well.
| <dependency> | ||
| <groupId>org.apache.tomcat.embed</groupId> | ||
| <artifactId>tomcat-embed-jasper</artifactId> | ||
| <version>9.0.112</version> | ||
| <version>11.0.21</version> |
There was a problem hiding this comment.
Breaking change: Tomcat 10+ dropped javax.* in favour of jakarta.*.
The java-jsp module has two source files that use javax.servlet.jsp.* APIs that no longer exist in Tomcat 10+:
Jasper.java:39—import javax.servlet.jsp.JspFactory;Jasper.java:91—JspFactory.setDefaultFactory(new JspFactoryImpl())—JspFactoryImplin Tomcat 11 implementsjakarta.servlet.jsp.JspFactory, notjavax.servlet.jsp.JspFactory; the types are incompatibleJasperOptions.java:25—import javax.servlet.jsp.tagext.TagLibraryInfo;JasperOptions.java:212—getCache()overrides a method fromorg.apache.jasper.Optionsthat in Tomcat 11 returnsMap<String, jakarta.servlet.jsp.tagext.TagLibraryInfo>; returningjavax.*fails to satisfy the interface contract
Tomcat 11 ships no javax.servlet.jsp.* classes; they are all under jakarta.servlet.jsp.*. Both source files will fail to compile, and the entire JSP analysis feature will be non-functional.
All javax.servlet.jsp.* imports in Jasper.java and JasperOptions.java must be migrated to jakarta.servlet.jsp.* before this version bump can land.
| <dependency> | |
| <groupId>org.apache.tomcat.embed</groupId> | |
| <artifactId>tomcat-embed-jasper</artifactId> | |
| <version>9.0.112</version> | |
| <version>11.0.21</version> | |
| <dependency> | |
| <groupId>org.apache.tomcat.embed</groupId> | |
| <artifactId>tomcat-embed-jasper</artifactId> | |
| <version>9.0.112</version> | |
| <exclusions> | |
| <exclusion> | |
| <groupId>org.eclipse.jdt</groupId> |
- Mark as noise
This PR contains the following updates:
6.2.11→7.0.75.11.2→6.0.36.0→8.0.19.0.112→11.0.21Release Notes
spring-projects/spring-framework (org.springframework:spring-expression)
v7.0.7Compare Source
⭐ New Features
SpringValidatorAdapterandMethodValidationAdapterperformance #36621FluxinKotlinSerializationJsonDecoder#36597methodIdentification()inCacheAspectSupportfor removal #36575ApplicationListenerMethodAdapter#getTargetMethod()public #36558SpringExtensionvia Spring or JUnit properties #36460🐞 Bug Fixes
MergedAnnotationdoes not useClassLoaderfor method or field #36606@Sqlfails ifDataSourceis wrapped in aTransactionAwareDataSourceProxy#36611AnnotatedTypeMetadatano longer retains source declaration order on Java 24+ #36598MergedAnnotation.asMap()fails when an attribute references a non-existent class #36586FileSystemResourcedoes not strictly follow theResource#isReadable()contract #36584AbstractJsonHttpMessageConverter.writeInternal(Object, Type, Writer)#36565SseServerResponse#36537AnnotationBeanNameGeneratorfails when an annotation references a non-existent class #36524DefaultJmsListenerContainermay hang in an endless loop indoShutdown#36506CoroutineUtils#36449📔 Documentation
spring.profiles.activeis ignored by@ActiveProfiles#36600MergedAnnotation.asAnnotationAttributes()Javadoc incorrectly states that it creates an immutable map #36567TypeDescriptor.array()Javadoc #36549@MockitoBean, etc.) #36541🔨 Dependency Upgrades
❤️ Contributors
Thank you to all the contributors who worked on this release:
@Mohak-Nagaraju, @Sineaggi, @T45K, @angry-2k, @bebeis, @cookie-meringue, @dmitrysulman, @elgunshukurov, @itsmevichu, @junhyung8795, @msridhar, @nameearly, @tobifasc, and @xxxxxxjun
v7.0.6Compare Source
⭐ New Features
ResourceHandlerUtilsinScriptTemplateView#36458ScriptTemplateViewTests#36456ConfigurationClassBeanDefinitionReader#36453AbstractTestContextBootstrapper#36430resolveContextLoader()only once inAbstractTestContextBootstrapper#36425toString()with modern JDKs #36417setDefaultCharset()inAbstractResourceBasedMessageSource#36413Predicate<RequestPath>>in path API version resolver #36398🐞 Bug Fixes
ResponseEntity<Mono<T>>(or Kotlin suspend function) controller method #36357📔 Documentation
FullyQualifiedConfigurationBeanNameGeneratorin Javadoc and reference docs #36455@FallbackalongsidePrimaryin the reference manual and@BeanJavadoc #36439UriComponentsBuilderand polish examples #36403@Configurationclasses over XML and Groovy in testing chapter #36393BeanPostProcessorandBeanFactoryPostProcessor#34964🔨 Dependency Upgrades
❤️ Contributors
Thank you to all the contributors who worked on this release:
@AgilAghamirzayev, @aavoronin93, @cetf9h, @froggy0m0, @gbouwen, @husseinvr97, @jisub-dev, @ngocnhan-tran1996, @siom79, and @xxxxxxjun
v7.0.5Compare Source
⭐ New Features
AnnotatedMethodannotation cache in derived instances #36322MediaType(MediaType, Charset)constructor #36318@Autowiredas a meta-annotation #36315requiredattribute lookup for@Autowiredannotations #36314@ResponseBodypresence per controller class inRequestResponseBodyMethodProcessor#36311🐞 Bug Fixes
📔 Documentation
Optionalwith null-safe and Elvis operators are not compilable #36331ListenableFuturein documentation #36313❤️ Contributors
Thank you to all the contributors who worked on this release:
@Niravil and @TAKETODAY
v7.0.4Compare Source
⭐ New Features
MethodParameterandAnnotatedMethod#36307@Lazyas a meta-annotation at arbitrary depths #36306@Validatedas a meta-annotation at arbitrary depths #36305setPackagesToScanconfiguration method toLocalEntityManagerFactoryBean#36270beforeRetrycallback withRetryStateargument #36245ProxyFactoryinHttpServiceProxyFactoryused to create HTTP service proxies #36225DataBufferUtils.write()with NettyDataBuffer on JDK 25 hangs indefinitely #36184RestClient.ResponseSpec#requiredBody#36173DefaultMessageListenerContaineris not applied consistently in case of listener setup failure #36143🐞 Bug Fixes
LocalEntityManagerFactoryBean#setDataSourcework on Hibernate as well as EclipseLink #36271StompBrokerRelayMessageHandlerfails to restart due to test context pausing #36266System.exiton startup (against multiple shutdown hooks) #36260BeanRegistrarimplementingImportAware#36242@Retryableon annotated interfaces #36233Netty4HeadersAdapter.removereturns empty list instead ofnullfor non-existing key #36226@Nullable#36191EclipseLinkConnectionHandlecan fail against transaction isolation race condition #36165📔 Documentation
Redirecting to a resourcesection #36284@SpringExtensionConfigin the reference manual #36240LocalContainerEntityManagerFactoryBean#setPersistenceUnitNamejavadoc #36205@GetMapping("/base") is combined with method level@GetMapping("/") #36198DispatcherServletsnippets #36175getErrors()withgetBindingResult()in examples #36170🔨 Dependency Upgrades
❤️ Contributors
Thank you to all the contributors who worked on this release:
@Ivarz, @catturtle123, @chschu, @deejay1, @dingqianwen, @dungdm93, @furaizi, @izeye, @kchung1995, @kilink, @msridhar, @ngocnhan-tran1996, @pgoslatara, @philwebb, @pisek, and @shub-est
v7.0.3Compare Source
⭐ New Features
PagedListHolderandPropertyComparatorfor removal #36139PropertyDescriptorarray inSimpleBeanInfoFactory#36112@ConcurrencyLimitto throw rejection exception #36109DefaultApiVersionInserter#36097@RequestBody Objectmethod parameter should use class of actual value #36078@Nullableon parameter inequals()implementations #36075@Transactionaltriggered method rollbacks #36073MethodFailureEventfor use inEventPublicationInterceptor#36072/errorrequests also fail. #36058TaskCallbackreturn value as potentially nullable #36057execute(Retryable)which avoidsRetryExceptionin favor of rethrowing the last originalRuntimeException#36052@Retryabletriggered retry executions #35382🐞 Bug Fixes
SmartFactoryBeantype matching forResolvableType.NONE#36123AbstractMessageSendingTemplateignores headers inconvertAndSend()variant #36120JmsClient.sendAndReceive()fails if headers are included #36118PropertyDescriptorUtilsdoes not reliably resolve overloaded write methods #36113AbstractJacksonHttpMessageConverter#36111DefaultApiVersionInserterencodes already encoded URI #36080PropertyDescriptorUtilsdoes not reliably resolve read/write methods in type hierarchies with generics #36019📔 Documentation
Multipart Content#36094@EnableWebFluxfrom documentation code snippets #36091CORSandFunctional Endpointsreferences #36089Configurationpage #36079encodeJavadoc forUriComponentsandUriComponentsBuilder#36040@ExceptionHandlersilently ignored whenspring.mvc.problemdetails.enabled=truewithout@Order#35982🔨 Dependency Upgrades
❤️ Contributors
Thank you to all the contributors who worked on this release:
@JKaplanEmpty-Nes, @MukjepScarlet, @TerryTaoYY, @haydenrear, @jhan0121, @jher235, @marcphilipp, @mipo256, @msridhar, @ngocnhan-tran1996, @parkhojeong, @philipbolting, @playous, @quaff, @thelightway24, and @xyraclius
v7.0.2Compare Source
⭐ New Features
AbstractTestContextBootstrapper#35995AbstractTestContextBootstrappershould resolveContextLoaderonly once #35994RetryExceptionfor@Retryablemethods #35983Lifecyclebeans on cancelled refresh #35964@RetryableandRetryPolicy#35963==instead ofinstanceoffor primitive array type checks #35962MultiValueMapCollectorfor use with streams #35958@Nullable#35947RetryListeneras well as callbacks for the initial attempt #35940ApplicationContext#getId()nullability to non-null #35925TransactionSynchronizationManager#registerSynchronization#35921AbstractKotlinSerializationHttpMessageConverter#canWrite#35920Optionalinjection point as well #35919canRead/canWriteoverrides toClassones inAbstractSmartHttpMessageConverter#35916Assert#noNullElements#35868BindingReflectionHintsRegistrarwithObjectToObjectConverterhints #35847resetCaches()method to general CacheManager interface #35845BeanRegistrarin Spring AOT generated code #35803Providerinstance #35373🐞 Bug Fixes
ContextConfigurationAttributes(Class)constructor incorrectly setsinheritLocationstofalse#36000ConcurrentReferenceHashMap#computeIfAbsentmay cause context initialisation deadlock #35944@Lazyinjection point #35917RuntimeBeanReferenceusing name and type #35913@Bean-level qualifier annotation #35908SingletonSuppliershould be defensive againstsingletonInstance/initializedvisibility mismatch #35905AbstractJacksonHttpMessageConverter#35889ServerSentEventwith Jackson encoder #35872@EnableResilientMethodsdoes not participate in globally enforced target class proxying #35863📔 Documentation
SpringExtensionrequires JUnit Jupiter 6.0 or higher #35900sessionTransactedflag for local versus global transaction #35897Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.