alberto-art3ch commented on PR #6679: URL: https://github.com/apache/fineract/pull/6679#issuecomment-6228356659
> Thanks for the upgrade. The `JPAConfig` change matches the new `JpaBaseConfiguration#entityManagerFactoryBuilder(..., ListableBeanFactory)` signature in 4.1.1, and CI is green. > > One thing to fix before merging: with Boot 4.1.1, some explicit pins in `org.apache.fineract.dependencies.gradle` now resolve **below** the versions the Boot BOM manages. Explicit `dependency` entries override the BOM, so these pins now act as downgrades. I resolved the classpaths of all modules on this branch and compared them with `spring-boot-dependencies:4.1.1`. > > ### Please bump (pin is below Boot 4.1.1) > Dependency Pinned Boot 4.1.1 Note > `org.mariadb.jdbc:mariadb-java-client` 3.5.8 3.5.10 **Security:** 3.5.8 is affected by [CVE-2026-55856](https://github.com/advisories/GHSA-g9jj-cgmh-9f38), [CVE-2026-55857](https://github.com/advisories/GHSA-qxvw-fvwx-5cp7), [CVE-2026-55858](https://github.com/advisories/GHSA-xvr9-35cr-46v9) and [CVE-2026-61700](https://github.com/advisories/GHSA-wxmm-q36w-r9xj), all fixed in 3.5.9. This is the driver used by `bootRun`, `copyDatabaseDriverPlugins` and the tests. > `ch.qos.logback:logback-core` / `logback-classic` 1.5.35 1.5.38 The pin now holds Logback back, which contradicts the comment above the block ("to be able to be on more recent ones"). > `org.hibernate.validator:hibernate-validator` 9.1.0.Final 9.1.3.Final The pin matched Boot 4.1.0 and is now behind. > Please either bump these to the Boot versions or drop the pins and let the BOM manage them. A pin should only sit below the Boot BOM when there is a documented reason. > > ### Above Boot and security-driven: keep > * `tomcat.version` 11.0.26: Boot's 11.0.24 is affected by [GHSA-9xv2-5v5q-p794](https://github.com/advisories/GHSA-9xv2-5v5q-p794), [GHSA-gcx9-497g-6cp6](https://github.com/advisories/GHSA-gcx9-497g-6cp6) and [GHSA-h3x4-894j-xpx5](https://github.com/advisories/GHSA-h3x4-894j-xpx5). > * `jackson-2-bom.version` 2.22.3 and `jackson-bom.version` 3.1.7: Boot's 2.21.5 and 3.1.5 have open advisories in `jackson-core` and `jackson-databind`. > > The other pins above Boot (`gson` 2.14.0, `json-path` 3.0.0, `commons-codec` 1.22.0, `httpcore5`/`httpcore5-h2` 5.4.4) have no known advisory against Boot's version. They are Renovate bumps rather than security pins, so no action is needed here. > > ### Below Boot on purpose (documented): fine > `liquibase-core` 4.33.0 (licence, LEGAL-721), `jaxb-runtime` 2.3.6 (Swagger) and `jakarta.annotation-api` 1.3.5 in `fineract-client`. > > ### Optional cleanup to stay aligned with Boot > * These pins are now identical to Boot 4.1.1. Removing them would let them follow future Boot upgrades instead of falling behind, as Logback, Hibernate Validator and MariaDB just did: > > * janino, quartz, ehcache, postgresql, mysql-connector-j, commons-lang3, lombok, awaitility, cache-api and webjars-locator-core > * the jakarta annotation, activation, xml.bind, validation, jms and j2ee APIs > * `log4j2.version` and `httpclient5.version` > * the opentelemetry, kotlin, junit, mockito and jersey BOM imports > * `mavenBom 'com.fasterxml.jackson:jackson-bom:2.22.3'`, which duplicates `ext['jackson-2-bom.version']` > * `micrometer-bom:1.16.5` and `slf4j-bom:2.0.17` are imported _before_ the Boot BOM, so Boot's versions win and these imports have no effect: the build resolves Micrometer 1.17.1 and SLF4J 2.0.18. They are misleading, since `micrometer-core` 1.16.5 itself has open advisories, and could be removed. > * `jakarta.ws.rs-api` is pinned to 3.1.0, while Jersey 4.0.2 and Boot 4.1.1 use 4.0.0. It works, because Jersey accepts `[3.1,5)`, but it isn't aligned. > * This one predates the PR: `fineract-provider` hardcodes `org.testcontainers:postgresql:1.20.4` and `junit-jupiter:1.20.4`, while the Boot BOM pulls in `org.testcontainers:testcontainers` 2.0.5. As a result the test classpath mixes Testcontainers 1.20.4, 1.21.4 and 2.0.5. Moving consistently to Testcontainers 2.x is worth a separate ticket. > > Minor: the description says "only the Spring portfolio moves", but Boot 4.1.1 also moves other unpinned managed dependencies, for example Micrometer 1.17.0 → 1.17.1 and Spring Data 2026.0.1. @adamsaghy Thanks for the thorough review. - Bumped the pins left below the Boot 4.1.1 BOM to the Boot versions: `mariadb-java-client` 3.5.10, Logback 1.5.38 and Hibernate Validator 9.1.3.Final. I kept them as explicit pins rather than dropping them, to stay consistent with the policy described above that block. - Kept the security-driven pins above Boot (Tomcat 11.0.26, Jackson 2.22.3 / 3.1.7). - Corrected the description: Boot 4.1.1 also moves unpinned non-Spring dependencies such as Micrometer. I'd rather keep the optional cleanup out of this PR so it stays focused on the CVE fix. That covers removing the pins identical to Boot, dropping the no-op Micrometer/SLF4J BOM imports, aligning `jakarta.ws.rs-api`, and the Testcontainers 2.x move. Removing pins also changes how fast we can react to a CVE in those libraries (Renovate bumps vs. waiting for a Boot patch), so it seems worth a separate discussion. I'll open follow-up tickets and link them here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
