-
Notifications
You must be signed in to change notification settings - Fork 0
fix: Update to Jdk 25 #466
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: renovate/bellsoft-liberica-runtime-container-25.x
Are you sure you want to change the base?
Changes from all commits
ed4895a
e5883ee
420ee01
27e6762
96dc8c5
1806ace
3542708
7bf6e7e
58e244c
eca713d
790cdb3
c3aab6b
50095f5
7a15f24
9875214
373be78
3ecfdd3
4e60d29
0bd6b28
a5acf33
1d57787
697da06
c0558a5
b61e4ad
05cb963
d4031cc
7b42750
3b7049d
330e4e2
817f6b7
62bda84
13df06e
858fbb5
3e6b020
073755c
c792695
01743b5
ebfea61
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,3 @@ | ||
| # Enable auto-env through the sdkman_auto_env config | ||
| # Add key=value pairs of SDKs to use below | ||
| java=21.0.8-librca | ||
| java=25-librca |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,18 +5,26 @@ plugins { | |
|
|
||
| repositories { | ||
| gradlePluginPortal() | ||
| // TODO: remove when detekt stable is in gradle plugin portal | ||
| maven { | ||
| // https://central.sonatype.org/publish/publish-portal-snapshots/#consuming-via-gradle | ||
| url = uri("https://central.sonatype.com/repository/maven-snapshots/") | ||
| content { | ||
| includeModule("io.gitlab.arturbosch.detekt", "detekt-gradle-plugin") | ||
| } | ||
| } | ||
|
Comment on lines
+8
to
+15
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chainAddress snapshot repository non-determinism and add removal tracking. The Sonatype Maven snapshots repository introduces a reproducibility and supply-chain risk:
Since this PR upgrades to JDK 25, verify whether detekt is now stable in the Gradle plugin portal and can replace this workaround. If it remains necessary, update the TODO to reference a specific issue and define clear removal criteria (e.g., "Remove when detekt X.Y+ is available in gradle plugin portal"). 🌐 Web query: 💡 Result: Yes — detekt is published as stable releases on the Gradle Plugin Portal (not only snapshots). For example, the io.gitlab.arturbosch.detekt plugin shows stable versions (latest listed: 1.23.8). [1][2] Sources:
Remove unnecessary snapshot repository workaround. detekt is published as stable releases on the Gradle Plugin Portal (latest: 1.23.8), making the Sonatype Maven snapshots repository workaround unnecessary. This workaround introduces reproducibility and supply-chain risks through mutable snapshot artifacts. Remove lines 8-15 from 🤖 Prompt for AI Agents |
||
| } | ||
|
|
||
| dependencies { | ||
| implementation(libs.plugin.springBoot) | ||
| implementation(libs.plugin.spotless) | ||
| implementation(libs.plugin.detekt) | ||
| implementation(kotlin("allopen", "2.2.21")) | ||
| implementation(kotlin("gradle-plugin", "2.2.21")) | ||
| implementation(libs.kotlin.allopen) | ||
| implementation(libs.kotlin.gradle.plugin) | ||
| // required for kotlin plugin jpa | ||
| implementation(kotlin("reflect", "2.2.21")) | ||
| implementation(kotlin("stdlib-jdk8", "2.2.21")) | ||
| implementation(kotlin("noarg", "2.2.21")) | ||
| implementation(libs.kotlin.reflect) | ||
| implementation(libs.kotlin.stdlib.jdk8) | ||
| implementation(libs.kotlin.noarg) | ||
|
Comment on lines
+22
to
+27
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chainCRITICAL: Verify version catalog definitions for Kotlin dependencies. The code now references version catalog entries ( Verify that all five Kotlin library entries are properly defined in
🏁 Script executed: #!/bin/bash
# Description: Verify that gradle/libs.versions.toml exists and defines all required Kotlin libraries
# Check if gradle/libs.versions.toml exists
if [ ! -f gradle/libs.versions.toml ]; then
echo "ERROR: gradle/libs.versions.toml does not exist"
exit 1
fi
# Search for required Kotlin library definitions
echo "Checking for required Kotlin library definitions:"
rg -c 'kotlin\.(allopen|gradle-plugin|reflect|stdlib-jdk8|noarg)' gradle/libs.versions.tomlLength of output: 47 🏁 Script executed: #!/bin/bash
# Search for any version catalog files in the repository
echo "Looking for version catalog files (*.versions.toml or libs.versions.toml):"
fd -e "versions.toml" . 2>/dev/null || echo "No *.versions.toml files found"
# Also check for gradle directory structure
echo ""
echo "Gradle directory contents:"
ls -la gradle/ 2>/dev/null || echo "gradle/ directory not found"
# Check if gradle/libs.versions.toml is referenced anywhere else in build files
echo ""
echo "Searching for references to libs.versions.toml or version catalog:"
rg -i "libs\.versions|version.catalog" --type gradle --type kotlin 2>/dev/null | head -20 || echo "No references found"Length of output: 420 |
||
| } | ||
|
|
||
| gradlePlugin { | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| package hu.bsstudio.bssweb | ||
|
|
||
| import org.junit.jupiter.api.Test | ||
| import org.springframework.boot.test.context.SpringBootTest | ||
|
|
||
| @SpringBootTest | ||
| class BssWebApplicationTest { | ||
| @Test | ||
| fun contextLoads() { | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| bss: | ||
| file-api: | ||
| url: http://localhost:8888 | ||
| spring: | ||
| datasource: | ||
| url: jdbc:tc:postgresql:16.3-alpine3.18:///db?currentSchema=private | ||
| security: | ||
| oauth2: | ||
| resourceserver: | ||
| opaquetoken: | ||
| introspection-uri: http://localhost:8888 | ||
| client-id: client-id | ||
| client-secret: client-secret |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,5 @@ | ||
| rootProject.name = "bss-web-admin-backend" | ||
|
|
||
| include( | ||
| "client", | ||
| "integration", | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
Verify the Docker image hashes are correct.
The base images have been updated to JDK 25 with new SHA256 hashes. While Liberica Runtime Container (Liberica Lite with Alpaquita Linux) supports JDK 25 as an LTS version, the new hashes must be verified as authentic to prevent supply-chain risks.
Please confirm these hashes by running:
Also ensure that the application is tested and verified to work correctly with Java 25, as this is a major version upgrade from JDK 21.
Also applies to: 29-29
🏁 Script executed:
Length of output: 0
🏁 Script executed:
Length of output: 2344
Update the jdk-25-cds-musl image hash—current hash does not match Docker Hub.
The jre-25-cds-musl hash is correct, but the jdk-25-cds-musl hash is invalid:
450594440bb32b72f281e50626b629f1cc60caeb7796638bc570b9fab03e55ee3726c869b95563c00a642d52fc06afdc649ac3071cad160152846515597b6ab1Update line 1 to use the correct hash. This will prevent build failures and supply-chain risks.
🧰 Tools
🪛 Checkov (3.2.334)
[low] 1-40: Ensure that HEALTHCHECK instructions have been added to container images
(CKV_DOCKER_2)
🤖 Prompt for AI Agents