Skip to content

Upgrade spring boot to 4.1 gradle to 9 SCG to newest#175

Merged
Padi-owasp merged 9 commits into
mainfrom
upgrade/spring-boot-4.1-gradle-9
Jul 20, 2026
Merged

Upgrade spring boot to 4.1 gradle to 9 SCG to newest#175
Padi-owasp merged 9 commits into
mainfrom
upgrade/spring-boot-4.1-gradle-9

Conversation

@Padi-owasp

Copy link
Copy Markdown
Member

No description provided.

Padi-owasp and others added 9 commits July 18, 2026 08:33
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pin distributionSha256Sum for supply-chain hardening. Full build on
Gradle 9.6.1 required no source changes; all tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps the Spring Boot Gradle plugin from 4.0.1 to 4.1.0 and the Spring
Cloud release train from 2025.1.0 to 2025.1.2 (Oakwood), the train that
introduces Spring Boot 4.1.0 compatibility.

The Spring Cloud bump transitively pulls in
spring-cloud-gateway-server-webflux 5.0.2 (previously 5.0.0), whose
RewriteFunction interface now explicitly declares its generic
apply(ServerWebExchange, T) method alongside a default erasure-bridge
apply(Object, Object). That makes the raw RewriteFunction parameter of
Config's single-arg setRewriteFunction(RewriteFunction) overload
unusable as a lambda target (javac can no longer derive a single
functional descriptor for the raw type). Fixed by using the existing
typed setRewriteFunction(Class<T>, Class<R>, RewriteFunction<T, R>)
overload with explicit String.class witnesses in
ReadRequestBodyFilter, giving the lambda a properly parameterized
target type; the private rewrite() helper was re-typed accordingly,
dropping two now-unnecessary casts.

./gradlew clean build: BUILD SUCCESSFUL, 108/108 tests pass across 43
test classes (full @SpringBootTest integration suite: routing, CSRF,
session, OIDC login, security). dependencyInsight confirms spring-boot
resolves to 4.1.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump guava, snakeyaml, oauth2-oidc-sdk, nimbus-jose-jwt, commons-codec,
caffeine, wiremock-spring-boot, and the publish-on-central plugin to
their latest stable versions, discovered via the Gradle Versions
Plugin (added and removed temporarily). rerunner-jupiter,
commons-lang3, and ST4 were already current. BOM-managed coordinates
(jspecify, jackson-dataformat-yaml, junit-jupiter) are left untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ion plan

Update the Tech-Stack line in CLAUDE.md to Gradle 9, and mark all
checklist items in the iteration plan as done with a filled-in Outcome
section recording final resolved versions, dependency bumps, the
ReadRequestBodyFilter source fix, and the Docker verification deferred
to CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Docker is unavailable in the dev environment; the docker build and
container smoke test are deferred to CI. Aligns the checkbox state with
the Outcome section.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…sts)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Docker is now available; ran the two previously-deferred Task 4 checks.
Image builds end-to-end on gradle:9.6.1-jdk17 and the container boots
cleanly on amazoncorretto:17, serving HTTP 200 on port 8080.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@Padi-owasp
Padi-owasp merged commit 28ef7d7 into main Jul 20, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant