CD-7811 upgrade tomcat-embed-core to 11.0.15

build.gradle

@@ -12,7 +12,7 @@ plugins {
   // dont update com.jfrog.artifactory, new version contains a bug
   id 'com.jfrog.artifactory' version '5.2.5'
   id "de.undercouch.download" version "5.6.0" apply false
-  id 'io.spring.dependency-management' version '1.1.6'
+  id 'io.spring.dependency-management' version '1.1.7'
   id "org.cyclonedx.bom" version "1.10.0" apply false
   id 'org.sonarqube' version '5.1.0.4882'
 }
@@ -220,7 +220,7 @@ subprojects {
 
   ext {
     protobufVersion = '4.28.2'
-    springVersion = '5.3.39'
+    springVersion = '6.2.12'
     elasticSearchClientVersion = '7.17.24'
   }
 
@@ -305,12 +305,12 @@ subprojects {
       dependency 'com.sonarsource.architecture:sonar-architecture-java-frontend-plugin:1.4.0.2329'
 
       // please keep this list alphabetically ordered
-      dependencySet(group: 'ch.qos.logback', version: '1.3.15') {
+      dependencySet(group: 'ch.qos.logback', version: '1.5.23') {
         entry 'logback-classic'
         entry 'logback-core'
       }
-      // TODO switch to dependency 'ch.qos.logback.access:tomcat:2.0.1' when upgrading to Tomcat 10+
-      dependency 'ch.qos.logback:logback-access:1.3.15'
+      dependency('ch.qos.logback.access:common:2.0.3')
+      dependency('ch.qos.logback.access:logback-access-tomcat:2.0.6')
       dependency('commons-beanutils:commons-beanutils:1.11.0') {
         exclude 'commons-logging:commons-logging'
       }
@@ -378,11 +378,11 @@ subprojects {
       }
       dependency 'com.auth0:java-jwt:4.4.0'
       dependency 'io.netty:netty-all:4.2.6.Final'
-      dependency 'com.sun.mail:jakarta.mail:1.6.7'
-      dependency 'javax.annotation:javax.annotation-api:1.3.2'
-      dependency 'javax.inject:javax.inject:1'
-      dependency 'javax.xml.bind:jaxb-api:2.3.1'
-      dependency 'jakarta.servlet:jakarta.servlet-api:4.0.4'
+      dependency 'jakarta.mail:jakarta.mail-api:2.1.5'
+      dependency 'jakarta.annotation:jakarta.annotation-api:3.0.0'
+      dependency 'jakarta.inject:jakarta.inject-api:2.0.1'
+      dependency 'jakarta.xml.bind:jakarta.xml.bind-api:2.3.3'
+      dependency 'jakarta.servlet:jakarta.servlet-api:6.1.0'
       dependency 'junit:junit:4.13.2'
       dependency 'org.xmlunit:xmlunit-core:2.10.0'
       dependency 'org.xmlunit:xmlunit-matchers:2.10.0'
@@ -393,7 +393,7 @@ subprojects {
       dependency 'org.apache.commons:commons-collections4:4.4'
       dependency 'org.apache.commons:commons-csv:1.12.0'
       dependency 'org.apache.commons:commons-lang3:3.18.0'
-      dependency 'org.apache.commons:commons-email:1.6.0'
+      dependency 'org.apache.commons:commons-email2-jakarta:2.0.0-M1'
       dependency 'org.apache.commons:commons-text:1.12.0'
       dependency 'org.apache.mina:mina-core:2.2.3'
       dependency 'org.apache.kerby:kerb-simplekdc:2.1.0'
@@ -410,7 +410,7 @@ subprojects {
         entry 'log4j-api'
         entry 'log4j-to-slf4j'
       }
-      dependencySet(group: 'org.apache.tomcat.embed', version: '9.0.90') {
+      dependencySet(group: 'org.apache.tomcat.embed', version: '11.0.15') {
         entry 'tomcat-embed-core'
         entry('tomcat-embed-jasper') {
           exclude 'org.eclipse.jdt.core.compiler:ecj'
@@ -491,12 +491,12 @@ subprojects {
       dependency("org.springframework:spring-webmvc:${springVersion}") {
         exclude 'commons-logging:commons-logging'
       }
-      dependency 'org.springdoc:springdoc-openapi-webmvc-core:1.8.0'
+      dependency 'org.springdoc:springdoc-openapi-starter-webmvc-api:2.8.13'
       dependency 'org.subethamail:subethasmtp:3.1.7'
       dependency 'org.yaml:snakeyaml:2.3'
-      dependency 'org.hibernate.validator:hibernate-validator:6.2.5.Final'
-      dependency 'jakarta.el:jakarta.el-api:3.0.3'
-      dependency 'org.glassfish:jakarta.el:3.0.4'
+      dependency 'org.hibernate.validator:hibernate-validator:9.0.1.Final'
+      dependency 'jakarta.el:jakarta.el-api:5.0.1'
+      dependency 'org.glassfish.expressly:expressly:5.0.0'
       dependency 'org.kohsuke:github-api:1.326'
       dependency 'org.wiremock:wiremock-standalone:3.9.1'
       dependency 'org.skyscreamer:jsonassert:1.5.3'

codescan-application/build.gradle

@@ -130,7 +130,7 @@ zip {
     //tolerance will allow for some growth in the archive size.
     def expectedSize = 300_000_000
     //We set a tolerance of 15MB to avoid failing the build for small differences in the archive size.
-    def tolerance = 30_000_000
+    def tolerance = 50_000_000
     def minArchiveSize = expectedSize - tolerance
     def maxArchiveSize = expectedSize + tolerance
 

gradle.properties

@@ -5,7 +5,7 @@ version=24.12
 # 30 months from the release date for LTA versions
 # No change required for patch versions
 versionEOL=2025-05-27
-pluginApiVersion=10.14-CODESCAN
+pluginApiVersion=10.15-CODESCAN
 description=Open source platform for continuous inspection of code quality
 projectTitle=SonarQube
 org.gradle.jvmargs=-Xmx2048m

server/sonar-alm-client/src/main/java/org/sonar/alm/client/bitbucket/bitbucketcloud/BitbucketCloudRestClient.java

@@ -27,7 +27,7 @@
 import java.util.function.Function;
 import java.util.function.UnaryOperator;
 import javax.annotation.Nullable;
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 import okhttp3.Credentials;
 import okhttp3.FormBody;
 import okhttp3.HttpUrl;

server/sonar-auth-bitbucket/src/test/java/org/sonar/auth/bitbucket/IntegrationTest.java

@@ -23,8 +23,8 @@
 import java.util.Arrays;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.stream.Collectors;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import okhttp3.mockwebserver.MockResponse;
 import okhttp3.mockwebserver.MockWebServer;
 import okhttp3.mockwebserver.RecordedRequest;
@@ -39,7 +39,7 @@
 import org.sonar.api.server.http.HttpRequest;
 import org.sonar.api.server.http.HttpResponse;
 import org.sonar.api.utils.System2;
-import org.sonar.server.http.JavaxHttpRequest;
+import org.sonar.server.http.JakartaHttpRequest;
 
 import static java.lang.String.format;
 import static java.net.URLEncoder.encode;
@@ -258,7 +258,7 @@ public String getCallbackUrl() {
 
     @Override
     public HttpRequest getHttpRequest() {
-      return new JavaxHttpRequest(request);
+      return new JakartaHttpRequest(request);
     }
 
     @Override

server/sonar-auth-github/src/test/java/org/sonar/auth/github/IntegrationTest.java

@@ -25,8 +25,8 @@
 import java.util.List;
 import java.util.TreeSet;
 import java.util.concurrent.atomic.AtomicBoolean;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import okhttp3.mockwebserver.MockResponse;
 import okhttp3.mockwebserver.MockWebServer;
 import okhttp3.mockwebserver.RecordedRequest;
@@ -44,7 +44,7 @@
 import org.sonar.auth.github.client.GithubApplicationClient;
 import org.sonar.auth.github.scribe.ScribeServiceBuilder;
 import org.sonar.db.DbTester;
-import org.sonar.server.http.JavaxHttpRequest;
+import org.sonar.server.http.JakartaHttpRequest;
 import org.sonar.server.property.InternalProperties;
 import org.sonar.server.property.InternalPropertiesImpl;
 
@@ -452,7 +452,7 @@ public String getCallbackUrl() {
 
     @Override
     public HttpRequest getHttpRequest() {
-      return new JavaxHttpRequest(request);
+      return new JakartaHttpRequest(request);
     }
 
     @Override

server/sonar-auth-gitlab/src/main/java/org/sonar/auth/gitlab/GitLabIdentityProvider.java

@@ -30,7 +30,7 @@
 import java.util.Set;
 import java.util.concurrent.ExecutionException;
 import java.util.stream.Stream;
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 import org.sonar.api.server.authentication.Display;
 import org.sonar.api.server.authentication.OAuth2IdentityProvider;
 import org.sonar.api.server.authentication.UnauthorizedException;

server/sonar-auth-saml/build.gradle

@@ -17,6 +17,8 @@ dependencies {
     compileOnlyApi project(':server:sonar-webserver-api')
     compileOnlyApi project(':sonar-core')
 
+    implementation 'javax.servlet:javax.servlet-api:4.0.1'
+
     testImplementation 'com.tngtech.java:junit-dataprovider'
     testImplementation 'junit:junit'
     testImplementation 'org.assertj:assertj-core'

server/sonar-auth-saml/src/it/java/org/sonar/auth/saml/SamlIdentityProviderIT.java

@@ -26,8 +26,8 @@
 import java.util.HashMap;
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicBoolean;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import org.apache.commons.io.IOUtils;
 import org.junit.Before;
 import org.junit.Rule;
@@ -43,8 +43,8 @@
 import org.sonar.api.testfixtures.log.LogTester;
 import org.sonar.api.utils.System2;
 import org.sonar.db.DbTester;
-import org.sonar.server.http.JavaxHttpRequest;
-import org.sonar.server.http.JavaxHttpResponse;
+import org.sonar.server.http.JakartaHttpRequest;
+import org.sonar.server.http.JakartaHttpResponse;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
@@ -372,12 +372,12 @@ public String getCallbackUrl() {
 
     @Override
     public HttpRequest getHttpRequest() {
-      return new JavaxHttpRequest(mock(HttpServletRequest.class));
+      return new JakartaHttpRequest(mock(HttpServletRequest.class));
     }
 
     @Override
     public HttpResponse getHttpResponse() {
-      return new JavaxHttpResponse(response);
+      return new JakartaHttpResponse(response);
     }
 
     @Override
@@ -406,7 +406,7 @@ public DumbCallbackContext(HttpServletRequest request, HttpServletResponse respo
       this.expectedCallbackUrl = expectedCallbackUrl;
       Map<String, String[]> parameterMap = new HashMap<>();
       parameterMap.put("SAMLResponse", new String[]{loadResponse(encodedResponseFile)});
-      when(((JavaxHttpRequest) getHttpRequest()).getDelegate().getParameterMap()).thenReturn(parameterMap);
+      when(((JakartaHttpRequest) getHttpRequest()).getDelegate().getParameterMap()).thenReturn(parameterMap);
     }
 
 
@@ -446,12 +446,12 @@ public String getCallbackUrl() {
 
     @Override
     public HttpRequest getHttpRequest() {
-      return new JavaxHttpRequest(request);
+      return new JakartaHttpRequest(request);
     }
 
     @Override
     public HttpResponse getHttpResponse() {
-      return new JavaxHttpResponse(response);
+      return new JakartaHttpResponse(response);
     }
 
     @Override