Skip to content

Improved: Bump minor versions of dependencies #1039

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jacopoc merged 1 commit into from
Apr 1, 2026
Merged

Improved: Bump minor versions of dependencies #1039

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
104 changes: 52 additions & 52 deletions dependencies.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,76 +18,76 @@
*/
dependencies {
implementation 'com.drewnoakes:metadata-extractor:2.19.0'
implementation 'com.github.ben-manes.caffeine:caffeine:3.1.8'
implementation 'com.google.guava:guava:33.3.1-jre'
implementation 'com.google.zxing:core:3.5.3'
implementation 'com.github.ben-manes.caffeine:caffeine:3.2.3'
implementation 'com.google.guava:guava:33.5.0-jre'
implementation 'com.google.zxing:core:3.5.4'
implementation 'com.googlecode.concurrentlinkedhashmap:concurrentlinkedhashmap-lru:1.4.2'
implementation 'com.googlecode.ez-vcard:ez-vcard:0.12.1'
implementation 'com.googlecode.ez-vcard:ez-vcard:0.12.2'
implementation 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20240325.1'
implementation 'com.googlecode.libphonenumber:libphonenumber:8.13.52'
implementation 'com.googlecode.libphonenumber:libphonenumber:8.13.55'
implementation 'com.ibm.icu:icu4j:76.1'
implementation 'com.github.librepdf:openpdf:1.3.43' // This is the last version with com.lowagie.text that is used (only) by PdfSurveyServices class.
implementation 'com.github.librepdf:openpdf:1.4.2' // This is the last version with com.lowagie.text that is used (only) by PdfSurveyServices class.
implementation 'com.sun.mail:javax.mail:1.6.2'
implementation 'com.rometools:rome:2.1.0'
implementation 'com.thoughtworks.xstream:xstream:1.4.21'
implementation 'commons-cli:commons-cli:1.5.0' // with 1.6.0, 2 tests of OfbizStartupUnitTests don't pass
implementation 'commons-net:commons-net:3.11.1'
implementation 'commons-validator:commons-validator:1.9.0'
implementation 'commons-cli:commons-cli:1.11.0'
implementation 'commons-net:commons-net:3.13.0'
implementation 'commons-validator:commons-validator:1.10.1'
implementation 'javax.transaction:javax.transaction-api:1.3'
implementation 'net.fortuna.ical4j:ical4j:1.0-rc4-atlassian-12'
implementation 'net.lingala.zip4j:zip4j:2.11.5'
implementation 'net.lingala.zip4j:zip4j:2.11.6'
implementation 'org.activiti:activiti-juel-jakarta:8.1.0'
implementation 'org.apache.ant:ant-junit:1.10.15'
implementation 'org.apache.commons:commons-collections4:4.4'
implementation 'org.apache.commons:commons-csv:1.12.0'
implementation 'org.apache.commons:commons-dbcp2:2.13.0'
implementation 'org.apache.commons:commons-collections4:4.5.0'
implementation 'org.apache.commons:commons-csv:1.14.1'
implementation 'org.apache.commons:commons-dbcp2:2.14.0'
implementation 'org.apache.commons:commons-fileupload2-jakarta:2.0.0-M1'
implementation 'org.apache.commons:commons-imaging:1.0-alpha3' // Alpha but OK, "Imaging was working and was used by a number of projects in production even before reaching its initial release as an Apache Commons component." Since 1.0.0-alpha4 (note the use of semver) the API has changed. Better wait an "official release" to rewrite OFBiz code...
implementation 'org.apache.commons:commons-text:1.12.0'
implementation 'org.apache.commons:commons-text:1.15.0'
implementation 'org.apache.geronimo.components:geronimo-transaction:3.1.5' // 4.0.0 does not compile
implementation 'org.apache.geronimo.specs:geronimo-jms_1.1_spec:1.1.1'
implementation 'org.apache.httpcomponents:httpclient-cache:4.5.14'
implementation 'org.apache.logging.log4j:log4j-api:2.24.2' // the API of log4j 2
implementation 'org.apache.logging.log4j:log4j-core:2.24.2' // Somehow needed by Buildbot to compile OFBizDynamicThresholdFilter.java
implementation 'org.apache.poi:poi:5.3.0'
implementation 'org.apache.pdfbox:pdfbox:3.0.5'
implementation 'org.apache.pdfbox:pdfbox-io:3.0.5'
implementation 'org.apache.logging.log4j:log4j-api:2.25.3' // the API of log4j 2
implementation 'org.apache.logging.log4j:log4j-core:2.25.3' // Somehow needed by Buildbot to compile OFBizDynamicThresholdFilter.java
implementation 'org.apache.poi:poi:5.5.1'
implementation 'org.apache.pdfbox:pdfbox:3.0.7'
implementation 'org.apache.pdfbox:pdfbox-io:3.0.7'
implementation 'org.apache.shiro:shiro-core:1.13.0' // Got "Exception in thread "main" java.lang.UnsupportedOperationException: Cannot create a hash with the given algorithm: argon2" with 2.0.2 in integration tests
implementation 'org.apache.shiro:shiro-crypto-cipher:2.0.2'
implementation 'org.apache.sshd:sshd-core:2.14.0'
implementation 'org.apache.sshd:sshd-sftp:2.14.0'
implementation 'org.apache.tika:tika-core:3.2.3'
implementation 'org.apache.tika:tika-parsers:3.2.3'
implementation 'org.apache.tika:tika-parser-pdf-module:3.2.3'
implementation 'org.apache.cxf:cxf-rt-frontend-jaxrs:4.1.3'
implementation 'org.apache.tomcat:tomcat-catalina-ha:10.1.52' // Remember to change the version number (10 now) in javadoc block if needed.
implementation 'org.apache.tomcat:tomcat-jasper:10.1.52'
implementation 'org.apache.shiro:shiro-crypto-cipher:2.1.0'
implementation 'org.apache.sshd:sshd-core:2.17.1'
implementation 'org.apache.sshd:sshd-sftp:2.17.1'
implementation 'org.apache.tika:tika-core:3.3.0'
implementation 'org.apache.tika:tika-parsers:3.3.0'
implementation 'org.apache.tika:tika-parser-pdf-module:3.3.0'
implementation 'org.apache.cxf:cxf-rt-frontend-jaxrs:4.2.0'
implementation 'org.apache.tomcat:tomcat-catalina-ha:10.1.53' // Remember to change the version number (10 now) in javadoc block if needed.
implementation 'org.apache.tomcat:tomcat-jasper:10.1.53'
implementation 'org.apache.axis2:axis2-kernel:1.8.2'
implementation 'org.apache.xmlgraphics:batik-anim:1.18'
implementation 'org.apache.xmlgraphics:batik-util:1.18'
implementation 'org.apache.xmlgraphics:batik-bridge:1.18'
implementation 'org.apache.xmlgraphics:fop:2.11' // NOTE: since 2.4 dependencies are messed up. See https://github.com/moqui/moqui-fop/blob/master/build.gradle
implementation 'org.clojure:clojure:1.12.0'
implementation 'org.apache.groovy:groovy-all:5.0.0-alpha-11'
implementation 'org.apache.xmlgraphics:batik-anim:1.19'
implementation 'org.apache.xmlgraphics:batik-util:1.19'
implementation 'org.apache.xmlgraphics:batik-bridge:1.19'
implementation 'org.apache.xmlgraphics:fop:2.11'
implementation 'org.clojure:clojure:1.12.4'
implementation 'org.apache.groovy:groovy-all:5.0.4'
implementation 'org.freemarker:freemarker:2.3.34' // Remember to change the version number in FreeMarkerWorker class when upgrading. See OFBIZ-10019 if >= 2.4
implementation 'org.owasp.esapi:esapi:2.6.0.0'
implementation 'org.springframework:spring-test:6.1.16'
implementation 'com.fasterxml.jackson.core:jackson-databind:2.18.2'
implementation 'org.owasp.esapi:esapi:2.7.0.0'
implementation 'org.springframework:spring-test:6.2.17'
implementation 'com.fasterxml.jackson.core:jackson-databind:2.21.2'
implementation 'oro:oro:2.0.8'
implementation 'wsdl4j:wsdl4j:1.6.3'
implementation 'com.auth0:java-jwt:4.4.0'
implementation 'com.auth0:jwks-rsa:0.22.2'
implementation 'com.auth0:java-jwt:4.5.1'
implementation 'com.auth0:jwks-rsa:0.23.0'
implementation 'org.jdom:jdom2:2.0.6.1'
implementation 'com.google.re2j:re2j:1.7'
implementation 'com.google.re2j:re2j:1.8'
implementation 'xerces:xercesImpl:2.12.2'
implementation('org.mustangproject:library:2.8.0') { // 2.10.0 did not work, cf. OFBIZ-12920 (https://github.com/apache/ofbiz-framework/pull/712#issuecomment-1968960963)
implementation('org.mustangproject:library:2.22.0') {
exclude group: 'pull-parser', module: 'pull-parser'
exclude group: 'xpp3', module: 'xpp3'
}

testImplementation 'org.hamcrest:hamcrest-library:2.2' // Enable junit4 to not depend on hamcrest-1.3
testImplementation 'org.mockito:mockito-core:5.14.2'
testImplementation 'org.jmockit:jmockit:1.49'
testImplementation 'org.mockito:mockito-core:5.23.0'
testImplementation 'org.jmockit:jmockit:1.50'
testImplementation 'com.pholser:junit-quickcheck-generators:1.0'

runtimeOnly 'javax.xml.soap:javax.xml.soap-api:1.4.0'
Expand All @@ -99,24 +99,24 @@ dependencies {
runtimeOnly 'org.apache.derby:derby:10.16.1.1' // 10.17.x.x requires Java 21
runtimeOnly 'org.apache.derby:derbytools:10.16.1.1' // 10.17.x.x requires Java 21
runtimeOnly 'org.apache.geronimo.specs:geronimo-jaxrpc_1.1_spec:2.1'
runtimeOnly 'org.apache.logging.log4j:log4j-1.2-api:2.24.2' // for external jars using the old log4j1.2: routes logging to log4j 2
runtimeOnly 'org.apache.logging.log4j:log4j-jul:2.24.2' // for external jars using the java.util.logging: routes logging to log4j 2
runtimeOnly 'org.apache.logging.log4j:log4j-slf4j-impl:2.24.2' // for external jars using slf4j: routes logging to log4j 2
runtimeOnly 'org.apache.logging.log4j:log4j-web:2.24.2' //???
runtimeOnly 'org.apache.logging.log4j:log4j-jcl:2.24.2' // need to constrain to version to avoid classpath conflict (ReflectionUtil)
runtimeOnly 'org.apache.logging.log4j:log4j-1.2-api:2.25.3' // for external jars using the old log4j1.2: routes logging to log4j 2
runtimeOnly 'org.apache.logging.log4j:log4j-jul:2.25.3' // for external jars using the java.util.logging: routes logging to log4j 2
runtimeOnly 'org.apache.logging.log4j:log4j-slf4j-impl:2.25.3' // for external jars using slf4j: routes logging to log4j 2
runtimeOnly 'org.apache.logging.log4j:log4j-web:2.25.3' //???
runtimeOnly 'org.apache.logging.log4j:log4j-jcl:2.25.3' // need to constrain to version to avoid classpath conflict (ReflectionUtil)

// specify last codenarc version for java 17 compliance
codenarc('org.codenarc:CodeNarc:3.6.0-groovy-4.0')
codenarc('org.codenarc:CodeNarc:3.7.0-groovy-4.0')

// use constraints to update transitive dependencies
constraints {
implementation('org.apache.james:apache-mime4j-core:0.8.10') {
implementation('org.apache.james:apache-mime4j-core:0.8.13') {
because 'CVE-2024-21742'
}
implementation('org.bouncycastle:bcprov-jdk18on:1.78') {
implementation('org.bouncycastle:bcprov-jdk18on:1.83') {
because 'CVE-2024-29857, CVE-2024-30171, CVE-2024-30172, CVE-2024-34447'
}
implementation('org.testng:testng:7.7.0') {
implementation('org.testng:testng:7.12.0') {
because 'CVE-2022-4065'
}
}
Expand Down
Binary file modified gradle/wrapper/gradle-wrapper.jar
View file
Open in desktop
Binary file not shown.
2 changes: 1 addition & 1 deletion gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.8-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.4-bin.zip
networkTimeout=10000
zipStoreBase=GRADLE_USER_HOME
zipStorePath=wrapper/dists
37 changes: 22 additions & 15 deletions gradlew
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

26 changes: 14 additions & 12 deletions gradlew.bat
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions settings.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@
*/

plugins {
id 'com.gradle.develocity' version '3.18.2'
id 'com.gradle.common-custom-user-data-gradle-plugin' version '2.0.2'
id 'com.gradle.develocity' version '3.19.2'
id 'com.gradle.common-custom-user-data-gradle-plugin' version '2.4.0'
}

def isCI = System.getenv('GITHUB_ACTIONS') != null
Expand Down
Loading