Chore: upgrade to spring boot 4 (#1925)

* upgrade to spring boot 4

* fix import for jackson 3

* replace explicit spring-retry with builint spring boot features

* remove unnecessary workaround

* fix tests

* more fixes

* revert to keep RestTemplateBuilder

* fix deprecation

* fix tests

* fix tests

* fix integration test

* migrate from jakarta to jspecify annotations

* convert to jackson 3, jspecify

* add unit test for AuthTokenConverter

* replace ObjectMapper with JsonMapper

* fix import

* replace with jspecify

* bump es version

* silence missing thymeleaf template location

* update .devfile

* fix checks

---------

Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org>

Author: netomi

.devfile.yaml

@@ -17,7 +17,7 @@ components:
           path: /home/user/.local/
   - name: elasticsearch
     container:
-      image: docker.elastic.co/elasticsearch/elasticsearch:8.18.8
+      image: docker.elastic.co/elasticsearch/elasticsearch:9.2.8
       memoryRequest: 256Mi
       memoryLimit: 2Gi
       cpuRequest: 100m

.gitpod.dockerfile

@@ -10,7 +10,7 @@ USER gitpod
 RUN bash -c ". /home/gitpod/.sdkman/bin/sdkman-init.sh \
     && sdk install java 25-tem"
 
-RUN curl https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.7.1-linux-x86_64.tar.gz --output elasticsearch-linux-x86_64.tar.gz \
+RUN curl https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-9.2.8-linux-x86_64.tar.gz --output elasticsearch-linux-x86_64.tar.gz \
     && tar -xzf elasticsearch-linux-x86_64.tar.gz \
     && rm elasticsearch-linux-x86_64.tar.gz
-ENV ES_HOME="$HOME/elasticsearch-8.7.1"
+ENV ES_HOME="$HOME/elasticsearch-9.2.8"

deploy/kubernetes/elasticsearch.yaml

@@ -30,7 +30,7 @@ spec:
             privileged: true
       containers:
         - name: elasticsearch
-          image: docker.elastic.co/elasticsearch/elasticsearch:8.18.8
+          image: docker.elastic.co/elasticsearch/elasticsearch:9.2.8
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

deploy/openshift/README.md

@@ -51,7 +51,7 @@ You can find the deployment YAML configuration in the `openvsx-deployment.yml` f
 * `ROUTE_NAME`: The name of the route to access the OpenVSX server (default: internal)
 * `NAMESPACE`: The namespace where OpenVSX will be deployed (default: openvsx)
 * `POSTGRESQL_IMAGE`: The PostgreSQL image to use for the database (default: image-registry.openshift-image-registry.svc:5000/openshift/postgresql:15-el8)
-* `OPENVSX_ELASTICSEARCH_IMAGE`: The image for Elasticsearch (default: docker.elastic.co/elasticsearch/elasticsearch:8.7.1).
+* `OPENVSX_ELASTICSEARCH_IMAGE`: The image for Elasticsearch (default: docker.elastic.co/elasticsearch/elasticsearch:9.2.8).
 * `OPENVSX_SERVER_IMAGE`: The image for the OpenVSX Server.
 * `OPENVSX_CLI_IMAGE`: The image for the OpenVSX CLI.
 * `OVSX_PAT_BASE64`: Base64 encoded OVSX personal access token.

deploy/openshift/openvsx-deployment.yml

@@ -375,7 +375,7 @@ parameters:
   displayName: OpenVSX CLI image
   description: OpenVSX CLI image to use for the deployment of the OpenVSX CLI
 - name: OPENVSX_ELASTICSEARCH_IMAGE
-  value: docker.elastic.co/elasticsearch/elasticsearch:8.7.1
+  value: docker.elastic.co/elasticsearch/elasticsearch:9.2.8
   displayName: OpenVSX Elasticsearch image
   description: OpenVSX Elasticsearch image to use for the deployment of the OpenVSX Elasticsearch
 - name: OVSX_PAT_BASE64

docker-compose.yml

@@ -16,7 +16,7 @@ services:
       - debug
 
   elasticsearch:
-    image: elasticsearch:8.18.8
+    image: elasticsearch:9.2.8
     environment:
       - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
       - xpack.security.enabled=false

server/build.gradle

@@ -15,16 +15,15 @@ plugins {
 
 def jooqSrcDir = 'src/main/jooq-gen'
 
-ext['junit-jupiter.version'] = libs.versions.junit.get()
+//ext['junit-jupiter.version'] = libs.versions.junit.get()
 
 // override spring boot managed versions
 // see https://docs.spring.io/spring-boot/gradle-plugin/managing-dependencies.html
 // example:
 // ext['netty.version'] = '4.1.132.Final'
 
-ext['postgresql.version'] = '42.7.11'
-ext['netty.version'] = '4.1.135.Final'
 ext['opentelemetry.version'] = '1.63.0'
+ext['flyway.version'] = libs.versions.flyway
 
 java {
     sourceCompatibility = libs.versions.java.get()
@@ -49,33 +48,18 @@ configurations {
     devImplementation.extendsFrom implementation
     devRuntimeOnly.extendsFrom runtimeOnly
 
-    // exclude commons-logging to avoid runtime warnings like these
-    // Standard Commons Logging discovery in action with spring-jcl:
-    //    please remove commons-logging.jar from classpath in order to avoid potential conflicts
-    configureEach {
-        exclude group: "commons-logging", module: "commons-logging"
-    }
-
-    // Gatling 3.15 requires Netty 4.2.x but Spring Boot's dependency management forces 4.1.x.
-    // Override all io.netty modules (except tcnative which has its own versioning) on the
-    // gatling configuration to keep its classpath internally consistent.
-    matching { it.name.startsWith('gatling') }.configureEach {
-        resolutionStrategy.eachDependency { details ->
-            if (details.requested.group == 'io.netty' && !details.requested.name.startsWith('netty-tcnative')) {
-                details.useVersion '4.2.13.Final'
-            }
-        }
-    }
+    testImplementation.exclude group: 'com.vaadin.external.google', module: 'android-json'
 }
 
 dependencies {
-    implementation "org.springframework.boot:spring-boot-starter-web"
+    implementation "org.springframework.boot:spring-boot-starter-webmvc"
     implementation "org.springframework.boot:spring-boot-starter-jetty"
     modules {
         module("org.springframework.boot:spring-boot-starter-tomcat") {
             replacedBy("org.springframework.boot:spring-boot-starter-jetty")
         }
     }
+    implementation "org.springframework.boot:spring-boot-starter-restclient"
     implementation "org.springframework.boot:spring-boot-starter-validation"
     implementation "org.springframework.boot:spring-boot-starter-jooq"
     implementation "org.springframework.boot:spring-boot-starter-data-jpa"
@@ -84,13 +68,16 @@ dependencies {
     implementation "org.springframework.boot:spring-boot-starter-security"
     implementation "org.springframework.boot:spring-boot-starter-actuator"
     implementation "org.springframework.boot:spring-boot-starter-cache"
-    implementation "org.springframework.boot:spring-boot-starter-aop"
     implementation "org.springframework.boot:spring-boot-starter-mail"
-    implementation "org.springframework.boot:spring-boot-starter-thymeleaf"
+    implementation "org.springframework.boot:spring-boot-starter-zipkin"
+    implementation "org.springframework.boot:spring-boot-security-oauth2-client"
+
     implementation "org.springframework.security:spring-security-oauth2-client"
     implementation "org.springframework.security:spring-security-oauth2-jose"
+
     implementation "org.springframework.session:spring-session-jdbc"
-    implementation "org.springframework.retry:spring-retry"
+
+    implementation "org.springframework.boot:spring-boot-thymeleaf"
 
     implementation "org.apache.httpcomponents.client5:httpclient5"
     implementation "com.github.ben-manes.caffeine:caffeine"
@@ -110,6 +97,7 @@ dependencies {
 
     implementation libs.jobrunr.spring
 
+    implementation "org.springframework.boot:spring-boot-flyway"
     implementation libs.flyway.core
     implementation libs.flyway.database.postgresql
 
@@ -120,12 +108,8 @@ dependencies {
 
     implementation libs.springdoc
 
-    implementation libs.jackson.core
-    implementation libs.jackson.annotations
-    implementation libs.jackson.databind
-    implementation libs.jackson.jaxb.annotations
-    implementation libs.jackson.dataformat.xml
     implementation libs.jackson.dataformat.yaml
+    implementation libs.jackson.dataformat.xml
     implementation libs.jackson.dataformat.toml
 
     implementation libs.woodstox.core
@@ -142,19 +126,22 @@ dependencies {
     runtimeOnly "org.postgresql:postgresql"
     jooqCodegen "org.postgresql:postgresql"
 
+    // to aid migration from 3.5 to 4.0
+    runtimeOnly "org.springframework.boot:spring-boot-properties-migrator"
+
     devRuntimeOnly "org.springframework.boot:spring-boot-devtools"
 
     testImplementation("org.springframework.boot:spring-boot-starter-test") {
         exclude group: 'org.junit.vintage', module: 'junit-vintage-engine'
     }
+    testImplementation "org.springframework.boot:spring-boot-starter-webmvc-test"
     testImplementation "org.springframework.security:spring-security-test"
-    testImplementation libs.junit.jupiter.api
+
+    testImplementation "org.springframework.boot:spring-boot-testcontainers"
     testImplementation libs.testcontainers.elasticsearch
     testImplementation libs.testcontainers.localstack
     testImplementation libs.testcontainers.junit.jupiter
-
-    testRuntimeOnly libs.junit.jupiter.engine
-    testRuntimeOnly libs.testcontainers.postgresql
+    testImplementation libs.testcontainers.postgresql
 
     gatling libs.gatling.core
     gatling libs.gatling.app
@@ -202,7 +189,7 @@ jooq {
 }
 
 rewrite {
-    activeRecipe("org.openrewrite.java.migrate.jakarta.JavaxAnnotationMigrationToJakartaAnnotation")
+    activeRecipe("org.openrewrite.java.jspecify.MigrateFromJakartaAnnotationApi")
     setExportDatatables(true)
 }
 

server/gradle/libs.versions.toml

@@ -8,35 +8,31 @@ commons-lang3   = "3.20.0"
 flyway          = "11.20.3"
 gatling         = "3.15.0"
 gcloud          = "2.62.1"
-hibernate       = "6.6.42.Final"
 ipaddress       = "5.5.1"
-jackson         = "2.18.8"
 java            = "25"
 jaxb-api        = "2.3.1"
 jaxb-impl       = "2.3.8"
 jedis           = "7.4.1"
-jobrunr         = "7.5.3"
+jobrunr         = "8.6.1"
 jooq            = "3.19.34"
 jsonpath        = "2.9.0"
-junit           = "5.14.2"
 loki4j          = "1.4.2"
 re2j            = "1.7"
-rewrite-java    = "3.26.0"
-spring-boot     = "3.5.14"
+rewrite-java    = "3.38.0"
+spring-boot     = "4.0.7"
 springdoc       = "2.8.13"
-testcontainers  = "1.21.4"
 tika            = "3.3.1"
 woodstox        = "6.4.0"
 
 [plugins]
 download                     = { id = "de.undercouch.download", version = "5.7.0" }
 gatling                      = { id = "io.gatling.gradle", version.ref = "gatling" }
-hibernate-orm                = { id = "org.hibernate.orm", version.ref = "hibernate" }
+hibernate-orm                = { id = "org.hibernate.orm" }
 jooq-codegen                 = { id = "org.jooq.jooq-codegen-gradle", version.ref = "jooq" }
 spring-boot                  = { id = "org.springframework.boot", version.ref = "spring-boot"}
 spring-dependency-management = { id = "io.spring.dependency-management", version = "1.1.7" }
 test-logger                  = { id = "com.adarshr.test-logger", version = "4.0.0" }
-rewrite                      = { id = "org.openrewrite.rewrite", version = "7.25.0" }
+rewrite                      = { id = "org.openrewrite.rewrite", version = "7.35.0" }
 
 [libraries]
 awssdk-s3                    = { module = "software.amazon.awssdk:s3", version.ref = "aws" }
@@ -51,28 +47,22 @@ flyway-database-postgresql   = { module = "org.flywaydb:flyway-database-postgres
 gatling-app                  = { module = "io.gatling:gatling-app", version.ref = "gatling" }
 gatling-core                 = { module = "io.gatling:gatling-core", version.ref = "gatling" }
 google-cloud-storage         = { module = "com.google.cloud:google-cloud-storage", version.ref = "gcloud" }
-ipaddress                    = { module = "com.github.seancfoley:ipaddress", version.ref = "ipaddress"}
-jackson-annotations          = { module = "com.fasterxml.jackson.core:jackson-annotations", version.ref = "jackson" }
-jackson-core                 = { module = "com.fasterxml.jackson.core:jackson-core", version.ref = "jackson" }
-jackson-databind             = { module = "com.fasterxml.jackson.core:jackson-databind", version.ref = "jackson" }
-jackson-dataformat-toml      = { module = "com.fasterxml.jackson.dataformat:jackson-dataformat-toml", version.ref = "jackson" }
-jackson-dataformat-xml       = { module = "com.fasterxml.jackson.dataformat:jackson-dataformat-xml", version.ref = "jackson" }
-jackson-dataformat-yaml      = { module = "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml", version.ref = "jackson" }
-jackson-jaxb-annotations     = { module = "com.fasterxml.jackson.module:jackson-module-jaxb-annotations", version.ref = "jackson" }
+ipaddress                    = { module = "com.github.seancfoley:ipaddress", version.ref = "ipaddress" }
+jackson-dataformat-yaml      = { module = "tools.jackson.dataformat:jackson-dataformat-yaml" }
+jackson-dataformat-xml       = { module = "tools.jackson.dataformat:jackson-dataformat-xml" }
+jackson-dataformat-toml      = { module = "tools.jackson.dataformat:jackson-dataformat-toml" }
 jaxb-api                     = { module = "javax.xml.bind:jaxb-api", version.ref = "jaxb-api" }
 jaxb-impl                    = { module = "com.sun.xml.bind:jaxb-impl", version.ref = "jaxb-impl" }
 jedis                        = { module = "redis.clients:jedis", version.ref = "jedis" }
-jobrunr-spring               = { module = "org.jobrunr:jobrunr-spring-boot-3-starter", version.ref = "jobrunr" }
+jobrunr-spring               = { module = "org.jobrunr:jobrunr-spring-boot-4-starter", version.ref = "jobrunr" }
 json-path                    = { module = "com.jayway.jsonpath:json-path", version.ref = "jsonpath" }
-junit-jupiter-api            = { module = "org.junit.jupiter:junit-jupiter-api", version.ref = "junit" }
-junit-jupiter-engine         = { module = "org.junit.jupiter:junit-jupiter-engine", version.ref = "junit" }
 loki-logback-appender        = { module = "com.github.loki4j:loki-logback-appender", version.ref = "loki4j" }
 re2j                         = { module = "com.google.re2j:re2j", version.ref = "re2j" }
 rewrite-java                 = { module = "org.openrewrite.recipe:rewrite-migrate-java", version.ref = "rewrite-java"}
 springdoc                    = { module = "org.springdoc:springdoc-openapi-starter-webmvc-ui", version.ref = "springdoc" }
-testcontainers-elasticsearch = { module = "org.testcontainers:elasticsearch", version.ref = "testcontainers" }
-testcontainers-junit-jupiter = { module = "org.testcontainers:junit-jupiter", version.ref = "testcontainers" }
-testcontainers-localstack    = { module = "org.testcontainers:localstack", version.ref = "testcontainers" }
-testcontainers-postgresql    = { module = "org.testcontainers:postgresql", version.ref = "testcontainers" }
+testcontainers-elasticsearch = { module = "org.testcontainers:testcontainers-elasticsearch" }
+testcontainers-junit-jupiter = { module = "org.testcontainers:testcontainers-junit-jupiter" }
+testcontainers-localstack    = { module = "org.testcontainers:testcontainers-localstack" }
+testcontainers-postgresql    = { module = "org.testcontainers:testcontainers-postgresql" }
 tika-core                    = { module = "org.apache.tika:tika-core", version.ref = "tika" }
 woodstox-core                = { module = "com.fasterxml.woodstox:woodstox-core", version.ref = "woodstox" }

server/settings.gradle

@@ -1 +1,38 @@
+import groovy.xml.XmlSlurper
+
+pluginManagement {
+    repositories {
+        gradlePluginPortal()
+        mavenCentral()
+    }
+    resolutionStrategy {
+        eachPlugin {
+            // Supply the Hibernate ORM plugin version from Spring Boot's BOM so it is
+            // always kept in sync with the managed hibernate-core dependency.
+            if (requested.id.id == 'org.hibernate.orm') {
+                useVersion(gradle.ext.hibernateOrmVersion)
+            }
+        }
+    }
+}
+
 rootProject.name = 'openvsx-server'
+
+buildscript {
+    repositories {
+        mavenCentral()
+    }
+}
+
+// Read the Spring Boot version from the version catalog file
+def tomlText = file("gradle/libs.versions.toml").text
+def springBootVersion = (tomlText =~ /(?m)^spring-boot\s*=\s*"([^"]+)"/).collect { it[1] }.first()
+
+// Resolve the Spring Boot BOM POM and extract the Hibernate ORM version it manages.
+// The BOM uses Maven property placeholders (e.g. ${hibernate.version}) in
+// <dependencyManagement>, so we read the resolved value from <properties> directly.
+def bomPomFile = buildscript.configurations.detachedConfiguration(
+    buildscript.dependencies.create("org.springframework.boot:spring-boot-dependencies:${springBootVersion}@pom")
+).singleFile
+def bomPom = new XmlSlurper().parse(bomPomFile)
+gradle.ext.hibernateOrmVersion = bomPom.properties['hibernate.version'].text()

server/src/dev/resources/application.yml

@@ -13,7 +13,7 @@ spring:
     name: openvsx-server
   autoconfigure:
     # don't send traces to Zipkin in development
-    exclude: org.springframework.boot.actuate.autoconfigure.tracing.zipkin.ZipkinAutoConfiguration
+    exclude: org.springframework.boot.zipkin.autoconfigure.ZipkinAutoConfiguration
   profiles:
     include: ovsx
 # connect to redis cluster configured in docker-compose.yml
@@ -40,8 +40,7 @@ spring:
     jdbc:
       initialize-schema: never
   thymeleaf:
-    # explicitly disable thymeleaf view resolution
-    enabled: false
+    check-template-location: false
 
 #  mail:
 #    host: "localhost"