Skip to content

fix: promote jsr305 and opentelemetry-api to api scope#360

Open
curfew-marathon wants to merge 1 commit into
mainfrom
fix/promote-api-dependency-scopes
Open

fix: promote jsr305 and opentelemetry-api to api scope#360
curfew-marathon wants to merge 1 commit into
mainfrom
fix/promote-api-dependency-scopes

Conversation

@curfew-marathon

@curfew-marathon curfew-marathon commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Summary

Three dependencies were declared as implementation in build.gradle but expose their types through public method signatures. Consumers of this library need these types on the compile classpath, which implementation does not provide. This change promotes them to api scope.

jsr305 (@Nonnull / @Nullable)
These annotations appear on public method signatures across the model package. With implementation scope, downstream consumers that reference those methods cannot resolve the annotation types at compile time.

opentelemetry-api
Attributes.prepare() returns io.opentelemetry.api.common.Attributes and Metrics.getMeter() returns io.opentelemetry.api.metrics.Meter. Both are public methods, so the OTel types must be on the consumer compile classpath.

opentelemetry-bom (platform)
Promoted alongside opentelemetry-api so that the BOM version constraint is propagated to consumers, consistent with how the Jackson BOM is handled.

What was not changed

  • jackson-datatype-jsr310 remains implementation: the module is registered internally and no JSR-310 serializer types appear in the public API.
  • jackson-databind-nullable remains implementation: JsonNullable does not appear in any public method signature.
  • Integration test dependencies are unaffected: test suites have no downstream consumers.

Test plan

  • ./gradlew test passes with no failures

Summary by CodeRabbit

  • Security

    • Improved protection against a known path traversal vulnerability in a test-related component.
  • Compatibility

    • Improved compatibility with WireMock 3.x in test environments.
  • Library API

    • Exposed required nullability annotations and OpenTelemetry APIs for applications integrating with the library.
    • OpenTelemetry version alignment is now consistently maintained across the published API.

Copilot AI review requested due to automatic review settings July 24, 2026 03:01
@curfew-marathon
curfew-marathon requested a review from a team as a code owner July 24, 2026 03:01

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 156abcca-6878-4356-bbab-bd299fd93400

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Walkthrough

Gradle now pins Handlebars 4.5.2 for test runtime resolution and exposes JSR305 and OpenTelemetry dependencies through the library’s API configuration.

Changes

Gradle dependency updates

Layer / File(s) Summary
Test runtime dependency resolution
build.gradle
Pins Handlebars to version 4.5.2 for testRuntimeClasspath and changes JSR305 from implementation to api.
Public OpenTelemetry dependencies
build.gradle
Changes the OpenTelemetry BOM and API module declarations from implementation to api.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly captures the main dependency scope promotion in the pull request.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/promote-api-dependency-scopes

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov-commenter

codecov-commenter commented Jul 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.69%. Comparing base (587b5ea) to head (d6d9f3c).

Additional details and impacted files
@@            Coverage Diff            @@
##               main     #360   +/-   ##
=========================================
  Coverage     38.69%   38.69%           
  Complexity     1290     1290           
=========================================
  Files           198      198           
  Lines          7707     7707           
  Branches        900      900           
=========================================
  Hits           2982     2982           
  Misses         4579     4579           
  Partials        146      146           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
build.gradle (1)

61-67: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Add a Handlebars/WireMock templating compatibility test.

This forces only handlebars core to 4.5.2 while retaining WireMock’s transitive helper version. The supplied ApiExecutorTest covers a literal body, so it does not exercise the helper linkage this mixed graph could break. Add a templated-response test before relying on ./gradlew test; Gradle force rules override conflicting dependency requests. (docs.gradle.org)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@build.gradle` around lines 61 - 67, Add a WireMock templated-response
compatibility test alongside the existing ApiExecutorTest, exercising a response
template helper rather than only a literal body. Ensure the test runs through
the mixed Handlebars core/helper dependency graph created by the
resolutionStrategy.force rule and verifies the templated response is rendered
successfully.

Source: MCP tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@build.gradle`:
- Around line 61-67: Add a WireMock templated-response compatibility test
alongside the existing ApiExecutorTest, exercising a response template helper
rather than only a literal body. Ensure the test runs through the mixed
Handlebars core/helper dependency graph created by the resolutionStrategy.force
rule and verifies the templated response is rendered successfully.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 887a379d-944f-459f-b9a3-6dd87d1ce76c

📥 Commits

Reviewing files that changed from the base of the PR and between 587b5ea and e779555.

📒 Files selected for processing (1)
  • build.gradle

jsr305 annotations appear on public model method signatures.
opentelemetry-api types appear in public return types of Attributes and Metrics.
@curfew-marathon
curfew-marathon force-pushed the fix/promote-api-dependency-scopes branch from e779555 to d6d9f3c Compare July 25, 2026 02:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants