Merge pull request #329 from recurly/remove-dependencies

chore: Remove external dependencies and upgrade to Java standard library APIs

Author: cbarton

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ jobs:
     name: Java ${{ matrix.java }} tests
     strategy:
       matrix:
-        java: [8, 11, 16, 17]
+        java: [8, 11, 16, 17, 18, 19, 20, 21]
     steps:
       - uses: actions/checkout@v6.0.3
       - name: Setup java

pom.xml

@@ -62,8 +62,8 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <okhttp3.version>4.12.0</okhttp3.version>
-        <surefire.version>3.0.0-M4</surefire.version>
-        <jacoco.version>0.8.12</jacoco.version>
+        <surefire.version>3.5.5</surefire.version>
+        <jacoco.version>0.8.13</jacoco.version>
     </properties>
 
     <build>
@@ -84,7 +84,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.8.1</version>
+                <version>3.15.0</version>
                 <configuration>
                     <source>${java.version}</source>
                     <target>${java.version}</target>
@@ -155,7 +155,7 @@
             <plugin>
               <groupId>org.apache.maven.plugins</groupId>
               <artifactId>maven-source-plugin</artifactId>
-              <version>2.2.1</version>
+              <version>3.4.0</version>
               <executions>
                 <execution>
                   <id>attach-sources</id>
@@ -168,7 +168,7 @@
             <plugin>
               <groupId>org.apache.maven.plugins</groupId>
               <artifactId>maven-javadoc-plugin</artifactId>
-              <version>3.1.1</version>
+              <version>3.12.0</version>
               <configuration>
                 <source>${java.version}</source>
                 <javadocExecutable>${java.home}/bin/javadoc</javadocExecutable>
@@ -186,7 +186,7 @@
             <plugin>
               <groupId>org.apache.maven.plugins</groupId> 
               <artifactId>maven-gpg-plugin</artifactId>
-              <version>1.5</version> 
+              <version>3.2.8</version>
               <executions>
                 <execution>
                   <id>sign-artifacts</id> 
@@ -206,7 +206,7 @@
             <plugin>
               <groupId>org.sonatype.central</groupId>
               <artifactId>central-publishing-maven-plugin</artifactId>
-              <version>0.8.0</version>
+              <version>0.10.0</version>
               <extensions>true</extensions>
               <configuration>
                 <publishingServerId>central</publishingServerId>
@@ -216,7 +216,7 @@
             <plugin>
               <groupId>org.owasp</groupId>
               <artifactId>dependency-check-maven</artifactId>
-              <version>9.1.0</version>
+              <version>12.1.3</version>
             </plugin>
         </plugins>
     </build>
@@ -225,7 +225,7 @@
         <dependency>
             <groupId>com.google.code.gson</groupId>
             <artifactId>gson</artifactId>
-            <version>2.8.9</version>
+            <version>2.13.1</version>
         </dependency>
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>
@@ -243,16 +243,7 @@
             <version>${okhttp3.version}</version>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>joda-time</groupId>
-            <artifactId>joda-time</artifactId>
-            <version>2.10.6</version>
-        </dependency>
-        <dependency>
-            <groupId>com.fatboyindustrial.gson-jodatime-serialisers</groupId>
-            <artifactId>gson-jodatime-serialisers</artifactId>
-            <version>1.8.0</version>
-        </dependency>
+
         <dependency>
             <groupId>org.apache.maven.surefire</groupId>
             <artifactId>surefire</artifactId>
@@ -263,7 +254,7 @@
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter-engine</artifactId>
-            <version>5.6.2</version>
+            <version>5.12.2</version>
             <scope>test</scope>
         </dependency>
         <dependency>
@@ -276,30 +267,40 @@
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-core</artifactId>
-            <version>4.4.0</version>
+            <version>4.11.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-inline</artifactId>
-            <version>4.4.0</version>
+            <version>4.11.0</version>
+            <scope>test</scope>
+        </dependency>
+        <!-- Override Byte Buddy to a version that supports Java 21 (65) and above.
+             Mockito 4.11.0 bundles Byte Buddy 1.12.19 which only supports up to Java 20 (64).
+             Byte Buddy 1.14.9+ supports Java 21 while remaining compatible with Java 8. -->
+        <dependency>
+            <groupId>net.bytebuddy</groupId>
+            <artifactId>byte-buddy</artifactId>
+            <version>1.18.8</version>
             <scope>test</scope>
         </dependency>
         <dependency>
-            <groupId>org.hamcrest</groupId>
-            <artifactId>hamcrest-library</artifactId>
-            <version>2.2</version>
+            <groupId>net.bytebuddy</groupId>
+            <artifactId>byte-buddy-agent</artifactId>
+            <version>1.18.8</version>
             <scope>test</scope>
         </dependency>
 
-        <!-- Specify versions of transitive dependencies
-            plexus:plexus-utils introduced through jacoco-maven-plugin, maven-compiler-plugin, and others
-              - can be removed when mvn dependency:list shows version 3.0.24 or higher and no snyk reported vulnerabilities
-        -->
+        <!-- Override transitive plexus-utils to ensure a CVE-free version.
+             Pulled in via test-scoped jacoco-maven-plugin and surefire deps.
+             Scoped to test so it does not appear in consumers' transitive deps.
+             Can be removed once those deps pull in 4.0.3+ transitively. -->
         <dependency>
           <groupId>org.codehaus.plexus</groupId>
           <artifactId>plexus-utils</artifactId>
-          <version>3.5.1</version>
+          <version>4.0.3</version>
+          <scope>test</scope>
         </dependency>
     </dependencies>
 </project>

scripts/clean

@@ -6,3 +6,4 @@ rm -f src/main/java/com/recurly/v3/Constants.java
 rm -f src/main/java/com/recurly/v3/requests/*
 rm -f src/main/java/com/recurly/v3/resources/*
 rm -f src/main/java/com/recurly/v3/exception/*
+rm -f src/main/java/com/recurly/v3/queryparams/*

src/main/java/com/recurly/v3/BaseClient.java

@@ -22,7 +22,8 @@
 import okhttp3.*;
 import okhttp3.Request.Builder;
 import okhttp3.logging.HttpLoggingInterceptor;
-import org.joda.time.DateTime;
+import java.time.ZonedDateTime;
+import java.time.format.DateTimeFormatter;
 
 public abstract class BaseClient {
   private static final List<String> BINARY_TYPES = Arrays.asList("application/pdf");
@@ -34,25 +35,28 @@ public abstract class BaseClient {
   private String apiUrl;
 
   protected BaseClient(final String apiKey) {
-    this(apiKey, newHttpClient(apiKey), new ClientOptions());
+    this(apiKey, newHttpClient(validateApiKey(apiKey)), new ClientOptions());
   }
 
   protected BaseClient(final String apiKey, final ClientOptions clientOptions) {
-    this(apiKey, newHttpClient(apiKey), clientOptions);
+    this(apiKey, newHttpClient(validateApiKey(apiKey)), clientOptions);
   }
 
   protected BaseClient(final String apiKey, final OkHttpClient client) {
     this(apiKey, client, new ClientOptions());
   }
 
   protected BaseClient(final String apiKey, final OkHttpClient client, final ClientOptions clientOptions) {
+    this.apiKey = validateApiKey(apiKey);
+    this.client = client;
+    this.apiUrl = clientOptions.getBaseUrl();
+  }
+
+  private static String validateApiKey(final String apiKey) {
     if (apiKey == null || apiKey.isEmpty()) {
       throw new IllegalArgumentException("apiKey cannot be null or empty");
     }
-
-    this.apiKey = apiKey;
-    this.client = client;
-    this.apiUrl = clientOptions.getBaseUrl();
+    return apiKey;
   }
 
   private static OkHttpClient newHttpClient(final String apiKey) {
@@ -207,8 +211,8 @@ private okhttp3.Request buildRequest(
           continue;
         } else if (value instanceof String) {
           stringValue = value.toString();
-        } else if (value instanceof DateTime) {
-          stringValue = value.toString();
+        } else if (value instanceof ZonedDateTime) {
+          stringValue = DateTimeFormatter.ISO_OFFSET_DATE_TIME.format((ZonedDateTime) value);
         } else if (value instanceof Integer) {
           stringValue = Integer.toString((Integer) value);
         } else if (value instanceof Float) {

src/main/java/com/recurly/v3/JsonSerializer.java

@@ -1,6 +1,9 @@
 package com.recurly.v3;
 
-import com.fatboyindustrial.gsonjodatime.Converters;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.time.format.DateTimeParseException;
 import com.google.gson.*;
 import com.google.gson.annotations.SerializedName;
 import com.google.gson.reflect.TypeToken;
@@ -14,22 +17,37 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import org.joda.time.DateTime;
+import java.time.ZonedDateTime;
 
 public class JsonSerializer {
-  private class DateDeserializer implements JsonDeserializer<DateTime> {
+  private class DateDeserializer implements JsonDeserializer<ZonedDateTime> {
     @Override
-    public DateTime deserialize(JsonElement element, Type arg1, JsonDeserializationContext arg2)
+    public ZonedDateTime deserialize(JsonElement element, Type arg1, JsonDeserializationContext arg2)
         throws JsonParseException {
-      return DateTime.parse(element.getAsString());
+      String s = element.getAsString();
+      try {
+        return ZonedDateTime.parse(s);
+      } catch (DateTimeParseException e) {
+        return LocalDateTime.parse(s).atZone(ZoneOffset.UTC);
+      }
+    }
+  }
+
+  private class DateSerializer implements com.google.gson.JsonSerializer<ZonedDateTime> {
+    @Override
+    public JsonElement serialize(ZonedDateTime src, Type typeOfSrc, JsonSerializationContext context) {
+      return new JsonPrimitive(DateTimeFormatter.ISO_OFFSET_DATE_TIME.format(src));
     }
   }
 
-  private final Gson gsonSerializer = Converters.registerDateTime(new GsonBuilder()).create();
+  private final Gson gsonSerializer =
+      new GsonBuilder()
+          .registerTypeAdapter(ZonedDateTime.class, new DateSerializer())
+          .create();
   private final Gson gsonDeserializer =
       new GsonBuilder()
           .excludeFieldsWithoutExposeAnnotation()
-          .registerTypeAdapter(DateTime.class, new DateDeserializer())
+          .registerTypeAdapter(ZonedDateTime.class, new DateDeserializer())
           .registerTypeAdapterFactory(new RecurlyEnumTypeAdapterFactory())
           .create();
 

src/test/java/com/recurly/v3/BaseClientTest.java

@@ -21,7 +21,8 @@
 import okhttp3.Response;
 
 import org.apache.commons.io.IOUtils;
-import org.joda.time.DateTime;
+import java.time.ZonedDateTime;
+import java.time.format.DateTimeFormatter;
 import org.junit.Assert;
 import org.junit.jupiter.api.Test;
 import org.mockito.stubbing.Answer;
@@ -132,14 +133,14 @@ public void testMakeRequestWithoutResource() throws IOException {
 
   @Test
   public void testMakeRequestWithQueryParams() throws IOException {
-    DateTime dateTime = new DateTime();
+    ZonedDateTime dateTime = ZonedDateTime.now();
 
     final Call mCall = mock(Call.class);
     Answer answer = (i) -> {
       Request request = i.getArgument(0);
       HttpUrl url = request.url();
       assertEquals("Aaron", url.queryParameter("my_string"));
-      assertEquals(dateTime.toString(), url.queryParameter("my_date_time"));
+      assertEquals(DateTimeFormatter.ISO_OFFSET_DATE_TIME.format(dateTime), url.queryParameter("my_date_time"));
       assertEquals("1", url.queryParameter("my_integer"));
       assertEquals("2.3", url.queryParameter("my_float"));
       assertEquals("4.5", url.queryParameter("my_double"));

src/test/java/com/recurly/v3/ClientTest.java

@@ -1,8 +1,7 @@
 package com.recurly.v3;
 
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.matchesPattern;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import org.junit.jupiter.api.Test;
 
@@ -25,6 +24,6 @@ public void testCantInitializeWithoutApiKey() {
 
   @Test
   public void testRespondsWithValidApiVersion() {
-    assertThat(Client.API_VERSION, matchesPattern("v\\d{4}-\\d{2}-\\d{2}"));
+    assertTrue(Client.API_VERSION.matches("v\\d{4}-\\d{2}-\\d{2}"));
   }
 }

src/test/java/com/recurly/v3/JsonSerializerTest.java

@@ -7,7 +7,7 @@
 import com.recurly.v3.fixtures.MyRequest;
 import com.recurly.v3.fixtures.MyResource;
 import com.recurly.v3.Constants;
-import org.joda.time.DateTime;
+import java.time.ZonedDateTime;
 import org.junit.jupiter.api.Test;
 
 public class JsonSerializerTest {
@@ -125,13 +125,13 @@ private static String getDateTimesJson() {
         + "}";
   }
 
-  private static void checkDateTime(DateTime date) {
-    assertEquals(DateTime.class, date.getClass());
+  private static void checkDateTime(ZonedDateTime date) {
+    assertEquals(ZonedDateTime.class, date.getClass());
     assertEquals(2019, date.getYear());
-    assertEquals(5, date.getMonthOfYear());
+    assertEquals(5, date.getMonthValue());
     assertEquals(31, date.getDayOfMonth());
-    assertEquals(15, date.getHourOfDay());
-    assertEquals(31, date.getMinuteOfHour());
-    assertEquals(24, date.getSecondOfMinute());
+    assertEquals(15, date.getHour());
+    assertEquals(31, date.getMinute());
+    assertEquals(24, date.getSecond());
   }
 }