Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency io.dropwizard:dropwizard-core to v4 - autoclosed #417

Closed
wants to merge 1 commit into from
Closed

Update dependency io.dropwizard:dropwizard-core to v4 - autoclosed #417

wants to merge 1 commit into from

Conversation

mend-for-github-com[bot]
Copy link

@mend-for-github-com mend-for-github-com bot commented Feb 15, 2024 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
io.dropwizard:dropwizard-core compile major 1.3.13 -> 4.0.0

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
High 7.0 CVE-2020-27216 #187

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
High 7.5 CVE-2023-6481 #410

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
Critical 9.8 CVE-2022-1471 #362
High 7.5 CVE-2017-18640 #85
High 7.5 CVE-2021-28165 #296
High 7.5 CVE-2022-25857 #348

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
High 7.5 CVE-2023-36478 #403

Release Notes

dropwizard/dropwizard (io.dropwizard:dropwizard-core)

v4.0.0

Compare Source

Dropwizard 4.0.0

It's finally here, the next major release of Dropwizard! This one has been developed and released in tandem with Dropwizard 3.0.0.

If you're wondering what the differences are: Not much!

3️⃣ Dropwizard 3.0.0 is still based on and is using dependencies for Java EE and the javax.* package namespace. The effort to migrate from Dropwizard 2.x to Dropwizard 3.0.0 should be minimal for many projects.

4️⃣ Dropwizard 4.0.0 is based on and is using dependencies for Jakarta EE and the jakarta.* package namespace. The effort to migrate from Dropwizard 2.x to Dropwizard 4.0.0 might be bigger due to more package changes and more breaking changes in our dependencies.

📣 In any case, let us know how the migration went and if you were missing anything important in the upgrade notes in our GitHub Discussions!

⚠️ Breaking changes

For a full list of relevant changes please refer to the Upgrade Notes for Dropwizard 4.0.x.

Java 11 baseline

Dropwizard 4.0.0 and later require Java 11 as a baseline. Later versions of Java are also working.

Dropwizard Package Structure and JPMS

In order to properly support the Java Platform Module System (JPMS), the Java packages in modules must not overlap, or put differently, the packages may not be split into multiple modules.

Dropwizard 4.0.0 won’t enable full support for the JPMS. Instead, as a transition step, automatic modules are introduced.

Affected packages:

Maven module | Old package | New package
-- | -- | --
dropwizard-core | io.dropwizard | io.drowizard.core
dropwizard-logging | io.dropwizard.logging | io.dropwizard.logging.common
dropwizard-metrics | io.dropwizard.metrics | io.dropwizard.metrics.common
dropwizard-views | io.dropwizard.views | io.dropwizard.views.common

Transition to Jakarta EE

Previously released Dropwizard versions used Java/Jakarta EE dependencies under the javax namespace. Dropwizard 4.0.x transitioned to Jakarta EE 9 components and therefore utilize the new jakarta namespace for many components.

This means that most of the imports of existing applications using Dropwizard 2.x or 3.x will have to be changed from the javax to the jakarta namespace. However, other components still use the javax namespace, so a simple search and replace could break other imports.

Jakarta EE 9 compatibility

As stated above, Dropwizard 4.0.x will transition to Jakarta EE 9 components. This means, Dropwizard will now try to be consistent with one specific EE version.

Therefore Dropwizard 4.0.x will stay on components of Jakarta EE 9 and the transition to components of Jakarta EE 10 will be postponed to an other release series.

Since the EE version bump will probably introduce breaking changes, the Jakarta EE 10 components will be most likely integrated in Dropwizard 5.0.x and not in a 4.1.x release.

Jetty 11

The main change introduced in Dropwizard 4.0.0 is the upgrade to Jetty 11.0.x. Jetty 11.0.x is built for Java 11, therefore the Java version change was necessary.

This change comes with some migration cost. For detailed information regarding the changes introduced in Jetty 11.0.x, refer to the Jetty migration guide.

Apache HttpClient 5

The version of Apache HttpClient used in dropwizard-client has been updated to version 5.x.

For more information refer to the Apache HttpClient 5.0 migration guide.

Hibernate 6

Hibernate 5.6 provides compatible implementations for JPA 2.2 and for Jakarta Persistence 3.0.

But Hibernate 6.0 and 6.1 still provide compatible implementations for Jakarta Persistence 3.0, so we upgraded to Hibernate 6.1 in Dropwizard 4.0.x.

If any other aspects from Hibernate are used in an application rather than those provided by Dropwizard, there might be an additional migration cost. Please follow the Hibernate 6 migration guide and the Hibernate 6.1 migration guide, if you encounter any problems.

Removed Support for JUnit 4.x

Support for testing with JUnit 4.x has been moved from dropwizard-testing to dropwizard-testing-junit4.

🥇 Special thanks

The release of Dropwizard 3.0.0 wouldn't have been possible without the help of the community (YOU!) and especially the following contributors:

@​zUniQueX, @​rhowe, @​pstackle, @​dennyac, and countless others!

What's Changed since Dropwizard 4.0.0-beta.4

Full Changelog: dropwizard/dropwizard@v4.0.0-beta.4...v4.0.0

v3.0.6

Compare Source

What's Changed

Full Changelog: dropwizard/dropwizard@v3.0.5...v3.0.6

v3.0.5

Compare Source

What's Changed

Full Changelog: dropwizard/dropwizard@v3.0.4...v3.0.5

v3.0.4

Compare Source

What's Changed

Full Changelog: dropwizard/dropwizard@v3.0.3...v3.0.4

v3.0.3

Compare Source

What's Changed

@mend-for-github-com mend-for-github-com bot added the security fix Security fix generated by WhiteSource label Feb 15, 2024
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/io.dropwizard-dropwizard-core-4.x branch from 5f35442 to 970b5d2 Compare February 20, 2024 02:39
@mend-for-github-com mend-for-github-com bot changed the title Update dependency io.dropwizard:dropwizard-core to v4 Update dependency io.dropwizard:dropwizard-core to v4 - autoclosed Feb 29, 2024
@mend-for-github-com mend-for-github-com bot deleted the whitesource-remediate/io.dropwizard-dropwizard-core-4.x branch February 29, 2024 06:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
security fix Security fix generated by WhiteSource
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants