Skip to content

Commit 94e63d8

Browse files
suresh-prakashclaude
suresh-prakash
and
claude
authored
build: adopt hypertrace shared BOM, version catalog, and java-convention plugin (#120)
* build: bump to JDK 17 and upgrade service-framework to 0.1.94 for Jetty 12 (CVE-2026-2332) The current build pulls service-framework 0.1.89 (Jetty 11.0.24, vulnerable to CVE-2026-2332 / CVE-2025-5115). service-framework 0.1.94 migrates to Jetty 12.1.9 (ee10), which requires JDK 17+. - Bump source/target compatibility to Java 17 across all subprojects - Bump CI workflows to Java 17 - Bump platform-metrics + platform-service-framework 0.1.89 -> 0.1.94 - Bump grpc-client-utils 0.13.16 -> 0.13.23 (resolution conflict version) - Bump junit-pioneer 2.0.0 -> 2.3.0 and mockito-core 5.2.0 -> 5.15.2 for JDK 17+ reflection compat - Add --add-opens to test task for junit-pioneer @SetEnvironmentVariable on JDK 17+ Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * build: use Gradle Java toolchain to provision JDK 17 The shared hypertrace gradle GitHub action launches Gradle with JDK 11 on the runner. Setting source/target compatibility to 17 caused 'invalid source release: 17' on subprojects in the build job. Switching to a Java toolchain lets Gradle auto-provision and compile with JDK 17 regardless of the launcher JDK the action uses. * build: adopt hypertrace shared BOM and version catalog Migrates the project to the canonical hypertrace pattern: the shared hypertrace-bom catalog drives common dep/plugin versions and the java-convention plugin standardizes JVM toolchain handling. Repo-local deps move to gradle/libs.versions.toml exposed as localLibs. - settings.gradle.kts: apply org.hypertrace.dependency-settings 0.2.0 with catalogVersion 0.3.80 (auto-registers commonLibs and localLibs) - gradle/libs.versions.toml: repo-local catalog (mockito, log4j, junit- pioneer, caffeine, avro, hypertrace-config-partitioner-api, grpc-netty, hypertrace-grpcutils-context, plus the avro plugin which is not in BOM) - build.gradle.kts: replace per-module hand-rolled plugin versions with alias(commonLibs.plugins.*); apply hypertrace.java-convention (toolchain 21 default, releaseCompatibility 11) so dep/JDK upgrades come for free via BOM bumps - Subprojects: rewrite to alias(commonLibs.*)/alias(localLibs.*) and add api(platform(commonLibs.hypertrace.bom)) for managed versions - Generate gradle.lockfile per module (settings-gradle.lockfile not tracked per the BOM doc) - Add .github/workflows/update-locks.yml: weekly schedule keeps locks in sync with newly published BOM versions - Bump pr-build/pr-test java-version 17 to 21 to match toolchain default * build: prefer non-jakarta aliases for hypertrace framework deps Both `hypertrace.framework.metrics` and `hypertrace.framework.metrics.jakarta` (and the same pair for `service`) resolve to the same underlying artifact in hypertrace-bom 0.3.80 — the `-jakarta` suffix is a transitional alias for the in-flight Jakarta EE migration. The unsuffixed names are clearer and self- explanatory; switch to those. No resolved-dependency change; lockfiles unchanged. * build: address review feedback — prefer commonLibs and slf4j2 binding - Move shared-catalog deps from localLibs to commonLibs: mockito-core, log4j-slf4j2-impl, grpc-netty, hypertrace-grpcutils-context. The BOM governs the versions there, so the local catalog only carries deps truly outside the shared catalog. - Switch the log4j binding to log4j-slf4j2-impl (the slf4j2 binding) per reviewer note — log4j-slf4j-impl was the slf4j-1.x binding and pulls in the wrong API. - Drop versions for kafka-bom-managed entries (avro, kafka-streams-avro- serde, kafka-streams-test-utils) — the kafka-bom platform constrains them. Lockfiles regenerated; resolved versions now follow the BOM (mockito 5.8.0, log4j-slf4j2-impl 2.25.4) instead of hand-pinned ones. --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
1 parent 0aa8c44 commit 94e63d8

16 files changed

Lines changed: 514 additions & 83 deletions

File tree

‎.github/workflows/pr-build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
- uses: actions/setup-java@v4
2323
with:
2424
distribution: 'temurin'
25-
java-version: '11'
25+
java-version: '21'
2626

2727
- name: Build with Gradle
2828
uses: hypertrace/github-actions/gradle@main

‎.github/workflows/pr-test.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
- uses: actions/setup-java@v4
1919
with:
2020
distribution: 'temurin'
21-
java-version: '11'
21+
java-version: '21'
2222

2323
- name: Unit test
2424
uses: hypertrace/github-actions/gradle@main
@@ -56,7 +56,7 @@ jobs:
5656
- uses: actions/setup-java@v4
5757
with:
5858
distribution: 'temurin'
59-
java-version: '11'
59+
java-version: '21'
6060
- name: Dependency Check
6161
uses: hypertrace/github-actions/dependency-check@main
6262
with:

‎.github/workflows/update-locks.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Update Locks
2+
on:
3+
workflow_dispatch:
4+
schedule:
5+
- cron: '37 21 * * 3'
6+
jobs:
7+
update-versions:
8+
runs-on: ubuntu-24.04
9+
steps:
10+
- name: Check out code
11+
uses: actions/checkout@v4
12+
with:
13+
fetch-depth: 0
14+
- name: Calculate simple repository name
15+
id: repo-basename
16+
shell: bash
17+
run: |
18+
echo "value=`basename ${{ github.repository }}`" >> $GITHUB_OUTPUT
19+
- name: Get Token from Github App
20+
uses: tibdex/github-app-token@v2
21+
id: generate-token
22+
with:
23+
app_id: ${{ secrets.GH_CI_APP_ID }}
24+
private_key: ${{ secrets.GH_CI_APP_PRIVATE_KEY }}
25+
repositories: >-
26+
[${{ toJson(steps.repo-basename.outputs.value) }}]
27+
- name: Update locks if needed
28+
uses: hypertrace/github-actions/raise-lock-pr@main
29+
with:
30+
token: ${{ steps.generate-token.outputs.token }}

‎build.gradle.kts‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,30 +2,25 @@ import org.hypertrace.gradle.publishing.HypertracePublishExtension
22
import org.hypertrace.gradle.publishing.License
33

44
plugins {
5-
id("org.hypertrace.repository-plugin") version "0.5.0"
6-
id("org.hypertrace.ci-utils-plugin") version "0.4.0"
7-
id("org.hypertrace.avro-plugin") version "0.5.1" apply false
8-
id("org.hypertrace.publish-plugin") version "1.1.1" apply false
9-
id("org.hypertrace.jacoco-report-plugin") version "0.3.0" apply false
10-
id("org.hypertrace.code-style-plugin") version "2.1.2" apply false
11-
id("org.owasp.dependencycheck") version "12.1.3"
5+
alias(commonLibs.plugins.hypertrace.repository)
6+
alias(commonLibs.plugins.hypertrace.ciutils)
7+
alias(commonLibs.plugins.hypertrace.publish) apply false
8+
alias(commonLibs.plugins.hypertrace.codestyle) apply false
9+
alias(commonLibs.plugins.hypertrace.java.convention)
10+
alias(commonLibs.plugins.owasp.dependencycheck)
11+
alias(localLibs.plugins.hypertrace.avro) apply false
1212
}
1313

1414
subprojects {
1515
group = "org.hypertrace.core.kafkastreams.framework"
16-
pluginManager.withPlugin("org.hypertrace.publish-plugin") {
16+
pluginManager.withPlugin(rootProject.commonLibs.plugins.hypertrace.publish.get().pluginId) {
1717
configure<HypertracePublishExtension> {
1818
license.set(License.APACHE_2_0)
1919
}
2020
}
2121

2222
pluginManager.withPlugin("java") {
23-
configure<JavaPluginExtension> {
24-
sourceCompatibility = JavaVersion.VERSION_11
25-
targetCompatibility = JavaVersion.VERSION_11
26-
27-
apply(plugin = "org.hypertrace.code-style-plugin")
28-
}
23+
apply(plugin = rootProject.commonLibs.plugins.hypertrace.codestyle.get().pluginId)
2924
}
3025

3126
// Handle lz4-java redirect capability conflict:
@@ -45,4 +40,4 @@ dependencyCheck {
4540
suppressionFile = "owasp-suppressions.xml"
4641
scanConfigurations.add("runtimeClasspath")
4742
failBuildOnCVSS = 3.0F
48-
}
43+
}

‎gradle/libs.versions.toml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[versions]
2+
caffeine = "3.1.8"
3+
junit-pioneer = "2.3.0"
4+
hypertrace-config = "0.1.73"
5+
hypertrace-avro-plugin = "0.5.1"
6+
7+
[libraries]
8+
junit-pioneer = { module = "org.junit-pioneer:junit-pioneer", version.ref = "junit-pioneer" }
9+
hamcrest-core = { module = "org.hamcrest:hamcrest-core", version = "2.2" }
10+
caffeine = { module = "com.github.ben-manes.caffeine:caffeine", version.ref = "caffeine" }
11+
kafka-streams-avro-serde = { module = "io.confluent:kafka-streams-avro-serde" }
12+
kafka-streams-test-utils = { module = "org.apache.kafka:kafka-streams-test-utils" }
13+
avro = { module = "org.apache.avro:avro" }
14+
hypertrace-config-partitioner-api = { module = "org.hypertrace.config.service:partitioner-config-service-api", version.ref = "hypertrace-config" }
15+
16+
[plugins]
17+
hypertrace-avro = { id = "org.hypertrace.avro-plugin", version.ref = "hypertrace-avro-plugin" }

‎kafka-event-listener/build.gradle.kts‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,26 @@
11
plugins {
22
`java-library`
33
jacoco
4-
id("org.hypertrace.publish-plugin")
5-
id("org.hypertrace.jacoco-report-plugin")
4+
alias(commonLibs.plugins.hypertrace.publish)
5+
alias(commonLibs.plugins.hypertrace.jacoco)
66
id("java-test-fixtures")
77
}
88

99
dependencies {
10-
annotationProcessor("org.projectlombok:lombok:1.18.38")
11-
compileOnly("org.projectlombok:lombok:1.18.38")
10+
annotationProcessor(commonLibs.lombok)
11+
compileOnly(commonLibs.lombok)
1212

1313
api(platform(project(":kafka-bom")))
14-
api("org.apache.kafka:kafka-clients")
14+
api(platform(commonLibs.hypertrace.bom))
15+
api(commonLibs.kafka.clients)
1516

16-
implementation("org.hypertrace.core.serviceframework:platform-metrics:0.1.89")
17-
testImplementation("org.junit.jupiter:junit-jupiter:5.9.2")
18-
testImplementation("org.mockito:mockito-core:5.2.0")
19-
testImplementation("com.github.ben-manes.caffeine:caffeine:3.1.8")
17+
implementation(commonLibs.hypertrace.framework.metrics)
18+
testImplementation(commonLibs.junit.jupiter)
19+
testImplementation(commonLibs.mockito.core)
20+
testImplementation(localLibs.caffeine)
2021

2122
testFixturesApi(platform(project(":kafka-bom")))
22-
testFixturesApi("org.apache.kafka:kafka-clients")
23+
testFixturesApi(commonLibs.kafka.clients)
2324
}
2425

2526
tasks.test {

‎kafka-event-listener/gradle.lockfile‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# This is a Gradle generated file for dependency locking.
2+
# Manual edits can break the build and are not advised.
3+
# This file is expected to be part of source control.
4+
at.yawk.lz4:lz4-java:1.8.1=runtimeClasspath,testRuntimeClasspath
5+
com.fasterxml.jackson:jackson-bom:2.21.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
6+
com.github.ben-manes.caffeine:caffeine:3.1.8=testCompileClasspath,testRuntimeClasspath
7+
com.github.luben:zstd-jni:1.5.6-3=runtimeClasspath,testRuntimeClasspath
8+
com.google.code.findbugs:jsr305:3.0.2=runtimeClasspath,testRuntimeClasspath
9+
com.google.errorprone:error_prone_annotations:2.18.0=runtimeClasspath
10+
com.google.errorprone:error_prone_annotations:2.21.1=testCompileClasspath,testRuntimeClasspath
11+
com.google.guava:failureaccess:1.0.1=runtimeClasspath,testRuntimeClasspath
12+
com.google.guava:guava-parent:32.1.2-jre=runtimeClasspath,testRuntimeClasspath
13+
com.google.guava:guava:32.1.2-jre=runtimeClasspath,testRuntimeClasspath
14+
com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=runtimeClasspath,testRuntimeClasspath
15+
com.typesafe:config:1.4.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
16+
io.dropwizard.metrics:metrics-core:4.2.25=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
17+
io.dropwizard.metrics:metrics-jakarta-servlet:4.2.25=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
18+
io.dropwizard.metrics:metrics-jvm:4.2.25=runtimeClasspath,testRuntimeClasspath
19+
io.github.mweirauch:micrometer-jvm-extras:0.2.2=runtimeClasspath,testRuntimeClasspath
20+
io.grpc:grpc-bom:1.75.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
21+
io.micrometer:micrometer-commons:1.14.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
22+
io.micrometer:micrometer-core:1.14.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
23+
io.micrometer:micrometer-observation:1.14.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
24+
io.micrometer:micrometer-registry-prometheus-simpleclient:1.14.4=runtimeClasspath,testRuntimeClasspath
25+
io.netty:netty-bom:4.1.133.Final=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
26+
io.prometheus:simpleclient:0.16.0=runtimeClasspath,testRuntimeClasspath
27+
io.prometheus:simpleclient_common:0.16.0=runtimeClasspath,testRuntimeClasspath
28+
io.prometheus:simpleclient_dropwizard:0.16.0=runtimeClasspath,testRuntimeClasspath
29+
io.prometheus:simpleclient_pushgateway:0.16.0=runtimeClasspath,testRuntimeClasspath
30+
io.prometheus:simpleclient_servlet_common:0.16.0=runtimeClasspath,testRuntimeClasspath
31+
io.prometheus:simpleclient_servlet_jakarta:0.16.0=runtimeClasspath,testRuntimeClasspath
32+
io.prometheus:simpleclient_tracer_common:0.16.0=runtimeClasspath,testRuntimeClasspath
33+
io.prometheus:simpleclient_tracer_otel:0.16.0=runtimeClasspath,testRuntimeClasspath
34+
io.prometheus:simpleclient_tracer_otel_agent:0.16.0=runtimeClasspath,testRuntimeClasspath
35+
jakarta.servlet:jakarta.servlet-api:6.1.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
36+
net.bytebuddy:byte-buddy-agent:1.14.10=testCompileClasspath,testRuntimeClasspath
37+
net.bytebuddy:byte-buddy:1.14.10=testCompileClasspath,testRuntimeClasspath
38+
org.apache.kafka:kafka-clients:7.7.0-ccs=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
39+
org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
40+
org.checkerframework:checker-qual:3.33.0=runtimeClasspath
41+
org.checkerframework:checker-qual:3.37.0=testCompileClasspath,testRuntimeClasspath
42+
org.eclipse.jetty.ee10:jetty-ee10-bom:12.1.9=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
43+
org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.9=runtimeClasspath,testRuntimeClasspath
44+
org.eclipse.jetty:jetty-bom:12.1.9=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
45+
org.eclipse.jetty:jetty-http:12.1.9=runtimeClasspath,testRuntimeClasspath
46+
org.eclipse.jetty:jetty-io:12.1.9=runtimeClasspath,testRuntimeClasspath
47+
org.eclipse.jetty:jetty-security:12.1.9=runtimeClasspath,testRuntimeClasspath
48+
org.eclipse.jetty:jetty-server:12.1.9=runtimeClasspath,testRuntimeClasspath
49+
org.eclipse.jetty:jetty-session:12.1.9=runtimeClasspath,testRuntimeClasspath
50+
org.eclipse.jetty:jetty-util:12.1.9=runtimeClasspath,testRuntimeClasspath
51+
org.hdrhistogram:HdrHistogram:2.2.2=runtimeClasspath,testRuntimeClasspath
52+
org.hypertrace.bom:hypertrace-bom:0.3.80=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
53+
org.hypertrace.core.serviceframework:platform-metrics:0.1.94=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
54+
org.junit.jupiter:junit-jupiter-api:5.10.0=testCompileClasspath,testRuntimeClasspath
55+
org.junit.jupiter:junit-jupiter-engine:5.10.0=testRuntimeClasspath
56+
org.junit.jupiter:junit-jupiter-params:5.10.0=testCompileClasspath,testRuntimeClasspath
57+
org.junit.jupiter:junit-jupiter:5.10.0=testCompileClasspath,testRuntimeClasspath
58+
org.junit.platform:junit-platform-commons:1.10.0=testCompileClasspath,testRuntimeClasspath
59+
org.junit.platform:junit-platform-engine:1.10.0=testRuntimeClasspath
60+
org.junit:junit-bom:5.10.0=testCompileClasspath,testRuntimeClasspath
61+
org.latencyutils:LatencyUtils:2.0.3=runtimeClasspath,testRuntimeClasspath
62+
org.mockito:mockito-core:5.8.0=testCompileClasspath,testRuntimeClasspath
63+
org.objenesis:objenesis:3.3=testRuntimeClasspath
64+
org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath
65+
org.projectlombok:lombok:1.18.30=annotationProcessor,compileClasspath
66+
org.slf4j:slf4j-api:2.0.17=runtimeClasspath,testRuntimeClasspath
67+
org.slf4j:slf4j-api:2.0.7=compileClasspath,testCompileClasspath
68+
org.xerial.snappy:snappy-java:1.1.10.5=runtimeClasspath,testRuntimeClasspath
69+
empty=

‎kafka-streams-framework/build.gradle.kts‎

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,40 @@
11
plugins {
22
`java-library`
33
jacoco
4-
id("org.hypertrace.publish-plugin")
5-
id("org.hypertrace.jacoco-report-plugin")
6-
id("org.hypertrace.avro-plugin")
4+
alias(commonLibs.plugins.hypertrace.publish)
5+
alias(commonLibs.plugins.hypertrace.jacoco)
6+
alias(localLibs.plugins.hypertrace.avro)
77
}
88

99
tasks.test {
1010
useJUnitPlatform()
1111
}
1212

1313
dependencies {
14-
annotationProcessor("org.projectlombok:lombok:1.18.38")
15-
compileOnly("org.projectlombok:lombok:1.18.38")
14+
annotationProcessor(commonLibs.lombok)
15+
compileOnly(commonLibs.lombok)
1616

1717
api(project(":kafka-streams-serdes"))
1818
api(platform(project(":kafka-bom")))
19+
api(platform(commonLibs.hypertrace.bom))
1920
api("org.apache.kafka:kafka-streams")
20-
api("io.confluent:kafka-streams-avro-serde")
21-
api("org.hypertrace.core.grpcutils:grpc-client-utils:0.13.16")
21+
api(localLibs.kafka.streams.avro.serde)
22+
api(commonLibs.hypertrace.grpcutils.client)
2223

23-
implementation("org.apache.avro:avro")
24-
implementation("org.apache.kafka:kafka-clients")
25-
implementation("org.hypertrace.core.serviceframework:platform-metrics:0.1.89")
26-
implementation("org.hypertrace.core.serviceframework:platform-service-framework:0.1.89")
27-
implementation("org.apache.commons:commons-lang3:3.18.0")
24+
implementation(localLibs.avro)
25+
implementation(commonLibs.kafka.clients)
26+
implementation(commonLibs.hypertrace.framework.metrics)
27+
implementation(commonLibs.hypertrace.framework.service)
28+
implementation(commonLibs.commons.lang)
2829

29-
testCompileOnly("org.projectlombok:lombok:1.18.38")
30-
testAnnotationProcessor("org.projectlombok:lombok:1.18.38")
31-
testImplementation("org.apache.kafka:kafka-streams-test-utils")
32-
testImplementation("org.junit.jupiter:junit-jupiter:5.9.2")
33-
testImplementation("org.junit-pioneer:junit-pioneer:2.0.0")
34-
testImplementation("org.mockito:mockito-core:5.2.0")
35-
testImplementation("org.hamcrest:hamcrest-core:2.2")
36-
testRuntimeOnly("org.apache.logging.log4j:log4j-slf4j-impl:2.20.0")
30+
testCompileOnly(commonLibs.lombok)
31+
testAnnotationProcessor(commonLibs.lombok)
32+
testImplementation(localLibs.kafka.streams.test.utils)
33+
testImplementation(commonLibs.junit.jupiter)
34+
testImplementation(localLibs.junit.pioneer)
35+
testImplementation(commonLibs.mockito.core)
36+
testImplementation(localLibs.hamcrest.core)
37+
testRuntimeOnly(commonLibs.log4j.slf4j2.impl)
3738
}
3839

3940
// Disabling compatibility check for the test avro definitions.

0 commit comments

Comments
 (0)