build: adopt hypertrace shared BOM, version catalog, and java-convention plugin by suresh-prakash · Pull Request #120 · hypertrace/kafka-streams-framework

suresh-prakash · 2026-06-01T06:47:59Z

Summary

Migrate this repo to the canonical hypertrace dependency pattern: the shared hypertrace-bom catalog drives common dep/plugin versions, the java-convention plugin standardises JVM toolchain handling, and a repo-local gradle/libs.versions.toml covers the rest. This addresses aaron-steinfeld's review request to "standardize this repo to use the BOM and plugins" so future CVE / dependency upgrades come for free via BOM bumps instead of one-off PRs.

The Jetty 12 / CVE-2026-2332 fix that originally motivated this PR is now picked up transitively through the BOM (which pins service-framework 0.1.94, grpc-client-utils 0.13.23, etc.). The original hand-rolled JDK 17 / dep bumps have been reverted in favour of letting the BOM and java-convention plugin manage them.

Reference

Migrating to using the shared BOM — internal best-practices doc that documents this pattern. Used as reference repos:

hypertrace/config-service (settings, root build, update-locks.yml)
hypertrace/document-store

Changes

Settings & catalogs

settings.gradle.kts: apply org.hypertrace.dependency-settings:0.2.0 with catalogVersion = 0.3.80. The plugin auto-registers commonLibs (from the BOM) and localLibs (from gradle/libs.versions.toml) — no explicit versionCatalogs.create(...) block needed.
gradle/libs.versions.toml (new): repo-local catalog for deps not in the shared BOM — mockito, log4j, junit-pioneer, caffeine, hamcrest-core, avro, kafka-streams-test-utils, kafka-streams-avro-serde, hypertrace-grpcutils-context, partitioner-config-service-api, grpc-netty, plus the org.hypertrace.avro-plugin (not in BOM).

Root build

build.gradle.kts: replace hand-rolled plugin versions with alias(commonLibs.plugins.*) (hypertrace.repository, hypertrace.ciutils, hypertrace.publish, hypertrace.codestyle, hypertrace.java.convention, owasp.dependencycheck).
Apply hypertrace.java-convention — defaults to toolchain JDK 21 with releaseCompatibility = 11, so JDK / dep upgrades come for free via BOM bumps and downstream consumers below JDK 21 still work (bytecode targets Java 11).

Subprojects

All five module build.gradle.kts files rewritten to alias(commonLibs.*) / alias(localLibs.*) references.
Each module adds api(platform(commonLibs.hypertrace.bom)) alongside the existing api(platform(project(":kafka-bom"))) so Hypertrace BOM versions take effect.
Use the unsuffixed commonLibs.hypertrace.framework.metrics / service aliases (rather than the -jakarta aliases that resolve to the same artifact in BOM 0.3.80) for clarity.

Lockfiles

Generate gradle.lockfile per module via ./gradlew resolveAndLockAll --write-locks (5 lockfiles).
settings-gradle.lockfile deleted per the BOM doc — not tracked.

CI workflows

Add .github/workflows/update-locks.yml (mirrors hypertrace/config-service) — weekly schedule + workflow_dispatch keeps gradle.lockfiles in sync with newly published BOM versions automatically.
pr-build.yml and pr-test.yml: bump setup-java Java 17 → 21 to match the java-convention toolchain default. Note: the shared hypertrace/github-actions/gradle@main action still launches Gradle on JDK 11 regardless of setup-java; the toolchain block then provisions JDK 21 for compile / test.

Why this approach (vs. the original JDK 17 + service-framework bump)

Adopting the BOM solves the same CVE problem the original PR aimed at, but also:

Aligns JDK and dep versions with every other hypertrace repo automatically.
Future Jetty / Netty / Kafka / etc. CVEs land via a one-line BOM bump in hypertrace-bom plus a regenerated lockfile — no per-repo coordination.
The update-locks.yml workflow propagates BOM updates without human action.

Test plan

./gradlew clean spotlessApply build passes locally with JAVA_HOME=$(/usr/libexec/java_home -v 21) (toolchain auto-provisions JDK 21 for compile / test).
All unit tests pass on all five modules.
Lockfiles regenerated cleanly via ./gradlew resolveAndLockAll --write-locks.
CI build & validate job passes.
CI test job (jacoco + report upload) passes.
CI dependency-check job passes — verify Jetty 12 has displaced Jetty 11 in the resolved graph and no high-CVSS CVEs remain.

🤖 Generated with Claude Code

github-actions · 2026-06-01T06:49:19Z

Test Results

15 files ±0 15 suites ±0 31s ⏱️ +2s
68 tests ±0 68 ✅ ±0 0 💤 ±0 0 ❌ ±0
86 runs ±0 86 ✅ ±0 0 💤 ±0 0 ❌ ±0

Results for commit 6f6f46a. ± Comparison against base commit 0aa8c44.

This pull request removes 5 and adds 5 tests. Note that renamed tests count towards both.

org.hypertrace.core.kafkastreams.framework.rocksdb.BoundedMemoryConfigSetterTest ‑ [1] {rocksdb.compaction.style=UNIVERSAL, rocksdb.compaction.universal.compression.size.percent=40, rocksdb.compaction.universal.max.size.amplification.percent=50, application.id=app-2, rocksdb.periodic.compaction.seconds=60}
org.hypertrace.core.kafkastreams.framework.rocksdb.BoundedMemoryConfigSetterTest ‑ [1] {rocksdb.write.buffer.size=8388608, rocksdb.direct.reads.enabled=true, rocksdb.max.write.buffers=2, rocksdb.compaction.style=LEVEL, application.id=app-1, rocksdb.log.level=INFO_LEVEL, rocksdb.compression.type=SNAPPY_COMPRESSION, rocksdb.block.size=8388608}
org.hypertrace.core.kafkastreams.framework.rocksdb.BoundedMemoryConfigSetterTest ‑ [2] {rocksdb.write.buffer.size=8388607, rocksdb.direct.reads.enabled=true, rocksdb.max.write.buffers=3, rocksdb.compaction.style=UNIVERSAL, application.id=app-2, rocksdb.log.level=DEBUG_LEVEL, rocksdb.compression.type=SNAPPY_COMPRESSION, rocksdb.block.size=8388609}
org.hypertrace.core.kafkastreams.framework.rocksdb.BoundedMemoryConfigSetterTest ‑ [3] {rocksdb.write.buffer.size=8388609, rocksdb.direct.reads.enabled=false, rocksdb.max.write.buffers=4, rocksdb.compaction.style=FIFO, application.id=app-3, rocksdb.log.level=ERROR_LEVEL, rocksdb.compression.type=SNAPPY_COMPRESSION, rocksdb.block.size=8388607}
org.hypertrace.core.kafkastreams.framework.rocksdb.BoundedMemoryConfigSetterTest ‑ [5] {rocksdb.cache.high.priority.pool.ratio=0.2, rocksdb.cache.write.buffers.ratio=0.9, application.id=app-5}

org.hypertrace.core.kafkastreams.framework.rocksdb.BoundedMemoryConfigSetterTest ‑ [1] {rocksdb.compaction.style=UNIVERSAL, rocksdb.periodic.compaction.seconds=60, application.id=app-2, rocksdb.compaction.universal.max.size.amplification.percent=50, rocksdb.compaction.universal.compression.size.percent=40}
org.hypertrace.core.kafkastreams.framework.rocksdb.BoundedMemoryConfigSetterTest ‑ [1] {rocksdb.log.level=INFO_LEVEL, application.id=app-1, rocksdb.compaction.style=LEVEL, rocksdb.max.write.buffers=2, rocksdb.direct.reads.enabled=true, rocksdb.write.buffer.size=8388608, rocksdb.block.size=8388608, rocksdb.compression.type=SNAPPY_COMPRESSION}
org.hypertrace.core.kafkastreams.framework.rocksdb.BoundedMemoryConfigSetterTest ‑ [2] {rocksdb.log.level=DEBUG_LEVEL, application.id=app-2, rocksdb.compaction.style=UNIVERSAL, rocksdb.max.write.buffers=3, rocksdb.direct.reads.enabled=true, rocksdb.write.buffer.size=8388607, rocksdb.block.size=8388609, rocksdb.compression.type=SNAPPY_COMPRESSION}
org.hypertrace.core.kafkastreams.framework.rocksdb.BoundedMemoryConfigSetterTest ‑ [3] {rocksdb.log.level=ERROR_LEVEL, application.id=app-3, rocksdb.compaction.style=FIFO, rocksdb.max.write.buffers=4, rocksdb.direct.reads.enabled=false, rocksdb.write.buffer.size=8388609, rocksdb.block.size=8388607, rocksdb.compression.type=SNAPPY_COMPRESSION}
org.hypertrace.core.kafkastreams.framework.rocksdb.BoundedMemoryConfigSetterTest ‑ [5] {application.id=app-5, rocksdb.cache.write.buffers.ratio=0.9, rocksdb.cache.high.priority.pool.ratio=0.2}

♻️ This comment has been updated with latest results.

…ty 12 (CVE-2026-2332) The current build pulls service-framework 0.1.89 (Jetty 11.0.24, vulnerable to CVE-2026-2332 / CVE-2025-5115). service-framework 0.1.94 migrates to Jetty 12.1.9 (ee10), which requires JDK 17+. - Bump source/target compatibility to Java 17 across all subprojects - Bump CI workflows to Java 17 - Bump platform-metrics + platform-service-framework 0.1.89 -> 0.1.94 - Bump grpc-client-utils 0.13.16 -> 0.13.23 (resolution conflict version) - Bump junit-pioneer 2.0.0 -> 2.3.0 and mockito-core 5.2.0 -> 5.15.2 for JDK 17+ reflection compat - Add --add-opens to test task for junit-pioneer @SetEnvironmentVariable on JDK 17+ Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

The shared hypertrace gradle GitHub action launches Gradle with JDK 11 on the runner. Setting source/target compatibility to 17 caused 'invalid source release: 17' on subprojects in the build job. Switching to a Java toolchain lets Gradle auto-provision and compile with JDK 17 regardless of the launcher JDK the action uses.

aaron-steinfeld · 2026-06-01T12:46:47Z

        with:
          distribution: 'temurin'
-          java-version: '11'
+          java-version: '17'


It's probably just as easy to standardize this repo to use the BOM and plugins, then the upgrades (And java 17) come for free.

Done — adopted shared BOM + plugins (, etc.) in 6f6f46a / 5da595c / f24e2ae. Updated PR title/description. Java 17 came along for free via toolchain default (now 21).

Done — adopted shared BOM + plugins (hypertrace.java-convention, hypertrace.repository, hypertrace.codestyle, etc.) across 6f6f46a / 5da595c / f24e2ae. Updated the PR title/description to reflect the new scope. Java 17 came along for free via the toolchain default (now 21).

Migrates the project to the canonical hypertrace pattern: the shared hypertrace-bom catalog drives common dep/plugin versions and the java-convention plugin standardizes JVM toolchain handling. Repo-local deps move to gradle/libs.versions.toml exposed as localLibs. - settings.gradle.kts: apply org.hypertrace.dependency-settings 0.2.0 with catalogVersion 0.3.80 (auto-registers commonLibs and localLibs) - gradle/libs.versions.toml: repo-local catalog (mockito, log4j, junit- pioneer, caffeine, avro, hypertrace-config-partitioner-api, grpc-netty, hypertrace-grpcutils-context, plus the avro plugin which is not in BOM) - build.gradle.kts: replace per-module hand-rolled plugin versions with alias(commonLibs.plugins.*); apply hypertrace.java-convention (toolchain 21 default, releaseCompatibility 11) so dep/JDK upgrades come for free via BOM bumps - Subprojects: rewrite to alias(commonLibs.*)/alias(localLibs.*) and add api(platform(commonLibs.hypertrace.bom)) for managed versions - Generate gradle.lockfile per module (settings-gradle.lockfile not tracked per the BOM doc) - Add .github/workflows/update-locks.yml: weekly schedule keeps locks in sync with newly published BOM versions - Bump pr-build/pr-test java-version 17 to 21 to match toolchain default

Both `hypertrace.framework.metrics` and `hypertrace.framework.metrics.jakarta` (and the same pair for `service`) resolve to the same underlying artifact in hypertrace-bom 0.3.80 — the `-jakarta` suffix is a transitional alias for the in-flight Jakarta EE migration. The unsuffixed names are clearer and self- explanatory; switch to those. No resolved-dependency change; lockfiles unchanged.

aaron-steinfeld

thanks for doing this!

aaron-steinfeld · 2026-06-01T13:22:36Z

        with:
          distribution: 'temurin'
-          java-version: '11'
+          java-version: '21'


FYI: no issue with changing this, but with the convention plugin the toolchains will govern the java version. At best, changing this may help caching (which is still important)

also you can keep at 17 if you want, the plugin just defaults to 21

Acknowledged — kept setup-java at 21 to match the convention plugin's toolchain default for cache hits. Per your follow-up, fine to keep at 17 too; flagged this as a no-op cosmetic if we want to flip back.

Noted — keeping at 21 for the moment to keep cache hits aligned with the convention default.

aaron-steinfeld · 2026-06-01T13:23:49Z

+kafka-streams-avro-serde = { module = "io.confluent:kafka-streams-avro-serde" }
+kafka-streams-test-utils = { module = "org.apache.kafka:kafka-streams-test-utils" }
+avro = { module = "org.apache.avro:avro" }
+hypertrace-grpcutils-context = { module = "org.hypertrace.core.grpcutils:grpc-context-utils", version.ref = "hypertrace-grpcutils" }


None of these are in the shared catalog? I would expect most would be (at least junit, mockito, grpc, avro and our own libs). If not, can move later. Omit the versions though, assuming they'd be governed by BOM.

Done in 6f6f46a — moved mockito-core, log4j-slf4j2-impl, grpc-netty, and hypertrace-grpcutils-context to commonLibs. Dropped versions on kafka-bom-managed entries (avro, kafka-streams-avro-serde, kafka-streams-test-utils). Kept in localLibs: junit-pioneer, caffeine, hamcrest-core, partitioner-config-service-api, and the avro plugin — these aren't in the shared catalog yet.

aaron-steinfeld · 2026-06-01T13:25:05Z

+[libraries]
+junit-pioneer = { module = "org.junit-pioneer:junit-pioneer", version.ref = "junit-pioneer" }
+mockito-core = { module = "org.mockito:mockito-core", version.ref = "mockito" }
+log4j-slf4j-impl = { module = "org.apache.logging.log4j:log4j-slf4j-impl", version.ref = "log4j" }


Careful on log4j, that should be the slf4j2 binding.

Good catch, fixed in 6f6f46a — switched to commonLibs.log4j.slf4j2.impl. Resolves to log4j-slf4j2-impl:2.25.4 (BOM-managed) instead of the slf4j-1.x binding.

- Move shared-catalog deps from localLibs to commonLibs: mockito-core, log4j-slf4j2-impl, grpc-netty, hypertrace-grpcutils-context. The BOM governs the versions there, so the local catalog only carries deps truly outside the shared catalog. - Switch the log4j binding to log4j-slf4j2-impl (the slf4j2 binding) per reviewer note — log4j-slf4j-impl was the slf4j-1.x binding and pulls in the wrong API. - Drop versions for kafka-bom-managed entries (avro, kafka-streams-avro- serde, kafka-streams-test-utils) — the kafka-bom platform constrains them. Lockfiles regenerated; resolved versions now follow the BOM (mockito 5.8.0, log4j-slf4j2-impl 2.25.4) instead of hand-pinned ones.

suresh-prakash force-pushed the pin-hypertrace-bom branch from 78dc7b6 to a0e37df Compare June 1, 2026 10:11

suresh-prakash force-pushed the pin-hypertrace-bom branch from a0e37df to 43cd165 Compare June 1, 2026 12:21

suresh-prakash changed the title ~~build: pin hypertrace-bom to 0.3.78 for JDK 11 compatibility~~ build: bump to JDK 17 and upgrade service-framework to 0.1.94 for Jetty 12 (CVE-2026-2332) Jun 1, 2026

suresh-prakash marked this pull request as ready for review June 1, 2026 12:24

suresh-prakash requested review from a team as code owners June 1, 2026 12:24

aaron-steinfeld reviewed Jun 1, 2026

View reviewed changes

suresh-prakash changed the title ~~build: bump to JDK 17 and upgrade service-framework to 0.1.94 for Jetty 12 (CVE-2026-2332)~~ build: adopt hypertrace shared BOM, version catalog, and java-convention plugin Jun 1, 2026

suresh-prakash requested a review from aaron-steinfeld June 1, 2026 13:20

aaron-steinfeld reviewed Jun 1, 2026

View reviewed changes

suresh-prakash requested a review from aaron-steinfeld June 1, 2026 13:54

aaron-steinfeld approved these changes Jun 1, 2026

View reviewed changes

avinashkolluru approved these changes Jun 2, 2026

View reviewed changes

avinashkolluru merged commit 94e63d8 into main Jun 2, 2026
5 checks passed

avinashkolluru deleted the pin-hypertrace-bom branch June 2, 2026 05:48

suresh-prakash mentioned this pull request Jun 2, 2026

Auto-size num.stream.threads from topology and replica count #119

Merged

11 tasks

Conversation

suresh-prakash commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Reference

Changes

Settings & catalogs

Root build

Subprojects

Lockfiles

CI workflows

Why this approach (vs. the original JDK 17 + service-framework bump)

Test plan

Uh oh!

github-actions Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aaron-steinfeld left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

suresh-prakash commented Jun 1, 2026 •

edited

Loading

github-actions Bot commented Jun 1, 2026 •

edited

Loading