Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: updating tomcat version to v10.1.33 #3939

Closed
wants to merge 1 commit into from
Closed

chore: updating tomcat version to v10.1.33 #3939

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions gradle/versions.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ dependencyResolutionManagement {

version('springBoot', '3.3.5')
version('springBootGraphQl', '3.3.5')
version('springBootStarterTomcat', '3.3.6')
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we pin just one extra dependency for upgrade? Does it make sense to update the spring-boot-starter-web patch version rather than just one specific dependency? This way we would be pinning one dependency after another that would be difficult to manage.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it has 4 dependencies. 3 of them are tomcat and 1 is jakarta-annotations-api. all 3 tomcat dependencies need to be upgraded. I dont think there will be any issue in upgrading jakarta-annotations-api to latest version, it has no breaking changes or vulnerabilities in the latest version.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tomcat is a transitive dependency of spring-boot-starter-web. Why do we upgrade only the tomcat and not the whole spring-boot-starter-web (which is already 2 patches behind)?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

only tomcat is listed to be upgraded to this particular version for v3. its mentioned in the description of the task for dependency upgrade.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now I see, it was not clear which issue is the PR related to as there is no reference. Even though the task mentions tomcat specifically, we should bear in mind that spring dependencies are provided as versioned sets and are tested together. Mixing spring boot transitive dependencies across different versions may bring unexpected troubles because these combinations are not tested and not guaranteed by spring to work. Such request to update a specific transitive dependency should imply upgrade of the main package we depend on, unless there is very strong reason not to do so.

version('springCloudNetflix', '4.1.3')
version('springCloudCommons', '4.1.4')
version('springCloudCB', '3.1.2')
Expand Down Expand Up @@ -116,6 +117,7 @@ dependencyResolutionManagement {
library('spring_boot_starter_cache', 'org.springframework.boot', 'spring-boot-starter-cache').versionRef('springBoot')
library('spring_boot_starter_webflux', 'org.springframework.boot', 'spring-boot-starter-webflux').versionRef('springBoot')
library('spring_boot_starter_oauth2_client', 'org.springframework.boot', 'spring-boot-starter-oauth2-client').versionRef('springBoot')
library('spring_boot_starter_tomcat', 'org.springframework.boot', 'spring-boot-starter-tomcat').versionRef('springBootStarterTomcat')

library('spring_cloud_starter_eureka_client', 'org.springframework.cloud', 'spring-cloud-starter-netflix-eureka-client').versionRef('springCloudNetflix')
library('spring_cloud_starter_eureka_server', 'org.springframework.cloud', 'spring-cloud-starter-netflix-eureka-server').versionRef('springCloudNetflix')
Expand Down
Loading