authorjapps / authorjapps/zerocode

Question. Release candence of ZeroCode updating the currency of internal dependencies.

Open
#514 3 comments 0 reactions 0 assignees View on GitHub
not-an-issue question
Dominant language
Java
Stars
1k
Forks
453
Avg merge
7d 2h
Merged PRs (30d)
5

Description

Hi,
I work for Watson Health in IBM and we are reviewing ZeroCode for our requirements.

I have a question to your release cadence and your plans to keep the version of third party open source jars current. With critical issues often appearing in the third party supply chain, keeping current is important from a security stance and to allow ZeroCode to continue to work with other software, e.g. Spring Boot.

Do you plan to release new versions of ZeroCode moving to the most current version of dependent jars? If a request is made through this channel to update dependencies to the current version can you give an example of the timeline.

The status of the last releases here are not up-to-date [https://github.com/authorjapps/zerocode/wiki/Zerocode-release-frequency-and-schedule](https://github.com/authorjapps/zerocode/wiki/Zerocode-release-frequency-and-schedule)

[https://mvnrepository.com/artifact/org.jsmart/zerocode-tdd](https://mvnrepository.com/artifact/org.jsmart/zerocode-tdd) - 1 release in 2021.

Example of an issue I hit.
I tried to get ZeroCode to work with the latest Spring Boot version, version 2.6.3 . There is a clashing jar file version, the higher version of the jackson library 2.13.1 in Spring Boot 2.6.3 is not compatible with ZeroCode, you get an exception saying 'Step cannot be created.'. I can continue as I have removed Spring Boot from my spike of ZeroCode.

Example of dependencies for ZeroCode.
- jackson-dataformat-yaml-2.9.8.jar - Dec, 2018
- jackson-databind-2.10.0.jar - Sep, 2019

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.