authorjapps / authorjapps/zerocode
Question. Release candence of ZeroCode updating the currency of internal dependencies.
- Dominant language
- Java
- Stars
- 1k
- Forks
- 453
- Avg merge
- 7d 2h
- Merged PRs (30d)
- 5
Description
Hi,
I work for Watson Health in IBM and we are reviewing ZeroCode for our requirements.
I have a question to your release cadence and your plans to keep the version of third party open source jars current. With critical issues often appearing in the third party supply chain, keeping current is important from a security stance and to allow ZeroCode to continue to work with other software, e.g. Spring Boot.
Do you plan to release new versions of ZeroCode moving to the most current version of dependent jars? If a request is made through this channel to update dependencies to the current version can you give an example of the timeline.
The status of the last releases here are not up-to-date [https://github.com/authorjapps/zerocode/wiki/Zerocode-release-frequency-and-schedule](https://github.com/authorjapps/zerocode/wiki/Zerocode-release-frequency-and-schedule)
[https://mvnrepository.com/artifact/org.jsmart/zerocode-tdd](https://mvnrepository.com/artifact/org.jsmart/zerocode-tdd) - 1 release in 2021.
Example of an issue I hit.
I tried to get ZeroCode to work with the latest Spring Boot version, version 2.6.3 . There is a clashing jar file version, the higher version of the jackson library 2.13.1 in Spring Boot 2.6.3 is not compatible with ZeroCode, you get an exception saying 'Step cannot be created.'. I can continue as I have removed Spring Boot from my spike of ZeroCode.
Example of dependencies for ZeroCode.
- jackson-dataformat-yaml-2.9.8.jar - Dec, 2018
- jackson-databind-2.10.0.jar - Sep, 2019
Contributor guide
Assessment
This issue has not been assessed yet.