conductor-oss / conductor-oss/java-sdk

Upgrade Spring Boot to 3.4/3.5 and Jackson to 2.18.x

Open
#102 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
12
Forks
10
Avg merge
2d 8h
Merged PRs (30d)
4

Description

## Summary

The `conductor-client-spring` module currently pins Spring Boot to `3.3.0`. Spring Boot 3.3.x reached end-of-OSS-support in November 2024 and has known CVEs. Jackson is pinned to `2.17.1` across the project.

This issue tracks upgrading both to currently-supported versions.

## Scope

- [ ] Bump `spring-boot-starter` in `conductor-client-spring/build.gradle` from `3.3.0` → `3.4.x` or `3.5.x` (latest supported)
- [ ] Bump `jackson` version in `versions.gradle` from `2.17.1` → `2.18.x` (latest stable)
- [ ] Verify all modules build and tests pass after the upgrade
- [ ] Check for any API compatibility breaks between Spring Boot 3.3 → 3.4/3.5 affecting the SDK

## Context

- Spring Boot 3.3.x is EOL; open CVEs #84 and #85 are filed against it
- PR #86 bumps Spring Boot only to `3.3.11` (latest 3.3.x patch) — that is a stopgap, not the long-term fix
- Jackson 2.18.x is the current stable 2.x line; upgrading Spring Boot will also pull in a compatible Jackson via the BOM
- `jackson-module-afterburner` (currently used) was deprecated in Jackson 2.17 and removed in 2.18 — migration to `jackson-module-blackbird` will be required as part of this upgrade

## Migration note

`jackson-module-afterburner` → `jackson-module-blackbird` swap required in `build.gradle`:
```diff
-implementation "com.fasterxml.jackson.module:jackson-module-afterburner:${versions.jackson}"
+implementation "com.fasterxml.jackson.module:jackson-module-blackbird:${versions.jackson}"
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.