conductor-oss / conductor-oss/java-sdk
Upgrade Spring Boot to 3.4/3.5 and Jackson to 2.18.x
- Dominant language
- Java
- Stars
- 12
- Forks
- 10
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 4
Description
## Summary
The `conductor-client-spring` module currently pins Spring Boot to `3.3.0`. Spring Boot 3.3.x reached end-of-OSS-support in November 2024 and has known CVEs. Jackson is pinned to `2.17.1` across the project.
This issue tracks upgrading both to currently-supported versions.
## Scope
- [ ] Bump `spring-boot-starter` in `conductor-client-spring/build.gradle` from `3.3.0` → `3.4.x` or `3.5.x` (latest supported)
- [ ] Bump `jackson` version in `versions.gradle` from `2.17.1` → `2.18.x` (latest stable)
- [ ] Verify all modules build and tests pass after the upgrade
- [ ] Check for any API compatibility breaks between Spring Boot 3.3 → 3.4/3.5 affecting the SDK
## Context
- Spring Boot 3.3.x is EOL; open CVEs #84 and #85 are filed against it
- PR #86 bumps Spring Boot only to `3.3.11` (latest 3.3.x patch) — that is a stopgap, not the long-term fix
- Jackson 2.18.x is the current stable 2.x line; upgrading Spring Boot will also pull in a compatible Jackson via the BOM
- `jackson-module-afterburner` (currently used) was deprecated in Jackson 2.17 and removed in 2.18 — migration to `jackson-module-blackbird` will be required as part of this upgrade
## Migration note
`jackson-module-afterburner` → `jackson-module-blackbird` swap required in `build.gradle`:
```diff
-implementation "com.fasterxml.jackson.module:jackson-module-afterburner:${versions.jackson}"
+implementation "com.fasterxml.jackson.module:jackson-module-blackbird:${versions.jackson}"
```
Contributor guide
Assessment
This issue has not been assessed yet.