Repository navigation
Update to Spring Boot 4.1.2 and drop fixture overrides it now covers - #259
Merged
Merged
Conversation
Bumps the maven-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [org.codehaus.plexus:plexus-archiver](https://github.com/codehaus-plexus/plexus-archiver) | `4.14.0` | `4.15.0` | | [com.github.siom79.japicmp:japicmp](https://github.com/siom79/japicmp) | `0.26.3` | `0.26.5` | | [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `2.22.3` | `2.22.4` | | [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.22.3` | `2.22.4` | | [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.6.0` | `3.6.1` | | [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.6.0` | `3.6.1` | | [org.springframework.boot:spring-boot-starter-parent](https://github.com/spring-projects/spring-boot) | `4.1.1` | `4.1.2` | Updates `org.codehaus.plexus:plexus-archiver` from 4.14.0 to 4.15.0 - [Release notes](https://github.com/codehaus-plexus/plexus-archiver/releases) - [Changelog](https://github.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md) - [Commits](codehaus-plexus/plexus-archiver@plexus-archiver-4.14.0...plexus-archiver-4.15.0) Updates `com.github.siom79.japicmp:japicmp` from 0.26.3 to 0.26.5 - [Release notes](https://github.com/siom79/japicmp/releases) - [Changelog](https://github.com/siom79/japicmp/blob/master/release.py) - [Commits](siom79/japicmp@japicmp-base-0.26.3...japicmp-base-0.26.5) Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.3 to 2.22.4 - [Commits](FasterXML/jackson-databind@jackson-databind-2.22.3...jackson-databind-2.22.4) Updates `com.fasterxml.jackson.core:jackson-core` from 2.22.3 to 2.22.4 - [Commits](FasterXML/jackson-core@jackson-core-2.22.3...jackson-core-2.22.4) Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.6.0 to 3.6.1 - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](apache/maven-surefire@surefire-3.6.0...surefire-3.6.1) Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.6.0 to 3.6.1 - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](apache/maven-surefire@surefire-3.6.0...surefire-3.6.1) Updates `org.springframework.boot:spring-boot-starter-parent` from 4.1.1 to 4.1.2 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](spring-projects/spring-boot@v4.1.1...v4.1.2) --- updated-dependencies: - dependency-name: org.codehaus.plexus:plexus-archiver dependency-version: 4.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: com.github.siom79.japicmp:japicmp dependency-version: 0.26.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: com.fasterxml.jackson.core:jackson-databind dependency-version: 2.22.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: com.fasterxml.jackson.core:jackson-core dependency-version: 2.22.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: org.apache.maven.plugins:maven-failsafe-plugin dependency-version: 3.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: org.apache.maven.plugins:maven-surefire-plugin dependency-version: 3.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: org.springframework.boot:spring-boot-starter-parent dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Boot 4.1.2 manages Tomcat 11.0.27, so the fixture's 11.0.26 override now downgrades Tomcat and fails RequireUpperBoundDeps. Its buildpack platform also brings Jackson 3.1.7, matching the plugin-realm pin, so remove the pin with its Dependabot rules and exact-version policy test as recorded in DEPENDENCY_DECISIONS.md. A policy test now guards against either override returning. Supersedes #256 and #257.
This was referenced Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This replaces #257 and #256.
It takes Dependabot's grouped update from #257 as is: Spring Boot 4.1.2 for the Jakarta fixture, Surefire/Failsafe 3.6.1, plexus-archiver 4.15.0, japicmp 0.26.5, and Jackson 2.22.4 for core tests and the publisher realm.
#257 failed because the fixture still pinned Tomcat to 11.0.26, older than the 11.0.27 that Boot 4.1.2 manages, and
RequireUpperBoundDepsrejected the downgrade. That override is removed.Boot 4.1.2's buildpack platform also brings Jackson 3.1.7, the same version as the plugin-realm pin. As planned in DEPENDENCY_DECISIONS.md, this removes the pin, its Dependabot ignore and group-exclusion rules, and the exact-version policy assertion together. A replacement policy test fails if either override returns. #256 (Jackson 3.1.8 for the pin) is no longer needed. No advisory affects 3.1.7.
Published library dependencies are unchanged.
Local verification:
python3 -m unittest discover -s scripts/tests: 36 tests pass./mvnw clean package -PtestJakarta -DskipTests: all enforcer rules pass./mvnw verify -pl core,jsp,jakartapasses. CI covers the Docker browser test.