Skip to content

chore: bump dependencies - #12770

Merged
daniel-kmiecik merged 7 commits into
masterfrom
bump-dependencies
Oct 21, 2026
Merged

daniel-kmiecik merged 7 commits into
masterfrom
bump-dependencies

Conversation

@daniel-kmiecik

@daniel-kmiecik daniel-kmiecik commented Oct 21, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Bumps Maven dependencies and plugins to their latest stable versions that are compatible with our Java 11 CI build. Plugin versions that were hardcoded across several poms are now centralized as *-version properties in the root pom.xml.

Bumped

Dependencies

  • jackson 2.21.2 → 2.22.4
  • commons-io 2.16.1 → 2.22.0
  • commons-cli 1.7.0 → 1.11.0
  • commons-lang3 3.18.0 → 3.21.0
  • snakeyaml 2.2 → 2.7
  • org.json 20231013 → 20260814
  • swagger-core / swagger-jersey2-jaxrs 1.6.14 → 1.6.16
  • testng 7.10.2 → 7.12.0
  • mockito 5.11.0 → 5.24.0
  • logback 1.5.32 → 1.6.5 (swagger-generator)
  • zip4j 2.11.5 → 2.11.6 (swagger-generator)
  • maven.version 3.9.5 → 3.10.0 (swagger-codegen-maven-plugin)

Plugins

  • compiler 3.16.0, jar 3.5.1, source 3.4.0, javadoc 3.12.0, jxr 3.6.0, project-info-reports 3.9.0
  • enforcer 3.6.3, gpg 3.2.8, build-helper 3.6.2, central-publishing 0.12.0
  • shade 3.6.2, war 3.5.1, failsafe 3.6.0, surefire 3.6.0
  • maven-plugin-plugin / maven-plugin-annotations 3.16.0
  • properties-maven-plugin 1.3.1, download-maven-plugin 1.13.0
  • exec-maven-plugin 3.6.4, site 3.22.0

I checked the bytecode level of the new jars. All are Java 11 compatible or lower.

Intentionally not bumped

Dependency Reason
jmockit 1.49 (1.50 available) 1.50 is compiled for Java 17 (class version 61). CI builds on Java 11, which fails with class file has wrong version 61.0, should be 55.0. 1.50 is also the last release, since the project is abandoned.
jmustache 1.15 (1.16 available) 1.16 changes template output and breaks CsharpClientGeneralEnumSupportIntegrationTest. Bumping needs a separate look at the rendering change and the expected files.
slf4j 1.7.36 (2.0.x available) Left as is on purpose, since 2.x changes how bindings are discovered.
jersey 3/4, jetty 11/12, jaxb 4 Require the javax → jakarta migration.
maven-release-plugin 3.x Affects the release process.
dependency-check-maven 6.5.3 → 13, scala-maven-plugin 3.x → 4.x Large jumps that may need configuration changes.
swagger-parser / swagger-core 2.x Only release candidates, and a different API.

##Surefire:
dropped the duplicate test-testng execution
Change: Removed the test-testng execution and the testNGArtifactName / junitArtifactName settings. A single default execution now runs both JUnit and TestNG tests. The jmockit -javaagent argLine is unchanged. Kept Surefire at 3.6.0 rather than reverting to 3.0.0.

PR checklist

  • Read the contribution guidelines.
  • Ran the shell script under ./bin/ to update Petstore sample so that CIs can verify the change. (For instance, only need to run ./bin/{LANG}-petstore.sh and ./bin/security/{LANG}-petstore.sh if updating the {LANG} (e.g. php, ruby, python, etc) code generator or {LANG} client's mustache templates). Windows batch files can be found in .\bin\windows\.
  • Filed the PR against the correct branch: 3.0.0 branch for changes related to OpenAPI spec 3.0. Default: master.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The broad upgrades need human compatibility validation, and the Surefire execution configuration needs migration before upgrading.

1 open issue
What changed in this PR

Updates Maven dependencies and build plugins across Swagger Codegen, with Java 11 compatibility as the stated goal.

Changes:

  • Bumps shared libraries and module-specific dependencies.
  • Centralizes shared plugin versions in root properties.
  • Updates compilation, testing, packaging, and publishing tools.
File Description
pom.xml Updates shared dependencies and centralizes plugin versions.
modules/​swagger-generator/​pom.xml Updates service dependencies and build plugins.
modules/​swagger-codegen/​pom.xml Updates execution, compilation, and reporting plugins.
modules/​swagger-codegen-maven-plugin/​pom.xml Updates Maven APIs and plugin tooling.
modules/​swagger-codegen-cli/​pom.xml Uses the centralized Shade plugin version.

Review effort: Balanced

Comment thread pom.xml

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Broad upgrades and test-provider changes need Java 11 CI validation confirming that both JUnit and TestNG suites still execute.

No open issues 🎉

1 resolved since last review

Review effort: Balanced

@daniel-kmiecik daniel-kmiecik changed the title chore: bump Maven dependencies chore: bump dependencies Oct 21, 2026
@daniel-kmiecik
daniel-kmiecik merged commit b971b58 into master Oct 21, 2026
13 checks passed
@daniel-kmiecik
daniel-kmiecik deleted the bump-dependencies branch October 21, 2026 12:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants