Spring upgrade org.springframework.boot from 3.3.6 to 3.5.7 by kevinfiol · Pull Request #9253 · CDCgov/prime-simplereport

kevinfiol · 2025-10-30T18:21:21Z

BACKEND PULL REQUEST

Related Issue

Resolves #9081

Stay up to date with the latest dependencies to ensure strong security and paying down tech debt

Changes Proposed

I updated to 3.5.7 as that was the latest patch version.
Gradle has been upgraded to a compatible version 8.14.3
MockBean and SpyBean have been deprecated, and migrated to their Mockito equivalents in our backend tests
Pinned dependency versions were updated by following versions specified in https://docs.spring.io/spring-boot/appendix/dependency-versions/coordinates.html

Additional Information

spring-boot-starter-test through org.skyscreamer:jsonassert:1.5.3 depends on com.vaadin.external.google:android-json, which seems like a version of org.json that was extracted from Android for general use.

We explicitly depend on org.json:json:20250517, which results in this warning when running tests:

Found multiple occurrences of org.json.JSONObject on the class path:

	jar:file:/home/kevin/.gradle/caches/modules-2/files-2.1/org.json/json/20250517/d67181bbd819ccceb929b580a4e2fcb0c8b17cd8/json-20250517.jar!/org/json/JSONObject.class
	jar:file:/home/kevin/.gradle/caches/modules-2/files-2.1/com.vaadin.external.google/android-json/0.0.20131108.vaadin1/fa26d351fe62a6a17f5cda1287c1c6110dec413f/android-json-0.0.20131108.vaadin1.jar!/org/json/JSONObject.class

The story seems to be that org.json at one point had an ambiguous license with the restriction "The software shall be used for good, not evil.". So JSONAssert and other framework authors moved away from org.json. However, since 2023, org.json removed that license and simply claims "Public Domain". Now it's just a matter of time until spring-boot-starter-test updates to JSONAssert 2.0, which re-includes org.json.

TLDR: We don't need to do anything here.

See:
spring-projects/spring-boot#41201
spring-projects/spring-boot#47385
skyscreamer/JSONassert#194

Testing

Run ./gradlew clean && ./gradlew build --refresh-dependencies locally
Run backend tests locally

kevinfiol · 2025-11-06T19:02:00Z

+    liquibase.setContexts(StringUtils.collectionToCommaDelimitedString(properties.getContexts()));
    liquibase.setDataSource(dataSource);
    liquibase.setDefaultSchema(properties.getDefaultSchema());
    liquibase.setDropFirst(properties.isDropFirst());
-    liquibase.setLabelFilter(properties.getLabelFilter());
+    liquibase.setLabelFilter(
+        StringUtils.collectionToCommaDelimitedString(properties.getLabelFilter()));


These now only take in a string, which can accept a CSV liquibase/liquibase#6534

schreiaj

Would like to see clarification about why the changes in backend/src/test/java/gov/cdc/usds/simplereport/integration/SubmitTestResultIntegrationTest.java and backend/src/test/java/gov/cdc/usds/simplereport/integration/SubmitTestResultTestConfig.java were made here in the PR, but otherwise LGTM.

schreiaj · 2025-11-07T00:04:50Z


  @Test
  void complete_submit_test_result_flow() throws IOException {
+    Date date = Date.from(Instant.parse("2023-05-24T19:33:06.472Z"));


What prompted this change? This seems to be new logic in a test or at least moving it from another file?

Yeah, this was moved from SubmitTestResultTestConfig.java in order to use MockitoBeans and to fix this failing test.

Someone with more Java/Mockito/Bean knowledge may be able to explain this better, but from my understanding: MockitoBeans behave slightly differently from MockBeans in that setting dateGenerator and uuidGenerator as MockitoBeans in the test config would not initialize them on time for when the fhirQueueReportingService Bean is finally used by this test. As a result, this test would fail because the dateGenerator and uuidGenerator would be null when they are called further down the call stack.

The work around is to set and initialize them locally in the test case, and pass them to fhirQueueReportingService when it's finally called.

DavidMcClatchey

LGTM - the code, tests, and build+run 🚀 🚀 🚀

DanielSass · 2025-11-10T16:35:15Z

+    testImplementation 'org.mockito:mockito-core'
+    testImplementation 'org.mockito:mockito-junit-jupiter'
+    testImplementation 'org.junit.jupiter:junit-jupiter'
+    testImplementation 'com.fasterxml.jackson.core:jackson-databind'
+
    // used to autoconfigure WireMock for testing


we're we not pulling in mockito explicitly before?
edit: I guess this is a stupid question

If I remember correctly, there was a change in transitive dependencies in spring-boot-starter-test between upgrades that required this.

DanielSass

🚀

DavidMcClatchey · 2025-11-10T18:12:15Z

I think we could add the Resolves tag for this one too if we're including the latest from gradle: #9245

DanielSass · 2025-11-10T18:14:30Z

re: upgrading gradle

It looks like the jump to 9.x is breaking. I would be more comfortable if we highest version of 8.x and address upgrading gradle in a separate PR (regardless of the breaking build)

This reverts commit e28b370.

sonarqubecloud · 2025-11-10T18:33:16Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

DanielSass

🚢

kevinfiol added 10 commits October 30, 2025 14:20

upgrade to 3.4

ed8a75a

update to 3.4

607f14e

update gradle in dockerfiles

aeeaa57

wip

667599e

remove comments

990fa4f

upgrade to 3.5.7

0434ad1

remove deprecated mock tools

e1d653d

merge main and resolve conflicts

702e5f8

fix tests

1e3a113

fix tests

2c73333

kevinfiol marked this pull request as ready for review November 6, 2025 15:38

kevinfiol requested review from a team as code owners November 6, 2025 15:38

kevinfiol requested review from DanielSass, DavidMcClatchey, mpbrown and schreiaj and removed request for a team November 6, 2025 15:39

kevinfiol changed the title ~~Spring upgrade org.springframework.boot from 3.3.6 to 3.5.4~~ Spring upgrade org.springframework.boot from 3.3.6 to 3.5.7 Nov 6, 2025

kevinfiol commented Nov 6, 2025

View reviewed changes

schreiaj previously approved these changes Nov 7, 2025

View reviewed changes

DavidMcClatchey previously approved these changes Nov 7, 2025

View reviewed changes

DanielSass reviewed Nov 10, 2025

View reviewed changes

Comment thread backend/gradle/wrapper/gradle-wrapper.properties

DanielSass reviewed Nov 10, 2025

View reviewed changes

DanielSass previously approved these changes Nov 10, 2025

View reviewed changes

update gradle to 9.2.0

e28b370

kevinfiol dismissed stale reviews from DanielSass and DavidMcClatchey via e28b370 November 10, 2025 17:19

kevinfiol dismissed schreiaj’s stale review via e28b370 November 10, 2025 17:19

kevinfiol added 2 commits November 10, 2025 13:19

Revert "update gradle to 9.2.0"

beff8be

This reverts commit e28b370.

gradle 8.14.3

95b6ca0

DavidMcClatchey approved these changes Nov 10, 2025

View reviewed changes

DanielSass approved these changes Nov 10, 2025

View reviewed changes

kevinfiol added this pull request to the merge queue Nov 10, 2025

Merged via the queue into main with commit 289ff9b Nov 10, 2025
35 checks passed

kevinfiol deleted the kf/upgrade-spring-boot-354 branch November 10, 2025 18:54

Conversation

kevinfiol commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

BACKEND PULL REQUEST

Related Issue

Changes Proposed

Additional Information

Testing

Uh oh!

kevinfiol Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

schreiaj left a comment

Choose a reason for hiding this comment

Uh oh!

schreiaj Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

kevinfiol Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DavidMcClatchey left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

DanielSass Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kevinfiol Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

DanielSass left a comment

Choose a reason for hiding this comment

Uh oh!

DavidMcClatchey commented Nov 10, 2025

Uh oh!

DanielSass commented Nov 10, 2025

Uh oh!

sonarqubecloud Bot commented Nov 10, 2025

Quality Gate passed

Uh oh!

DanielSass left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kevinfiol commented Oct 30, 2025 •

edited

Loading

kevinfiol Nov 7, 2025 •

edited

Loading

DanielSass Nov 10, 2025 •

edited

Loading