Migrate report-service to Java 17 / Spring Boot 3.2 (TTRWRKS-17) by devin-ai-integration[bot] · Pull Request #268 · COG-GTM/otterworks

devin-ai-integration · 2026-09-01T00:15:12Z

Summary

Cuts services/report-service over from Java 8 / Spring Boot 2.5.15 to Java 17 / Spring Boot 3.2.12 (TTRWRKS-17). The bulk is OpenRewrite's UpgradeSpringBoot_3_2 recipe (javax.* → jakarta.*, JUnit 4 → 5, SpringFox → springdoc, HttpClient 4 → 5, Security 5 → 6 lambda DSL); the rest is the hand-fixing the recipe can't do:

Security 6 headers DSL — XXssConfig.block(boolean) no longer exists, and the recipe also nested contentTypeOptions() inside the frameOptions lambda:
```
.headers(h -> h
    .frameOptions(f -> f.deny())
    .contentTypeOptions(c -> {})
    .xssProtection(x -> x.headerValue(HeaderValue.ENABLED_MODE_BLOCK)))
```
Swagger matchers moved with it: /swagger-resources/**, /v2/api-docs/** → /swagger-ui.html, /v3/api-docs/**.
HttpClient 5 timeouts — HttpComponentsClientHttpRequestFactory.setReadTimeout(int) is gone in Spring 6; the socket timeout now lives on the pool via ConnectionConfig, and the connect timeout takes a Duration.
springdoc bean — the recipe deleted the SpringFox Docket but left apiInfo() orphaned and private; re-exposed as @Bean OpenAPI.
Dead config — dropped the SpringFox spring.mvc.pathmatch.matching-strategy=ant-path-matcher workaround and the explicit hibernate.dialect (Hibernate 6 auto-detects), and unquoted springdoc.packages-to-scan, which the recipe emitted with literal quotes.
Build hygiene — removed the recipe's redundant httpclient5.version / surefire pins now managed by the Boot parent.

CI: the report-service job in ci.yml moves from Temurin 8 (mvn compile/test/package) to Temurin 17 with maven caching and a single mvn -B verify; the report-service-tests gate in docker-build.yml moves to 17 as well. Dockerfile builder/runtime are maven:3.9-eclipse-temurin-17 / eclipse-temurin:17-jre.

Docs/comments that asserted "Java 8 / Spring Boot 2.5" (README service table, docs/CI_STRATEGY.md, docs/SDLC-COVERAGE.md, Helm chart description, .trivyignore, per-class "LEGACY PATTERNS" headers) are updated to the new baseline; remaining tech debt (iText 5, POI 4.x, Guava 28, Commons IO 2.6, java.util.Date) is left in place and noted as follow-up.

No modernization sweeps: no records/var, no JPMS, no --add-opens needed. Local mvn verify on JDK 17: 50 tests, 0 failures, 1 skipped.

Link to Devin session: https://app.devin.ai/sessions/b80d51a99d4a41e89ce4684e0b91e1c3
Open in Devin Desktop: https://app.devin.ai/desktop/session/b80d51a99d4a41e89ce4684e0b91e1c3?variant=devin

OpenRewrite UpgradeSpringBoot_3_2 plus manual fixes: Security 6 headers DSL, HttpClient 5 timeouts, springdoc OpenAPI bean, CI on Temurin 17.

devin-ai-integration · 2026-09-01T00:15:14Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

devin-ai-integration

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 5 potential issues.

devin-ai-integration · 2026-09-01T00:20:18Z

+                .sessionManagement(management -> management
+                        .sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests(requests -> requests
+                        .requestMatchers("/health", "/metrics", "/actuator/**").permitAll()


🟡 Report metrics remain uncollectable

requestMatchers permits /metrics, while Spring exposes metrics at /actuator/prometheus. The ServiceMonitor requests /metrics, so every Prometheus scrape receives 403.

Suggested change

.requestMatchers("/health", "/metrics", "/actuator/**").permitAll()

.requestMatchers("/health", "/actuator/**").permitAll()

Was this helpful? React with 👍 or 👎 to provide feedback.

Checked this — it's pre-existing, not something this migration changed, so I've left it alone.

origin/main already had .antMatchers("/health", "/metrics", "/actuator/**").permitAll() and already exposed health,info,prometheus; this PR only renames antMatchers → requestMatchers. The monitoring.path: /metrics in the Helm values is also unchanged here, and every other service chart in the repo (file-service, document-service, …) uses the same /metrics path. Note also that /metrics is permitted, not blocked — an unmapped permitted path returns 404, not 403, and /actuator/prometheus is reachable via the /actuator/** matcher.

So the ServiceMonitor path is a repo-wide charting question rather than a regression introduced by the Java 17 cutover; changing it here would be an out-of-scope behavioral change to Helm values that ship from upstream. Flagging as a follow-up instead.

devin-ai-integration · 2026-09-01T00:20:20Z

+        connectionManager.setDefaultConnectionConfig(ConnectionConfig.custom()
+                .setConnectTimeout(Timeout.ofMilliseconds(connectionTimeout))
+                .setSocketTimeout(Timeout.ofMilliseconds(readTimeout))
+                .build());

        CloseableHttpClient httpClient = HttpClients.custom()
                .setConnectionManager(connectionManager)
                .build();

        HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory(httpClient);
-        factory.setConnectTimeout(connectionTimeout);
-        factory.setReadTimeout(readTimeout);
+        factory.setConnectTimeout(Duration.ofMillis(connectionTimeout));


📝 Info: Timeout migration preserves both bounds

ConnectionConfig applies the 30-second socket timeout across pooled routes. The request factory retains the five-second connection timeout.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-09-01T00:20:21Z

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
-                <version>2.22.2</version>
            </plugin>


📝 Info: Converted tests still execute

Surefire selects JUnit Platform and runs all seven classes. The suite completes 50 tests, with only the opt-in transcript test skipped.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-09-01T00:20:23Z

+                .authorizeHttpRequests(requests -> requests
+                        .requestMatchers("/health", "/metrics", "/actuator/**").permitAll()
+                        .requestMatchers("/swagger-ui/**", "/swagger-ui.html", "/v3/api-docs/**").permitAll()
+                        .requestMatchers("/api/v1/reports/**").permitAll())


📝 Info: Unmatched requests remain denied

Omitting anyRequest preserves the restrictive fallback. Unmatched paths return 403, while every declared public route remains reachable.

Was this helpful? React with 👍 or 👎 to provide feedback.

…lusion The module no longer builds on JDK 11, and without Nashorn the script-lookup case errors instead of evaluating; baseline re-recorded for that case only.

Migrate report-service to Java 17 / Spring Boot 3.2

87aa0f3

OpenRewrite UpgradeSpringBoot_3_2 plus manual fixes: Security 6 headers DSL, HttpClient 5 timeouts, springdoc OpenAPI bean, CI on Temurin 17.

devin-ai-integration Bot requested a review from a team September 1, 2026 00:15

devin-ai-integration Bot commented Sep 1, 2026

View reviewed changes

Measure report-service deps harness on JDK 17; drop junit-jupiter exc…

b91f625

…lusion The module no longer builds on JDK 11, and without Nashorn the script-lookup case errors instead of evaluating; baseline re-recorded for that case only.

This comment was marked as resolved.

Sign in to view

Fix deps module comment to match the recorded JDK 17 script baseline

13ee1b5

Navigation Menu

Uh oh!

Migrate report-service to Java 17 / Spring Boot 3.2 (TTRWRKS-17) - #268

Migrate report-service to Java 17 / Spring Boot 3.2 (TTRWRKS-17)#268
devin-ai-integration[bot] wants to merge 3 commits into
mainfrom
devin/1788221527-java8-to-17-boot3

devin-ai-integration Bot commented Sep 1, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot commented Sep 1, 2026

Uh oh!

devin-ai-integration Bot left a comment •

edited

Loading

Uh oh!

devin-ai-integration Bot Sep 1, 2026

Uh oh!

devin-ai-integration Bot Sep 1, 2026

Uh oh!

Uh oh!

devin-ai-integration Bot Sep 1, 2026

Uh oh!

devin-ai-integration Bot Sep 1, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot Sep 1, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

	.requestMatchers("/health", "/metrics", "/actuator/**").permitAll()
	.requestMatchers("/health", "/actuator/**").permitAll()

Uh oh!

Conversation

devin-ai-integration Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

devin-ai-integration Bot commented Sep 1, 2026

🤖 Devin AI Engineer

Uh oh!

devin-ai-integration Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

devin-ai-integration Bot Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

devin-ai-integration Bot commented Sep 1, 2026 •

edited

Loading

devin-ai-integration Bot left a comment •

edited

Loading

devin-ai-integration Bot Sep 1, 2026 •

edited

Loading