TTRWRKS-19: Migrate report-service to Java 17 / Spring Boot 3.2

.github/workflows/ci.yml

@@ -316,7 +316,7 @@ jobs:
       - run: npm test || true
       - run: npm run build
 
-  # Java 8 / Maven - Report Service (LEGACY)
+  # Java 17 / Maven - Report Service
   report-service:
     needs: detect-changes
     if: needs.detect-changes.outputs.report-service == 'true'
@@ -329,10 +329,9 @@ jobs:
       - uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '8'
-      - run: mvn compile -B -q
-      - run: mvn test -B
-      - run: mvn package -DskipTests -B -q
+          java-version: '17'
+          cache: maven
+      - run: mvn -B verify
 
   # Java 11 / Maven - Legacy Portal. Uses the checked-in wrapper rather than the
   # runner's mvn: the portal builds on Spring Boot 2.x and pins its own Maven.

.github/workflows/docker-build.yml

@@ -54,7 +54,8 @@ jobs:
       - uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '8'
+          java-version: '17'
+          cache: maven
       - run: mvn test -B
 
   legacy-portal-tests:

README.md

@@ -54,9 +54,8 @@ make down
 | Analytics Service | Scala 3.4 | Akka HTTP | 8088 | Usage analytics, data aggregation |
 | Admin Service | Ruby 3.3 | Rails 7.1 | 8089 | Admin dashboard backend |
 | Audit Service | C# 12 | ASP.NET 8 | 8090 | Immutable audit trail, compliance |
-| Report Service *(legacy)* | Java 8 | Spring Boot 2.5 | 8091 | PDF/CSV/Excel report generation (tech-debt: upgrade target Java 17+, Spring Boot 3.2+) |
+| Report Service | Java 17 | Spring Boot 3.2 | 8091 | PDF/CSV/Excel report generation |
 
-> **Note:** The Report Service intentionally uses outdated dependencies (Java 8, Spring Boot 2.5, JUnit 4, javax.\*) and is a candidate for a framework-upgrade exercise. See `services/report-service/pom.xml` for details.
 
 ## Frontend Applications
 
@@ -170,7 +169,7 @@ otterworks/
 │   ├── analytics-service/ #   Scala / Akka HTTP
 │   ├── admin-service/     #   Ruby / Rails
 │   ├── audit-service/     #   C# / ASP.NET
-│   └── report-service/    #   Java 8 / Spring Boot 2.5 (legacy)
+│   └── report-service/    #   Java 17 / Spring Boot 3.2
 ├── frontend/              # Web app (React/Next.js) + Admin dashboard (Angular)
 ├── infrastructure/
 │   ├── terraform/         #   App-specific AWS resources (S3, RDS, DynamoDB, etc.)

docs/CI_STRATEGY.md

@@ -22,7 +22,7 @@ Uses `dorny/paths-filter` for **change detection** — only services with modifi
 | analytics-service | Scala/Java 17 (sbt) | `sbt compile`, `sbt test` | Passing |
 | admin-service | Ruby 3.3 (Rails) | `db:schema:load`, `rspec` (with Postgres service container) | **Fixed** (was failing due to missing `table_name`) |
 | audit-service | C# / .NET 8 | `dotnet restore`, `dotnet build`, `dotnet test` | Passing |
-| report-service | Java 8 (Maven) — **LEGACY** | `mvn compile`, `mvn test`, `mvn package` | Passing |
+| report-service | Java 17 (Maven) | `mvn verify` | Passing |
 | web-app | Node.js 20 (Next.js) | `npm ci`, `npm run lint`, `npm test`, `npm run build` | Passing |
 | admin-dashboard | Node.js 20 (Angular) | `npm ci`, `npm run lint \|\| true`, `npm test \|\| true`, `npm run build` | Passing |
 | infrastructure | Terraform 1.7 | `terraform fmt -check`, `terraform init`, `terraform validate` | Passing |
@@ -56,7 +56,7 @@ After PR #31 (this PR):
 ### Immediate (No Changes Required)
 1. **Change detection is working well** — Only affected services are built on PRs, keeping CI fast (~2-5 min per service vs 30+ min for full monorepo build).
 2. **Security scanning is comprehensive** — Trivy + Gitleaks + Semgrep covers dependencies, secrets, and static analysis.
-3. **Legacy service isolation** — Report service (Java 8) is correctly skipped by Trivy since it's intentionally outdated for upgrade exercises.
+3. **Legacy service isolation** — Report service is still skipped by Trivy; re-enabling it now that it runs on Java 17 / Spring Boot 3.2 is a follow-up.
 
 ### Short-Term Improvements
 1. **Add `concurrency` groups** to cancel stale CI runs when new commits are pushed:

docs/EVENT_DRIVEN_SECURITY.md

@@ -134,7 +134,7 @@ Required GitHub Actions secrets:
 |---------|-------|--------|
 | Trivy scanner | Trivy v0.62.2 | `.github/workflows/sast-auto-remediate.yml` |
 | Trivy severity filter | CRITICAL, HIGH | `SEVERITY_THRESHOLD` env var |
-| Trivy excluded dirs | `services/report-service` | Legacy Java 8 service (separate upgrade track) |
+| Trivy excluded dirs | `services/report-service` | Exclusion predates the Java 17 upgrade; re-enabling is a follow-up |
 | Trivy suppressions | `.trivyignore` | Acknowledged CVEs with documented justification |
 | SonarCloud project key | `Cognition-Partner-Workshops_otterworks` | `sonar-project.properties` |
 | SonarCloud org | `cognition-partner-workshops` | `sonar-project.properties` |
@@ -153,7 +153,7 @@ Required GitHub Actions secrets:
 | analytics-service | Scala 3.4 | `build.sbt` | sbt dependencies |
 | admin-service | Ruby 3.3 | `Gemfile` | Bundler gems |
 | audit-service | C# 12 | `AuditService.csproj` | NuGet packages |
-| report-service | Java 8 | `pom.xml` | **Excluded** (legacy upgrade track) |
+| report-service | Java 17 | `pom.xml` | **Excluded** (re-enable as follow-up) |
 
 ## Extending to Snyk
 

docs/SDLC-COVERAGE.md

@@ -53,7 +53,7 @@ documented in `README.md` (branch from `main`, open PR, CI must pass).
 `dorny/paths-filter` that fans out to **one job per service/language**, each running the idiomatic
 toolchain:
 - Go `go vet` + `go test -race` + build (`api-gateway`)
-- Java 17 `gradle check` (`auth-service`, `notification-service`), Java 8 `mvn` (`report-service`, legacy)
+- Java 17 `gradle check` (`auth-service`, `notification-service`), Java 17 `mvn` (`report-service`)
 - Rust `cargo fmt/clippy/test/build` (`file-service`)
 - Python `ruff` + `pytest --cov` (`document-service`, `search-service`)
 - Node `npm ci/lint/test/build` (`collab-service`, `web-app`)

docs/labs/security-sprint-guide.md

@@ -19,7 +19,7 @@ This runs four scan types in sequence:
 | pip-audit | search-service | Python dependency advisories |
 | bundle-audit | admin-service | Ruby gem advisories |
 
-**Note:** report-service is intentionally excluded from scans. It is a legacy Java 8 service earmarked for a separate framework upgrade exercise and is not in scope for this sprint.
+**Note:** report-service is intentionally excluded from scans and is not in scope for this sprint.
 
 ## Understanding Trivy Output
 

infrastructure/helm/report-service/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: report-service
-description: OtterWorks Report Service - Legacy Java 8/Spring Boot 2.5 report generation
+description: OtterWorks Report Service - Java 17/Spring Boot 3.2 report generation
 type: application
 version: 0.1.0
 appVersion: "0.1.0"

security/deps/expected/report-service.json

@@ -3,8 +3,8 @@
   "advisory": "CVE-2022-42889",
   "artifact": "org.apache.commons:commons-text",
   "cases_sha256": "ea3ac7b9e1fc1dc7049222d7b4157e34b435927389036138b00feaabb28f225c",
-  "recorded_at": "2026-08-17T22:51:46.629685+00:00",
-  "reason": "baseline: commons-text 1.9 behavior before CVE-2022-42889 remediation",
+  "recorded_at": "2026-09-01T18:19:13.042957+00:00",
+  "reason": "report-service now builds on JDK 17 (Spring Boot 3.2): Nashorn is absent, so the Text4Shell script lookup no longer resolves on commons-text 1.9",
   "cases": [
     {
       "id": "banner-title",
@@ -49,8 +49,9 @@
     },
     {
       "id": "attack-script-lookup",
-      "outcome": "ok",
-      "value": "7"
+      "outcome": "error",
+      "error_type": "java.lang.IllegalArgumentException",
+      "error_message": "Error in script engine [javascript] evaluating script [3+4]."
     },
     {
       "id": "attack-dns-lookup",

security/deps/modules.yaml

@@ -15,16 +15,18 @@
 # dependency tree, and the report names it. A module whose candidates all fail is
 # reported unmeasured. `test` is the arguments appended to the resolved tool.
 modules:
-  # Both Maven modules pin JDK 11: their recorded transcripts include the
+  # legacy-portal pins JDK 11: its recorded transcript includes the
   # ${script:javascript:...} lookup, which only resolves while the JVM still ships
   # Nashorn (JDK <= 14). Measured on a newer JDK the script case would report a
   # behavior change that never happened, so an absent JDK 11 must read as unmeasured.
+  # report-service builds on JDK 17 (Spring Boot 3.2) and cannot resolve Nashorn at
+  # all, so its script case is recorded as unresolved on 17.
   - id: report-service
     path: services/report-service
     build: maven
     java_home:
-      - $JAVA_HOME_11_X64
-      - /usr/lib/jvm/java-11-openjdk-amd64
+      - $JAVA_HOME_17_X64
+      - /usr/lib/jvm/java-17-openjdk-amd64
     # No wrapper in this module; the `mvn` on PATH is what ci.yml uses for it too.
     test: -B test
     cases: cases/report-service.json

services/report-service/Dockerfile

@@ -1,6 +1,5 @@
-# LEGACY: Uses JDK 8 (target: JDK 17+ or 21+)
-# Maven build instead of Gradle (matches legacy Java enterprise pattern)
-FROM maven:3.8.7-eclipse-temurin-8 AS builder
+# Maven build instead of Gradle (matches the Java enterprise pattern used here)
+FROM maven:3.9-eclipse-temurin-17 AS builder
 
 WORKDIR /app
 COPY pom.xml .
@@ -10,8 +9,7 @@ RUN mvn dependency:go-offline -B
 COPY src/ src/
 RUN mvn package -DskipTests -B
 
-# LEGACY: JRE 8 runtime (target: eclipse-temurin:17-jre or 21-jre)
-FROM eclipse-temurin:8-jre
+FROM eclipse-temurin:17-jre
 
 RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
 

services/report-service/pom.xml

@@ -7,9 +7,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <!-- LEGACY: Spring Boot 2.5.14 — last 2.5.x release. Upgrade target: 3.2+ -->
-        <!-- Pinned via 2.5.15 patch release pending security review; see internal ticket OW-4471 -->
-        <version>2.5.15</version>
+        <version>3.2.12</version>
         <relativePath/>
     </parent>
 
@@ -18,28 +16,17 @@
     <version>0.1.0</version>
     <packaging>jar</packaging>
     <name>OtterWorks Report Service</name>
-    <description>Legacy report generation service — PDF, CSV, Excel exports from analytics and audit data</description>
+    <description>Report generation service — PDF, CSV, Excel exports from analytics and audit data</description>
 
     <properties>
-        <!-- LEGACY: Java 8 source/target. Upgrade target: Java 17+ -->
-        <java.version>1.8</java.version>
-        <maven.compiler.source>1.8</maven.compiler.source>
-        <maven.compiler.target>1.8</maven.compiler.target>
+        <java.version>17</java.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
-        <!-- LEGACY: SpringFox 3.0 (dead project). Upgrade target: springdoc-openapi 2.x -->
-        <springfox.version>3.0.0</springfox.version>
-        <!-- LEGACY: Apache POI 4.1.2 (2020). Upgrade target: 5.2+ -->
+        <springdoc.version>2.5.0</springdoc.version>
         <poi.version>4.1.2</poi.version>
-        <!-- LEGACY: iText 5.5.13.3 (AGPL, pre-license-change). Upgrade target: OpenPDF or iText 7+ -->
         <itext.version>5.5.13.3</itext.version>
-        <!-- LEGACY: Commons Lang 2.6 (EOL). Upgrade target: commons-lang3 -->
-        <commons-lang.version>2.6</commons-lang.version>
-        <!-- LEGACY: Commons IO 2.6 (2018). Upgrade target: 2.15+ -->
         <commons-io.version>2.6</commons-io.version>
-        <!-- LEGACY: Guava 28.0 (2019, many CVEs). Upgrade target: 33+ -->
         <guava.version>28.0-jre</guava.version>
-        <!-- Commons Text 1.9 — report banner/footer interpolation -->
         <commons-text.version>1.9</commons-text.version>
     </properties>
 
@@ -66,12 +53,10 @@
             <artifactId>spring-boot-starter-actuator</artifactId>
         </dependency>
 
-        <!-- LEGACY: javax.servlet — removed in Jakarta EE 9+. Upgrade: jakarta.servlet -->
         <dependency>
-            <groupId>javax.servlet</groupId>
-            <artifactId>javax.servlet-api</artifactId>
-            <version>4.0.1</version>
-            <scope>provided</scope>
+            <groupId>jakarta.servlet</groupId>
+            <artifactId>jakarta.servlet-api</artifactId>
+            <scope>test</scope>
         </dependency>
 
         <!-- Database -->
@@ -80,15 +65,12 @@
             <artifactId>postgresql</artifactId>
             <scope>runtime</scope>
         </dependency>
-
-        <!-- LEGACY: SpringFox Swagger 2 (dead project, last release 2020) -->
         <dependency>
-            <groupId>io.springfox</groupId>
-            <artifactId>springfox-boot-starter</artifactId>
-            <version>${springfox.version}</version>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
         </dependency>
 
-        <!-- LEGACY: Apache POI 4.x for Excel generation -->
+        <!-- Apache POI for Excel generation -->
         <dependency>
             <groupId>org.apache.poi</groupId>
             <artifactId>poi</artifactId>
@@ -99,19 +81,22 @@
             <artifactId>poi-ooxml</artifactId>
             <version>${poi.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.springdoc</groupId>
+            <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
+            <version>${springdoc.version}</version>
+        </dependency>
 
-        <!-- LEGACY: iText 5 for PDF generation (AGPL license concerns) -->
+        <!-- iText 5 for PDF generation (AGPL license concerns; OpenPDF migration is a follow-up) -->
         <dependency>
             <groupId>com.itextpdf</groupId>
             <artifactId>itextpdf</artifactId>
             <version>${itext.version}</version>
         </dependency>
 
-        <!-- LEGACY: Commons Lang 2 (EOL since 2012) -->
         <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
-            <version>${commons-lang.version}</version>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
         </dependency>
 
         <!-- Commons Text — report banner and footer interpolation -->
@@ -121,59 +106,40 @@
             <version>${commons-text.version}</version>
         </dependency>
 
-        <!-- LEGACY: Commons IO 2.6 (outdated) -->
+        <!-- Commons IO -->
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
             <version>${commons-io.version}</version>
         </dependency>
 
-        <!-- LEGACY: Guava 28 (2019, multiple CVEs including DoS) -->
+        <!-- Guava -->
         <dependency>
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
             <version>${guava.version}</version>
         </dependency>
-
-        <!-- LEGACY: RestTemplate HTTP client (deprecated in favor of WebClient) -->
         <dependency>
-            <groupId>org.apache.httpcomponents</groupId>
-            <artifactId>httpclient</artifactId>
-            <version>4.5.13</version>
+            <groupId>org.apache.httpcomponents.client5</groupId>
+            <artifactId>httpclient5</artifactId>
         </dependency>
 
-        <!-- Observability (also legacy versions) -->
+        <!-- Observability -->
         <dependency>
             <groupId>io.micrometer</groupId>
             <artifactId>micrometer-registry-prometheus</artifactId>
         </dependency>
 
-        <!-- LEGACY: OpenCSV 4.6 (2018). Upgrade target: 5.9+ -->
+        <!-- OpenCSV -->
         <dependency>
             <groupId>com.opencsv</groupId>
             <artifactId>opencsv</artifactId>
             <version>4.6</version>
         </dependency>
-
-        <!-- Testing -->
-        <!-- LEGACY: JUnit 4 (not JUnit 5/Jupiter). Upgrade target: junit-jupiter -->
-        <dependency>
-            <groupId>junit</groupId>
-            <artifactId>junit</artifactId>
-            <version>4.13.2</version>
-            <scope>test</scope>
-        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
-            <!-- Exclude JUnit 5 to force JUnit 4 usage -->
-            <exclusions>
-                <exclusion>
-                    <groupId>org.junit.jupiter</groupId>
-                    <artifactId>junit-jupiter</artifactId>
-                </exclusion>
-            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.h2database</groupId>
@@ -183,7 +149,6 @@
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-core</artifactId>
-            <version>3.12.4</version>
             <scope>test</scope>
         </dependency>
     </dependencies>
@@ -198,17 +163,10 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.8.1</version>
                 <configuration>
-                    <source>1.8</source>
-                    <target>1.8</target>
+                    <release>${java.version}</release>
                 </configuration>
             </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-                <version>2.22.2</version>
-            </plugin>
         </plugins>
     </build>
 </project>

services/report-service/src/main/java/com/otterworks/report/ReportApplication.java

@@ -9,16 +9,9 @@
  * OtterWorks Report Service — generates PDF, CSV, and Excel reports
  * from analytics and audit data.
  *
- * LEGACY NOTES (tech debt for upgrade exercise):
- * - Java 8 runtime (target: Java 17+)
- * - Spring Boot 2.5.14 (target: Spring Boot 3.2+)
- * - javax.* namespace throughout (target: jakarta.*)
- * - WebSecurityConfigurerAdapter (removed in Spring Security 6)
- * - SpringFox Swagger 2 (dead project; target: springdoc-openapi)
- * - JUnit 4 tests (target: JUnit 5 Jupiter)
+ * REMAINING TECH DEBT (follow-ups):
  * - java.util.Date usage (target: java.time.*)
  * - RestTemplate (target: WebClient or RestClient)
- * - Commons Lang 2 (EOL; target: commons-lang3)
  * - iText 5 (AGPL license; target: OpenPDF or iText 7)
  * - Apache POI 4.x (target: 5.2+)
  * - Guava 28 (multiple CVEs; target: 33+)