Skip to content

Commit d37b2a1

Browse files
foman-chfoman-ch
authored
Merge pull request #183 from companieshouse/feature/JU-529-technical-debt
addressing java migration technical debt
2 parents 80a96c4 + f4b3265 commit d37b2a1

File tree

4 files changed

+78
-56
lines changed

4 files changed

+78
-56
lines changed

‎Makefile‎

Lines changed: 45 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,20 @@
11
artifact_name := orders.api.ch.gov.uk
22
version := "unversioned"
33

4+
dependency_check_base_suppressions:=common_suppressions_spring_6.xml
5+
6+
# dependency_check_suppressions_repo_branch
7+
# The branch of the dependency-check-suppressions repository to use
8+
# as the source of the suppressions file.
9+
# This should point to "main" branch when being used for release,
10+
# but can point to a different branch for experimentation/development.
11+
dependency_check_suppressions_repo_branch:=feature/suppressions-for-company-accounts-api
12+
13+
dependency_check_minimum_cvss := 4
14+
dependency_check_assembly_analyzer_enabled := false
15+
dependency_check_suppressions_repo_url:[email protected]:companieshouse/dependency-check-suppressions.git
16+
suppressions_file := target/suppressions.xml
17+
418
.PHONY: all
519
all: build
620

@@ -67,7 +81,35 @@ sonar:
6781
sonar-pr-analysis:
6882
mvn sonar:sonar -P sonar-pr-analysis
6983

84+
85+
.PHONY: dependency-check
86+
dependency-check:
87+
@ if [ -d "$(DEPENDENCY_CHECK_SUPPRESSIONS_HOME)" ]; then \
88+
suppressions_home="$${DEPENDENCY_CHECK_SUPPRESSIONS_HOME}"; \
89+
fi; \
90+
if [ ! -d "$${suppressions_home}" ]; then \
91+
suppressions_home_target_dir="./target/dependency-check-suppressions"; \
92+
if [ -d "$${suppressions_home_target_dir}" ]; then \
93+
suppressions_home="$${suppressions_home_target_dir}"; \
94+
else \
95+
mkdir -p "./target"; \
96+
git clone $(dependency_check_suppressions_repo_url) "$${suppressions_home_target_dir}" && \
97+
suppressions_home="$${suppressions_home_target_dir}"; \
98+
if [ -d "$${suppressions_home_target_dir}" ] && [ -n "$(dependency_check_suppressions_repo_branch)" ]; then \
99+
cd "$${suppressions_home}"; \
100+
git checkout $(dependency_check_suppressions_repo_branch); \
101+
cd -; \
102+
fi; \
103+
fi; \
104+
fi; \
105+
suppressions_path="$${suppressions_home}/suppressions/$(dependency_check_base_suppressions)"; \
106+
if [ -f "$${suppressions_path}" ]; then \
107+
cp -av "$${suppressions_path}" $(suppressions_file); \
108+
mvn org.owasp:dependency-check-maven:check -DfailBuildOnCVSS=$(dependency_check_minimum_cvss) -DassemblyAnalyzerEnabled=$(dependency_check_assembly_analyzer_enabled) -DsuppressionFiles=$(suppressions_file); \
109+
else \
110+
printf -- "\n ERROR Cannot find suppressions file at '%s'\n" "$${suppressions_path}" >&2; \
111+
exit 1; \
112+
fi
113+
70114
.PHONY: security-check
71-
security-check:
72-
mvn org.owasp:dependency-check-maven:update-only
73-
mvn org.owasp:dependency-check-maven:check -DfailBuildOnCVSS=4 -DassemblyAnalyzerEnabled=false
115+
security-check: dependency-check

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
API handling CRUD operations on CH Ordering Service
44

55
### Requirements
6-
* [Java 8][1]
6+
* [Java 21][1]
77
* [Maven][2]
88
* [Git][3]
99

@@ -28,6 +28,6 @@ API handling CRUD operations on CH Ordering Service
2828
| *`/orders/{orderId}/reprocess`* | POST | Triggers the re-processing of the order. |
2929
| *`/healthcheck`* | GET | Returns HTTP OK (`200`) to indicate a healthy application instance. |
3030

31-
[1]: http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html
31+
[1]: https://www.oracle.com/java/technologies/downloads/#java21
3232
[2]: https://maven.apache.org/download.cgi
3333
[3]: https://git-scm.com/downloads

‎pom.xml‎

Lines changed: 31 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>uk.gov.companieshouse</groupId>
88
<artifactId>companies-house-parent</artifactId>
9-
<version>2.1.5</version>
9+
<version>2.1.6</version>
1010
</parent>
1111
<artifactId>orders.api.ch.gov.uk</artifactId>
1212
<version>unversioned</version>
@@ -15,34 +15,34 @@
1515

1616
<properties>
1717
<maven.compiler.release>21</maven.compiler.release>
18-
<ch-kafka.version>3.0.1</ch-kafka.version>
19-
<kafka-models.version>3.0.7</kafka-models.version>
18+
<ch-kafka.version>3.0.3</ch-kafka.version>
19+
<kafka-models.version>3.0.8</kafka-models.version>
2020
<java.version>21</java.version>
21-
<structured-logging.version>3.0.3</structured-logging.version>
22-
<commons.lang.version>3.14.0</commons.lang.version>
21+
<structured-logging.version>3.0.9</structured-logging.version>
22+
<commons.lang.version>3.16.0</commons.lang.version>
2323
<commons.beanutils.version>1.9.4</commons.beanutils.version>
24-
<org.mapstruct.version>1.5.5.FINAL</org.mapstruct.version>
25-
<gson.version>2.10.1</gson.version>
26-
<hamcrest.version>2.2</hamcrest.version>
24+
<org.mapstruct.version>1.6.0</org.mapstruct.version>
25+
<gson.version>2.11.0</gson.version>
26+
<hamcrest.version>3.0</hamcrest.version>
2727
<!-- system-rules: 1.17.2 is the latest version that works with JUnit 5.
2828
See https://github.com/stefanbirkner/system-rules/issues/70 -->
2929
<system-rules-version>1.17.2</system-rules-version>
30-
<spring-cloud-contract-wiremock-version>4.1.1</spring-cloud-contract-wiremock-version>
30+
<spring-cloud-contract-wiremock-version>4.1.4</spring-cloud-contract-wiremock-version>
3131
<start-class>uk.gov.companieshouse.orders.api.OrdersApiApplication</start-class>
32-
<private-api-sdk-java.version>4.0.76</private-api-sdk-java.version>
32+
<private-api-sdk-java.version>4.0.99</private-api-sdk-java.version>
3333
<api-sdk-manager-java-library.version>3.0.5</api-sdk-manager-java-library.version>
3434
<api-sdk-java.version>6.0.9</api-sdk-java.version>
3535
<api-helper-java.version>3.0.1</api-helper-java.version>
36-
<api-security-java.version>2.0.0</api-security-java.version>
37-
<de-flapdoodle-embed-mongo.version>4.9.3</de-flapdoodle-embed-mongo.version>
38-
<wiremock-standalone.version>3.4.2</wiremock-standalone.version>
39-
<spring-boot-dependencies.version>3.2.4</spring-boot-dependencies.version>
40-
<spring-boot-maven-plugin.version>3.2.0</spring-boot-maven-plugin.version>
41-
<commons-compress.version>1.26.1</commons-compress.version>
42-
<maven-compiler-plugin.version>3.12.1</maven-compiler-plugin.version>
43-
<maven-surefire-plugin.version>3.2.5</maven-surefire-plugin.version>
44-
<http2-common.version>11.0.20</http2-common.version>
45-
<test-containers.version>1.19.7</test-containers.version>
36+
<api-security-java.version>2.0.6</api-security-java.version>
37+
<spring-boot-dependencies.version>3.3.2</spring-boot-dependencies.version>
38+
<spring-boot-maven-plugin.version>3.3.2</spring-boot-maven-plugin.version>
39+
<commons-compress.version>1.27.0</commons-compress.version>
40+
<maven-compiler-plugin.version>3.13.0</maven-compiler-plugin.version>
41+
<maven-surefire-plugin.version>3.3.1</maven-surefire-plugin.version>
42+
<http3-common.version>11.0.22</http3-common.version>
43+
<test-containers.version>1.20.1</test-containers.version>
44+
<jakarta.servlet-api.version>6.0.0</jakarta.servlet-api.version>
45+
<spring-kafka-test.version>3.2.2</spring-kafka-test.version>
4646
<!-- Docker -->
4747
<jib-maven-plugin.version>3.4.1</jib-maven-plugin.version>
4848

@@ -74,28 +74,27 @@
7474
<dependency>
7575
<groupId>org.springframework.boot</groupId>
7676
<artifactId>spring-boot-starter-actuator</artifactId>
77-
<version>3.2.4</version>
78-
</dependency>
79-
<dependency>
80-
<!--Overriding spring-web version to remove vulnerability-->
81-
<groupId>org.springframework</groupId>
82-
<artifactId>spring-web</artifactId>
83-
<version>6.1.6</version>
8477
</dependency>
8578
<dependency>
8679
<groupId>org.apache.commons</groupId>
8780
<artifactId>commons-compress</artifactId>
8881
<version>${commons-compress.version}</version>
8982
</dependency>
9083
<dependency>
91-
<groupId>org.eclipse.jetty.http2</groupId>
92-
<artifactId>http2-common</artifactId>
93-
<version>${http2-common.version}</version>
84+
<groupId>org.eclipse.jetty.http3</groupId>
85+
<artifactId>http3-common</artifactId>
86+
<version>${http3-common.version}</version>
87+
<exclusions>
88+
<exclusion>
89+
<groupId>org.mortbay.jetty.quiche</groupId>
90+
<artifactId>jetty-quiche-native</artifactId>
91+
</exclusion>
92+
</exclusions>
9493
</dependency>
9594
<dependency>
9695
<groupId>jakarta.servlet</groupId>
9796
<artifactId>jakarta.servlet-api</artifactId>
98-
<version>6.0.0</version>
97+
<version>${jakarta.servlet-api.version}</version>
9998
<scope>provided</scope>
10099
</dependency>
101100
<dependency>
@@ -197,7 +196,7 @@
197196
<groupId>org.springframework.kafka</groupId>
198197
<artifactId>spring-kafka-test</artifactId>
199198
<scope>test</scope>
200-
<version>3.0.13</version>
199+
<version>${spring-kafka-test.version}</version>
201200
<exclusions>
202201
<exclusion>
203202
<groupId>org.pcollections</groupId>

‎suppress.xml‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

0 commit comments

Comments
 (0)