Raise baseline Java version to 21

Signed-off-by: nscuro <[email protected]>

.github/workflows/_meta-build.yaml

@@ -34,7 +34,7 @@ jobs:
         uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # tag=v4.2.1
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
           cache: 'maven'
 
       - name: Setup CycloneDX CLI

.github/workflows/ci-release.yaml

@@ -57,7 +57,7 @@ jobs:
         uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # tag=v4.2.1
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
           cache: 'maven'
 
       - name: Set Version

.github/workflows/ci-test.yaml

@@ -39,7 +39,7 @@ jobs:
         uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # tag=v4.2.1
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
           cache: 'maven'
 
       - name: Execute unit tests

DEVELOPING.md

@@ -18,7 +18,7 @@ This document primarily covers the API server. Please refer to the frontend repo
 
 There are a few things you'll need on your journey:
 
-* JDK 17+ ([Temurin](https://adoptium.net/temurin/releases) distribution recommended)
+* JDK 21+ ([Temurin](https://adoptium.net/temurin/releases) distribution recommended)
 * Maven (comes bundled with IntelliJ and Eclipse)
 * A Java IDE of your preference (we recommend IntelliJ, but any other IDE is fine as well)
 * Docker (optional)

docs/_posts/2024-xx-xx-v4.12.0.md

@@ -0,0 +1,53 @@
+---
+title: v4.12.0
+type: major
+---
+
+**Features:**
+
+* Raise baseline Java version to 21 - [apiserver/#3682]
+
+**Fixes:**
+
+**Upgrade Notes:**
+
+* The API server now requires Java 21 or newer. Users deploying Dependency-Track via containers
+don't have to do anything, since those have been shipped with Java 21 since version 4.10.0.
+Users deploying Dependency-Track as JAR will need to upgrade their Java installation accordingly.
+
+For a complete list of changes, refer to the respective GitHub milestones:
+
+* [API server milestone 4.12.0](https://github.com/DependencyTrack/dependency-track/milestone/27?closed=1)
+* [Frontend milestone 4.12.0](https://github.com/DependencyTrack/frontend/milestone/21?closed=1)
+
+We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.
+
+Special thanks to everyone who contributed code to implement enhancements and fix defects:
+
+###### dependency-track-apiserver.jar
+
+| Algorithm | Checksum |
+|:----------|:---------|
+| SHA-1     |          |
+| SHA-256   |          |
+
+###### dependency-track-bundled.jar
+
+| Algorithm | Checksum |
+|:----------|:---------|
+| SHA-1     |          |
+| SHA-256   |          |
+
+###### frontend-dist.zip
+
+| Algorithm | Checksum |
+|:----------|:---------|
+| SHA-1     |          |
+| SHA-256   |          |
+
+###### Software Bill of Materials (SBOM)
+
+* API Server: [bom.json](https://github.com/DependencyTrack/dependency-track/releases/download/4.12.0/bom.json)
+* Frontend: [bom.json](https://github.com/DependencyTrack/frontend/releases/download/4.12.0/bom.json)
+
+[apiserver/#3682]: https://github.com/DependencyTrack/dependency-track/pull/3682

pom.xml

@@ -80,6 +80,10 @@
     </ciManagement>
 
     <properties>
+        <!-- Java Version -->
+        <maven.compiler.source>21</maven.compiler.source>
+        <maven.compiler.target>21</maven.compiler.target>
+
         <!-- Dependency Versions -->
         <frontend.version>4.11.0</frontend.version>
         <lib.alpine.version>${project.parent.version}</lib.alpine.version>

src/main/java/org/dependencytrack/tasks/NistApiMirrorTask.java

@@ -146,13 +146,12 @@ public void inform(final Event e) {
                 .namingPattern(getClass().getSimpleName() + "-%d")
                 .uncaughtExceptionHandler(new LoggableUncaughtExceptionHandler())
                 .build();
-        final var executor = new ThreadPoolExecutor(1, 1, 0L, TimeUnit.SECONDS, new LinkedBlockingQueue<>(), factory);
 
         final long startTimeNs = System.nanoTime();
         final var numMirrored = new AtomicInteger(0);
         ZonedDateTime lastModified;
         try (final NvdCveClient client = createApiClient(apiUrl, apiKey, lastModifiedEpochSeconds)) {
-            try {
+            try (final var executor = new ThreadPoolExecutor(1, 1, 0L, TimeUnit.SECONDS, new LinkedBlockingQueue<>(), factory)) {
                 while (client.hasNext()) {
                     for (final DefCveItem defCveItem : client.next()) {
                         final CveItem cveItem = defCveItem.getCve();
@@ -186,28 +185,6 @@ public void inform(final Event e) {
                         });
                     }
                 }
-            } finally {
-                // Copied from ExecutorService#close (available since JDK 19).
-                // This code can be replaced with try-with-resources after upgrade to Java 21.
-                // https://github.com/openjdk/jdk/blob/890adb6410dab4606a4f26a942aed02fb2f55387/src/java.base/share/classes/java/util/concurrent/ExecutorService.java#L410-L429
-                boolean terminated = executor.isTerminated();
-                if (!terminated) {
-                    executor.shutdown();
-                    boolean interrupted = false;
-                    while (!terminated) {
-                        try {
-                            terminated = executor.awaitTermination(1L, TimeUnit.DAYS);
-                        } catch (InterruptedException ex) {
-                            if (!interrupted) {
-                                executor.shutdownNow();
-                                interrupted = true;
-                            }
-                        }
-                    }
-                    if (interrupted) {
-                        Thread.currentThread().interrupt();
-                    }
-                }
             }
 
             lastModified = client.getLastUpdated();

src/test/java/org/dependencytrack/common/ManagedHttpClientFactoryTest.java

@@ -36,7 +36,7 @@ public class ManagedHttpClientFactoryTest {
 
     @Before
     public void before() {
-        environmentVariables.set("http_proxy", "http://acme\\username:[email protected]:1080");
+        environmentVariables.set("http_proxy", "http://acme%5Cusername:[email protected]:1080");
         environmentVariables.set("no_proxy", "localhost:443,127.0.0.1:8080,example.com,www.example.net");
     }