Merge pull request #1471 from msdousti/migration

Migration to Spring Boot 3

.mvn/extensions.xml

@@ -0,0 +1,10 @@
+<extensions xmlns="http://maven.apache.org/EXTENSIONS/1.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+            xsi:schemaLocation="http://maven.apache.org/EXTENSIONS/1.0.0 http://maven.apache.org/xsd/core-extensions-1.0.0.xsd">
+
+    <extension>
+        <groupId>org.apache.maven.extensions</groupId>
+        <artifactId>maven-build-cache-extension</artifactId>
+        <version>1.0.0</version>
+    </extension>
+
+</extensions>

.mvn/wrapper/maven-wrapper.properties

@@ -1,2 +1,18 @@
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.8.1/apache-maven-3.8.1-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.2/apache-maven-3.9.2-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar

MIGRATION.md

@@ -25,6 +25,15 @@ Here are some of the breaking changes that can affect `riptide-failsafe` users:
 Since Spring 5, `AsyncRestTemplate` is deprecated in favor of `WebClient`.
 For that reason, we have removed `AsyncHttpOperations` from `riptide-compatibility` layer.
 
+Since Spring 6, `AsyncRestTemplate` and all corresponding classes like `AsyncClientHttpRequestFactory` have been removed.
+For that reason, we have removed `NonBlockingIO` from `riptide-core` to avoid additionally migrating to `WebClient`.
+The same reason applies to the removal of `HttpOutputMessageAsyncClientHttpRequestAdapter` from `riptide-compatibility-layer`.
+
+## Apache HttpClient 5
+
+Apache HttpClient 5 removed the definition of whether a specific HTTP method is allowed to have a body or not. Due to
+this `StreamingApacheClientHttpRequest::setBody` will not throw an exception anymore.
+
 ## OpenTracing
 
 The `SpanDecorators` obtained by `ServiceLoaderSpanDecorator` 

cve-suppressions.xml

@@ -1,67 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-    <suppress>
-        <gav>org.slf4j:slf4j-api:1.7.25</gav>
-        <cve>CVE-2018-8088</cve>
-    </suppress>
 
-    <suppress>
-        <packageUrl regex="true">^pkg:maven/org\.springframework/spring\-.+@.*$</packageUrl>
-        <vulnerabilityName>CVE-2015-3192</vulnerabilityName>
-        <vulnerabilityName>CVE-2015-5211</vulnerabilityName>
-        <cve>CVE-2016-5007</cve>
-        <cve>CVE-2018-1270</cve>
-        <cve>CVE-2018-1271</cve>
-        <cve>CVE-2018-1272</cve>
-    </suppress>
-
-    <suppress>
-        <cve>CVE-2016-1000027</cve>
-        <cve>CVE-2019-12814</cve>
-        <cve>CVE-2020-5421</cve>
-        <cve>CVE-2020-7712</cve>
-        <cve>CVE-2020-9488</cve>
-        <cve>CVE-2020-10663</cve>
-        <cve>CVE-2022-22965</cve>
-        <cve>CVE-2022-38752</cve>
-        <cve>CVE-2022-38751</cve>
-        <cve>CVE-2022-38750</cve>
-        <cve>CVE-2022-25857</cve>
-        <cve>CVE-2022-38749</cve>
-	<cve>CVE-2021-37533</cve>
-	<cve>CVE-2022-41854</cve>
-	<cve>CVE-2022-1471</cve>
-	<cve>CVE-2021-4277</cve>
-	<cve>CVE-2022-3064</cve>
-	<cve>CVE-2021-4235</cve>
-	<cve>CVE-2022-45688</cve>
-        <cve>CVE-2020-8908</cve>
-    </suppress>
-
-    <!-- https://github.com/jeremylong/DependencyCheck/issues/1921 -->
-    <suppress>
-        <gav regex="true">org\.springframework\.boot:.+:2\.1\.5\.RELEASE</gav>
-        <cve>CVE-2011-2730</cve>
-        <cve>CVE-2013-4152</cve>
-        <cve>CVE-2013-6429</cve>
-        <cve>CVE-2013-7315</cve>
-        <cve>CVE-2014-0054</cve>
-    </suppress>
-
-    <!-- https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot -->
-    <suppress>
-        <cve>CVE-2021-44228</cve>
-        <cve>CVE-2021-45105</cve>
-        <cve>CVE-2021-45046</cve>
-        <cve>CVE-2021-44832</cve>
-    </suppress>
+    <!-- Please add CPE or link for each CVE you add -->
 
-    <!--TODO: disabled temporary to fix the build-->
     <suppress>
-        <cve>CVE-2023-20860</cve>
-        <cve>CVE-2023-20861</cve>
-        <cve>CVE-2023-20863</cve>
-        <cve>CVE-2023-1370</cve>
-        <cve>CVE-2023-20873</cve>
+        <!-- https://github.com/FasterXML/jackson-databind/issues/3972 -->
+        <cve>CVE-2023-35116</cve>
     </suppress>
 </suppressions>