From 59292ec43664bf0a23569e6a7c06bd66023547a8 Mon Sep 17 00:00:00 2001 From: Hendrik Ebbers Date: Thu, 10 Sep 2026 19:39:48 +0200 Subject: [PATCH 1/2] chore: update java-parent to 1.3.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three things arrive with the new parent, and each has a consequence here. **project.build.outputTimestamp is now fixed centrally** (2026-09-10T00:00:00Z, a literal in the published POM, rewritten by release.sh per release). This is what docs/TODO.md tracked as "in progress separately" and what spec 018's design listed as a prerequisite; both are updated to say it shipped. Verified rather than assumed: the reactor was built twice and the artifact checksums compared — byte-identical. **The OpenAPI stack is now BOM-managed**, so the local swagger-annotations-jakarta.version property (2.2.29) is dropped and the explicit in spring-services-core removed. swagger-annotations-jakarta now resolves to 2.2.47 through the parent's swagger-bom import. This is not cosmetic: the parent warns that a split Swagger stack throws NoSuchMethodError at runtime, because swagger-core calls annotation members that only exist in its own release. Pinning our own version while the org standard moves on recreates exactly that hazard for any consumer that also pulls springdoc. **Spotless is configured with UNIX**, which the parent notes only takes full effect if the child carries a .gitattributes — otherwise Git checks files out per the local core.autocrlf and a Windows build produces a sources jar with CRLF, breaking reproducibility. Added one; it is diff-neutral today, since no tracked file currently contains CRLF. Verified: full reactor build green, 134 tests, no failing test class. spotless:check reports the same three pre-existing violations as on main (test files under com.example.app) — the new parent adds none, and they are left for a separate, formatting-only change. Co-Authored-By: Claude Opus 5 (1M context) --- .gitattributes | 17 +++++++++++++++++ docs/TODO.md | 11 ++++++++--- docs/specs/018-application-build-info/design.md | 2 +- pom.xml | 3 +-- spring-services-core/pom.xml | 3 ++- 5 files changed, 29 insertions(+), 7 deletions(-) create mode 100644 .gitattributes diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..1d51036 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,17 @@ +# Normalise line endings for every text file in the repository. +# +# java-parent 1.3.0 configures Spotless with UNIX, which makes the +# formatter's output independent of the developer's platform and Git configuration. That alone does +# not make the published sources jar LF-clean — Git still checks files out according to the local +# core.autocrlf — so the parent expects each child project to carry this file. Without it a build on +# Windows produces a sources jar with CRLF and the release stops being byte-reproducible. +* text=auto eol=lf + +# Binary files Git must never touch. +*.jar binary +*.png binary +*.jpg binary +*.jpeg binary +*.gif binary +*.ico binary +*.pdf binary diff --git a/docs/TODO.md b/docs/TODO.md index d5f2bfc..9a23762 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -374,8 +374,11 @@ Micrometer into every consuming application now. Spec 018 reads three files that no Open Elements build currently produces. The wiring is a `java-parent` concern plus one line per application repository: -- `project.build.outputTimestamp` fixed in `java-parent` — **in progress separately**; without it - no Maven build in the org is byte-reproducible, independent of spec 018. +- ~~`project.build.outputTimestamp` fixed in `java-parent`~~ — **done**: shipped in + `java-parent` 1.3.0 as the literal `2026-09-10T00:00:00Z`, and this reactor is on it. Verified by + building the reactor twice and comparing artifact checksums: byte-identical. The parent's comment + states it explicitly — the value is *not* a build time, it identifies the `java-parent` release an + artifact was built against; `release.sh` rewrites it per release. - `spring-boot-maven-plugin:build-info` in `java-parent`'s `pluginManagement`, with `additionalProperties` carrying `commit`, activated per application. - `cyclonedx-maven-plugin` output redirected to @@ -390,4 +393,6 @@ sit in an application-level activation, never in a profile shared with library m trap that already forced `generateGitPropertiesFile=false` in `java-parent`'s `full-build` profile. **Context:** Surfaced during the `/grill-me` for spec 018; deferred because `java-parent` is a -separate repository and its `outputTimestamp` change is already being made in parallel. +separate repository. Its `outputTimestamp` part has since landed (1.3.0, 2026-09-10); the remaining +bullets — `build-info`, the SBOM output path and `ARG GIT_COMMIT` in the application Dockerfiles — +are still open, and they are what spec 018 actually needs in order to read anything. diff --git a/docs/specs/018-application-build-info/design.md b/docs/specs/018-application-build-info/design.md index a57db5c..fe8c3f8 100644 --- a/docs/specs/018-application-build-info/design.md +++ b/docs/specs/018-application-build-info/design.md @@ -340,7 +340,7 @@ the model to be populated. It belongs in `java-parent` and in the application re | Requirement | Where | |---|---| -| `project.build.outputTimestamp` set to a fixed value | `java-parent` (in progress, separately) | +| `project.build.outputTimestamp` set to a fixed value | `java-parent` — **shipped in 1.3.0** (`2026-09-10T00:00:00Z`) | | `spring-boot-maven-plugin:build-info` in `pluginManagement`, with `additionalProperties` carrying `commit` | `java-parent`, activated per application | | `cyclonedx-maven-plugin` output to `${project.build.outputDirectory}/META-INF/sbom/application.cdx.json` | `java-parent`, activated per application | | `ARG GIT_COMMIT` in the Dockerfile, passed to Maven | each application repository | diff --git a/pom.xml b/pom.xml index 45aadf9..2b5541c 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ com.open-elements java-parent - 1.2.1 + 1.3.0 spring-services @@ -54,7 +54,6 @@ 1.45.3 - 2.2.29 1.0.0 2.0.5 3.10.0 diff --git a/spring-services-core/pom.xml b/spring-services-core/pom.xml index 0936be8..1ff9cb8 100644 --- a/spring-services-core/pom.xml +++ b/spring-services-core/pom.xml @@ -36,9 +36,10 @@ spring-boot-starter-oauth2-resource-server + io.swagger.core.v3 swagger-annotations-jakarta - ${swagger-annotations-jakarta.version} org.jspecify From 698b4b2a84cfd25bd07cd4a45b66023455bf4936 Mon Sep 17 00:00:00 2001 From: Hendrik Ebbers Date: Thu, 10 Sep 2026 19:48:05 +0200 Subject: [PATCH 2/2] chore: drop the two version properties java-parent 1.3.0 manages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Checked all five remaining properties in the reactor POM against the parent's dependencyManagement and against their actual usage here: | Property | managed by parent | referenced here | verdict | | --- | --- | --- | --- | | jspecify.version | yes (org.jspecify:jspecify 1.0.0) | core/pom.xml | removed | | testcontainers.version | yes (testcontainers-bom import) | nowhere | removed | | slack-api-client.version | no | slack | kept | | wiremock.version | no | core, dbbackup, search | kept | | mcp-sdk.version | no | mcp (2x) | kept | testcontainers.version was not merely dead: a property of that name in this POM shadows the parent's, and the parent's BOM import resolves through it. Both sat at 2.0.5, so the effect was invisible — but the next testcontainers bump in java-parent would have been silently pinned back to the old version by a value nobody remembers maintaining. jspecify had the same shape, plus an explicit in spring-services-core that is now gone as well. The remaining three stay, and the comment above them now says why: they are the versions the parent does not manage, and redefining a parent-managed property here is the trap to avoid. Verified: jspecify still resolves to 1.0.0, testcontainers to 2.0.5 (all five artifacts across core and scim), swagger-annotations-jakarta to 2.2.47. Full reactor build green, 134 tests. Co-Authored-By: Claude Opus 5 (1M context) --- pom.xml | 8 +++++--- spring-services-core/pom.xml | 3 +-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/pom.xml b/pom.xml index 2b5541c..45af940 100644 --- a/pom.xml +++ b/pom.xml @@ -51,11 +51,13 @@ spring-services-bom - + 1.45.3 - 1.0.0 - 2.0.5 3.10.0 0.18.3 diff --git a/spring-services-core/pom.xml b/spring-services-core/pom.xml index 1ff9cb8..e71de58 100644 --- a/spring-services-core/pom.xml +++ b/spring-services-core/pom.xml @@ -41,11 +41,10 @@ io.swagger.core.v3 swagger-annotations-jakarta + org.jspecify jspecify - ${jspecify.version} - compile