Repository navigation
Tags: openrewrite/rewrite-third-party
Tags
Convert jackson-databind and httpcore5 version pins to floor-only con… …straints (#93) * Convert jackson-databind and httpcore5 version pins to floor-only constraints * Also constrain `provided`, and declare the floors inline Constraints on `implementation` do not reach `provided`, which extends nothing; `dependencyInsight --configuration provided` resolved jackson-databind 2.17.3, so the CVE floor was missing on the very configuration the shaded recipe libraries are declared on, and the one dependency-check scans. The `resolutionStrategy` hook this replaced had covered it. Drop the `cliCompatImplementation` entry: the suite depends on `project` and inherits the floors through its runtimeElements variant, so it still resolves 2.21.5 by constraint, and naming the configuration forced the lazily-registered cliCompat test suite to be realized on every configuration phase.
Fix CVE-2026-54399: force httpcore5 group to 5.4.3 (#86) Refs moderneinc/dependency-vulnerability-reports#1121
Shade AWS SDK supporting modules into the fat jar (#82) PR #81 moved the shaded recipe libraries to provided scope so consumers no longer re-resolve a second standalone copy of their category descriptors. For software.amazon.awssdk:v2-migration this also dropped its supporting modules (utils, sdk-core, auth, aws-core, http-client-spi, regions) from consumers' runtime classpaths, since provided dependencies are not resolved transitively. The shadowJar only bundled the top-level v2-migration artifact, so its recipe classes were left referencing classes that are no longer present. This surfaced as a NoClassDefFoundError for software.amazon.awssdk.utils.ImmutableMap when initializing software.amazon.awssdk.v2migration.V1SetterToV2, e.g. when the rewrite-recipe-markdown-generator lists recipe descriptors. Broaden the shadowJar include to the whole software.amazon.awssdk group so the fat jar is self-contained, restoring the classes that used to reach consumers transitively.
PreviousNext