[TDB-19854/3.11] - Refactor the Demos to remove vulnerable dependencies (backport of master)

azure-pipelines.yml

@@ -25,44 +25,25 @@ resources:
       name: terracotta/terracotta
 
 jobs:
-- template: build-templates/gradle-common.yml@templates
-  parameters:
-    jdkVersion: '1.8'
-    jobName: 'LinuxJava8'
-    gradleTasks: 'check -x dependencyCheckAggregate'
-
-- template: build-templates/gradle-common.yml@templates
-  parameters:
-    jdkVersion: '1.8'
-    options: '-PtestVM=java11Home'
-    jobName: 'LinuxJava11'
-    gradleTasks: 'check -x dependencyCheckAggregate'
-
-- template: build-templates/gradle-common.yml@templates
-  parameters:
-    jdkVersion: '1.8'
-    options: '-PtestVM=java17Home'
-    jobName: 'LinuxJava17'
-    gradleTasks: 'check -x dependencyCheckAggregate'
-
-- template: build-templates/gradle-common.yml@templates
-  parameters:
-    jdkVersion: '1.8'
-    options: '-PtestVM=java21Home'
-    jobName: 'LinuxJava21'
-    gradleTasks: 'check -x dependencyCheckAggregate'
-
-- template: build-templates/gradle-common.yml@templates
-  parameters:
-    vmImage: 'windows-latest'
-    jdkVersion: '1.8'
-    jobName: 'WindowsJava8'
-    gradleTasks: 'check -x dependencyCheckAggregate'
-
-- template: build-templates/gradle-common.yml@templates
-  parameters:
-    vmImage: 'windows-latest'
-    jdkVersion: '1.8'
-    options: '-PtestVM=java21Home'
-    jobName: 'WindowsJava21'
-    gradleTasks: 'check -x dependencyCheckAggregate'
+  - template: build-templates/gradle-common.yml@templates
+    parameters:
+      jdkVersion: '17'
+      options: '-PtestVM=java17Home'
+      jobName: 'LinuxJava17'
+      gradleTasks: 'check -x dependencyCheckAggregate'
+
+  - template: build-templates/gradle-common.yml@templates
+    parameters:
+      jdkVersion: '17'
+      options: '-PtestVM=java21Home'
+      jobName: 'LinuxJava21'
+      gradleTasks: 'check -x dependencyCheckAggregate'
+
+
+  - template: build-templates/gradle-common.yml@templates
+    parameters:
+      vmImage: 'windows-latest'
+      jdkVersion: '17'
+      options: '-PtestVM=java21Home'
+      jobName: 'WindowsJava21'
+      gradleTasks: 'check -x dependencyCheckAggregate'

build-logic/src/main/java/org/ehcache/build/conventions/CheckstyleConvention.java

@@ -13,10 +13,28 @@ public void apply(Project project) {
     project.getPlugins().apply(CheckstylePlugin.class);
 
     project.getExtensions().configure(CheckstyleExtension.class, checkstyle -> {
+      checkstyle.setToolVersion("10.18.1");
       checkstyle.setConfigFile(project.getRootProject().file("config/checkstyle.xml"));
       Map<String, Object> properties = checkstyle.getConfigProperties();
       properties.put("projectDir", project.getProjectDir());
       properties.put("rootDir", project.getRootDir());
     });
+
+    project.getConfigurations().named("checkstyle", config -> {
+      config.getResolutionStrategy().dependencySubstitution(subs -> {
+        subs.substitute(subs.module("org.codehaus.plexus:plexus-utils:3.1.1"))
+          .using(subs.module("org.codehaus.plexus:plexus-utils:3.3.0"))
+          .because("Checkstyle 10.18.1 pulls mismatched plexus-utils versions");
+        subs.substitute(subs.module("org.apache.commons:commons-lang3:3.7"))
+          .using(subs.module("org.apache.commons:commons-lang3:3.8.1"))
+          .because("Checkstyle transitives mix commons-lang3 versions");
+        subs.substitute(subs.module("org.apache.httpcomponents:httpcore:4.4.13"))
+          .using(subs.module("org.apache.httpcomponents:httpcore:4.4.14"))
+          .because("Align httpcore to latest bugfix release");
+        subs.substitute(subs.module("commons-codec:commons-codec:1.11"))
+          .using(subs.module("commons-codec:commons-codec:1.15"))
+          .because("Checkstyle transitive dependencies depend on different commons-codec versions");
+      });
+    });
   }
 }

build-logic/src/main/java/org/ehcache/build/conventions/JavaConvention.java

@@ -1,7 +1,9 @@
 package org.ehcache.build.conventions;
 
+import java.util.Map;
 import org.gradle.api.Plugin;
 import org.gradle.api.Project;
+import org.gradle.api.artifacts.ModuleDependency;
 import org.gradle.api.artifacts.dsl.DependencyHandler;
 import org.gradle.api.plugins.JavaPlugin;
 
@@ -20,16 +22,29 @@ public void apply(Project project) {
 
     dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "junit:junit:" + project.property("junitVersion"));
     dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.assertj:assertj-core:" + project.property("assertjVersion"));
+    dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "net.bytebuddy:byte-buddy:" + project.property("byteBuddyVersion"));
+    dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "net.bytebuddy:byte-buddy-agent:" + project.property("byteBuddyVersion"));
     dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.hamcrest:hamcrest:" + project.property("hamcrestVersion"));
     dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.mockito:mockito-core:" + project.property("mockitoVersion"));
-    dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.terracotta:terracotta-utilities-test-tools:" + project.property("terracottaUtilitiesVersion"));
+    ModuleDependency md = (ModuleDependency)dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.terracotta:terracotta-utilities-test-tools:" + project.property("terracottaUtilitiesVersion"));
+    if (md != null) {
+      md.exclude(Map.of("group", "org.slf4j"));
+    }
 
     project.getConfigurations().all(config -> {
       config.getResolutionStrategy().dependencySubstitution(subs -> {
         subs.substitute(subs.module("org.hamcrest:hamcrest-core:1.3")).with(subs.module("org.hamcrest:hamcrest-core:" + project.property("hamcrestVersion")));
         subs.substitute(subs.module("org.hamcrest:hamcrest-library:1.3")).with(subs.module("org.hamcrest:hamcrest-library:" + project.property("hamcrestVersion")));
         subs.substitute(subs.module("junit:junit:4.12")).using(subs.module("junit:junit:4.13.1"));
       });
+      config.getResolutionStrategy().eachDependency(details -> {
+        String group = details.getRequested().getGroup();
+        String name = details.getRequested().getName();
+        if ("net.bytebuddy".equals(group) && ("byte-buddy".equals(name) || "byte-buddy-agent".equals(name))) {
+          details.useVersion(project.property("byteBuddyVersion").toString());
+          details.because("Align Byte Buddy family versions across AssertJ and Mockito");
+        }
+      });
     });
   }
 }

build-logic/src/main/java/org/ehcache/build/conventions/SpotbugsConvention.java

@@ -17,8 +17,8 @@ public void apply(Project project) {
     SpotBugsExtension spotbugs = project.getExtensions().getByType(SpotBugsExtension.class);
 
     spotbugs.getIgnoreFailures().set(false);
-    // Later versions of Spotbugs have stupid heuristics for EI_EXPOSE_REP*
-    spotbugs.getToolVersion().set("4.2.3");
+    spotbugs.getToolVersion().set("4.9.8");
+    spotbugs.getOmitVisitors().addAll("FindReturnRef", "ConstructorThrow");
 
     project.getPlugins().withType(JavaBasePlugin.class).configureEach(plugin -> {
 
@@ -46,6 +46,12 @@ public void apply(Project project) {
         subs.substitute(subs.module("org.apache.commons:commons-lang3:3.11"))
           .using(subs.module("org.apache.commons:commons-lang3:3.12.0"))
           .because("Spotbugs has dependency divergences");
+        subs.substitute(subs.module("org.apache.commons:commons-lang3:3.18.0"))
+          .using(subs.module("org.apache.commons:commons-lang3:3.19.0"))
+          .because("Spotbugs 4.9.8 has dependency divergences");
+        subs.substitute(subs.module("org.apache.logging.log4j:log4j-core:2.25.2"))
+          .using(subs.module("org.apache.logging.log4j:log4j-core:2.25.3"))
+          .because("Security vulnerability fix");
       });
     });
 

clustered/ehcache-client/build.gradle

@@ -37,7 +37,9 @@ dependencies {
   implementation "org.terracotta:lease-api:$terracottaPlatformVersion"
   implementation "org.terracotta.dynamic-config.entities:dynamic-config-topology-entity-client:$terracottaPlatformVersion"
   implementation "org.terracotta:connection-api:$terracottaApisVersion"
-  implementation "org.terracotta:terracotta-utilities-tools:$terracottaUtilitiesVersion"
+  implementation ("org.terracotta:terracotta-utilities-tools:$terracottaUtilitiesVersion") {
+    exclude group: 'org.slf4j'
+  }
 
   compileOnly 'org.osgi:org.osgi.service.component.annotations:1.3.0'
 
@@ -60,5 +62,7 @@ dependencies {
     exclude group:'org.slf4j', module:'slf4j-api'
   }
   testImplementation testFixtures(project(':ehcache-xml'))
-  testImplementation ("org.terracotta:statistics:$parent.statisticVersion")
+  testImplementation ("org.terracotta:statistics:$parent.statisticVersion") {
+    exclude group: 'org.slf4j', module: 'slf4j-api'
+  }
 }

clustered/ehcache-client/src/main/java/org/ehcache/clustered/client/internal/service/DefaultClusteringService.java

@@ -377,6 +377,7 @@ public ConnectionState getConnectionState() {
     return connectionState;
   }
 
+  @SuppressWarnings("removal")
   private static ExecutorService createAsyncWorker() {
     SecurityManager s = System.getSecurityManager();
     ThreadGroup initialGroup = (s != null) ? s.getThreadGroup() : Thread.currentThread().getThreadGroup();

clustered/ehcache-client/src/main/java/org/ehcache/clustered/client/internal/store/CommonServerStoreProxy.java

@@ -232,6 +232,7 @@ public Map.Entry<Long, Chain> next() {
         }
 
         @Override
+        @SuppressWarnings("deprecation")
         protected void finalize() throws Throwable {
           if (!lastBatch) {
             entity.invokeAndWaitForReceive(new ServerStoreOpMessage.IteratorCloseMessage(iteratorId), false);

clustered/ehcache-client/src/test/java/org/ehcache/clustered/client/internal/service/DefaultClusteringServiceDestroyTest.java

@@ -55,6 +55,8 @@
 import static org.mockito.Mockito.when;
 import static org.mockito.Mockito.withSettings;
 
+import org.mockito.quality.Strictness;
+
 /**
  * DefaultClusteringServiceDestroyTest
  */
@@ -194,7 +196,7 @@ public void testDestroyOnPartialDestroyState() throws Exception {
 
   private void mockLockForWriteLockSuccess() throws org.terracotta.exception.EntityNotProvidedException, org.terracotta.exception.EntityNotFoundException, org.terracotta.exception.EntityVersionMismatchException {
     when(connection.<VoltronReadWriteLockClient, Object, Void>getEntityRef(same(VoltronReadWriteLockClient.class), eq(1L), any())).thenReturn(lockEntityRef);
-    VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().lenient());
+    VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().strictness(Strictness.LENIENT));
     when(lockEntityRef.fetchEntity(null)).thenReturn(lockClient);
 
     when(lockClient.tryLock(LockMessaging.HoldType.WRITE)).thenReturn(true);
@@ -203,7 +205,7 @@ private void mockLockForWriteLockSuccess() throws org.terracotta.exception.Entit
 
   private void mockLockForReadLockSuccess() throws org.terracotta.exception.EntityNotProvidedException, org.terracotta.exception.EntityNotFoundException, org.terracotta.exception.EntityVersionMismatchException {
     when(connection.<VoltronReadWriteLockClient, Object, Void>getEntityRef(same(VoltronReadWriteLockClient.class), eq(1L), any())).thenReturn(lockEntityRef);
-    VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().lenient());
+    VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().strictness(Strictness.LENIENT));
     when(lockEntityRef.fetchEntity(null)).thenReturn(lockClient);
 
     when(lockClient.tryLock(LockMessaging.HoldType.READ)).thenReturn(true);

clustered/ehcache-client/src/test/java/org/ehcache/clustered/client/internal/service/StateRepositoryWhitelistingTest.java

@@ -166,9 +166,9 @@ public void testWhitelistingForPrimitiveClass() throws Exception {
     StateHolder<Integer, Integer> testMap = stateRepository.getPersistentStateHolder("testMap", Integer.class, Integer.class,
       Arrays.asList(Child.class)::contains, null);
 
-    testMap.putIfAbsent(new Integer(10), new Integer(20));
+    testMap.putIfAbsent(Integer.valueOf(10), Integer.valueOf(20));
 
-    assertThat(testMap.get(new Integer(10)), is(new Integer(20)));
+    assertThat(testMap.get(Integer.valueOf(10)), is(Integer.valueOf(20)));
     assertThat(testMap.entrySet(), hasSize(1));
   }
 

clustered/ehcache-client/src/test/java/org/ehcache/clustered/client/internal/store/ClusteredStoreTest.java

@@ -231,7 +231,7 @@ public void testGetThrowsOnlySAE() throws Exception {
   @SuppressWarnings("unchecked")
   public void testGetTimeout() throws Exception {
     ServerStoreProxy proxy = mock(ServerStoreProxy.class);
-    long longKey = HashUtils.intHashToLong(new Long(1L).hashCode());
+    long longKey = HashUtils.intHashToLong(Long.valueOf(1L).hashCode());
     when(proxy.get(longKey)).thenThrow(TimeoutException.class);
     ClusteredStore<Long, String> store = new ClusteredStore<>(config,null, null, proxy, null, null, new DefaultStatisticsService());
     assertThat(store.get(1L), nullValue());
@@ -630,7 +630,7 @@ public void testSingleChainSingleValue() throws StoreAccessException {
 
   @Test
   public void testSingleChainMultipleValues() throws StoreAccessException {
-    assertThat(Long.hashCode(1L), is(Long.hashCode(~1L)));
+    assertThat(Long.valueOf(1L).hashCode(), is(Long.valueOf(~1L).hashCode()));
 
     store.put(1L, "foo");
     store.put(~1L, "bar");

clustered/ehcache-clustered/build.gradle

@@ -100,8 +100,18 @@ task copyDocs(type: Sync) {
   into docsFolder
 }
 
+configurations {
+  javadocAdd
+}
+
+dependencies {
+  javadocAdd project(':clustered:ehcache-common-api')
+  javadocAdd project(':clustered:ehcache-common')
+}
+
 javadoc {
   exclude '**/core/**', '**/impl/**', '**/xml/**', '**/jsr107/**', '**/transactions/**', '**/management/**', '**/tck/**'
+  classpath += configurations.javadocAdd
 }
 
 tasks.named('jar') {

clustered/ehcache-common-api/src/main/java/org/ehcache/clustered/common/internal/store/ValueWrapper.java

@@ -25,7 +25,6 @@
 /**
  * ValueWrapper
  */
-@SuppressFBWarnings("EI_EXPOSE_REP")
 public class ValueWrapper implements Serializable {
 
   private static final long serialVersionUID = -4794738044295644587L;

clustered/ehcache-common/build.gradle

@@ -32,7 +32,9 @@ dependencies {
 
   implementation "org.terracotta:entity-common-api:$terracottaApisVersion"
   implementation "org.terracotta:runnel:$terracottaPlatformVersion"
-  implementation "org.terracotta:terracotta-utilities-tools:$terracottaUtilitiesVersion"
+  implementation ("org.terracotta:terracotta-utilities-tools:$terracottaUtilitiesVersion") {
+    exclude group: 'org.slf4j'
+  }
 
   testImplementation project(':clustered:test-utils')
 }

clustered/ehcache-common/src/test/java/org/ehcache/clustered/common/internal/Store/WhitelistedUnmarshallingTest.java

@@ -62,48 +62,48 @@ private <T> void unmarshallingStateRepoMessagesCheck(T t) {
 
   @Test
   public void unmarshallingIntegerTest() throws Exception {
-    unmarshallingStateRepoMessagesCheck(new Integer(10));
+    unmarshallingStateRepoMessagesCheck(Integer.valueOf(10));
   }
 
   @Test
   public void unmarshallingLongTest() throws Exception {
-    unmarshallingStateRepoMessagesCheck(new Long(10));
+    unmarshallingStateRepoMessagesCheck(Long.valueOf(10L));
   }
 
   @Test
   public void unmarshallingFloatTest() throws Exception {
-    unmarshallingStateRepoMessagesCheck(new Float(10.0));
+    unmarshallingStateRepoMessagesCheck(Float.valueOf(10.0f));
   }
 
   @Test
   public void unmarshallingDoubleTest() throws Exception {
-    unmarshallingStateRepoMessagesCheck(new Double(10.0));
+    unmarshallingStateRepoMessagesCheck(Double.valueOf(10.0));
   }
 
   @Test
   public void unmarshallingByteTest() throws Exception {
     byte b = 101;
-    unmarshallingStateRepoMessagesCheck(new Byte(b));
+    unmarshallingStateRepoMessagesCheck(Byte.valueOf(b));
   }
 
   @Test
   public void unmarshallingCharacterTest() throws Exception {
-    unmarshallingStateRepoMessagesCheck(new Character('b'));
+    unmarshallingStateRepoMessagesCheck(Character.valueOf('b'));
   }
 
   @Test
   public void unmarshallingStringTest() throws Exception {
-    unmarshallingStateRepoMessagesCheck(new String("John"));
+    unmarshallingStateRepoMessagesCheck("John");
   }
 
   @Test
   public void unmarshallingBooleanTest() throws Exception {
-    unmarshallingStateRepoMessagesCheck(new Boolean(true));
+    unmarshallingStateRepoMessagesCheck(Boolean.TRUE);
   }
 
   @Test
   public void unmarshallingShortTest() throws Exception {
-    unmarshallingStateRepoMessagesCheck(new Short((short) 1));
+    unmarshallingStateRepoMessagesCheck(Short.valueOf((short) 1));
   }
 
   @Test

clustered/ehcache-common/src/test/java/org/ehcache/clustered/common/internal/messages/ChainCodecTest.java

@@ -115,7 +115,7 @@ public void testChainEntryWithSingleElement() {
     StructEncoder<Void> encoder = ChainCodec.CHAIN_ENTRY_STRUCT.encoder();
     ChainCodec.encodeChainEntry(encoder, entry);
 
-    Map.Entry<Long, Chain> decoded = ChainCodec.decodeChainEntry(ChainCodec.CHAIN_ENTRY_STRUCT.decoder((ByteBuffer) encoder.encode().flip()));
+    Map.Entry<Long, Chain> decoded = ChainCodec.decodeChainEntry(ChainCodec.CHAIN_ENTRY_STRUCT.decoder(encoder.encode().flip()));
 
 
     assertThat(decoded.getKey(), is(42L));
@@ -132,7 +132,7 @@ public void testChainEntryWithSingleSequencedElement() {
     StructEncoder<Void> encoder = ChainCodec.CHAIN_ENTRY_STRUCT.encoder();
     ChainCodec.encodeChainEntry(encoder, entry);
 
-    Map.Entry<Long, Chain> decoded = ChainCodec.decodeChainEntry(ChainCodec.CHAIN_ENTRY_STRUCT.decoder((ByteBuffer) encoder.encode().flip()));
+    Map.Entry<Long, Chain> decoded = ChainCodec.decodeChainEntry(ChainCodec.CHAIN_ENTRY_STRUCT.decoder(encoder.encode().flip()));
 
     assertThat(decoded.getKey(), is(43L));
     assertThat(decoded.getValue().isEmpty(), is(false));
@@ -150,7 +150,7 @@ public void testChainEntryWithMultipleElements() {
     StructEncoder<Void> encoder = ChainCodec.CHAIN_ENTRY_STRUCT.encoder();
     ChainCodec.encodeChainEntry(encoder, entry);
 
-    Map.Entry<Long, Chain> decoded = ChainCodec.decodeChainEntry(ChainCodec.CHAIN_ENTRY_STRUCT.decoder((ByteBuffer) encoder.encode().flip()));
+    Map.Entry<Long, Chain> decoded = ChainCodec.decodeChainEntry(ChainCodec.CHAIN_ENTRY_STRUCT.decoder(encoder.encode().flip()));
 
     assertThat(decoded.getKey(), is(44L));
     assertThat(decoded.getValue().isEmpty(), is(false));
@@ -164,7 +164,7 @@ public void testChainEntryWithMultipleSequencedElements() {
     StructEncoder<Void> encoder = ChainCodec.CHAIN_ENTRY_STRUCT.encoder();
     ChainCodec.encodeChainEntry(encoder, entry);
 
-    Map.Entry<Long, Chain> decoded = ChainCodec.decodeChainEntry(ChainCodec.CHAIN_ENTRY_STRUCT.decoder((ByteBuffer) encoder.encode().flip()));
+    Map.Entry<Long, Chain> decoded = ChainCodec.decodeChainEntry(ChainCodec.CHAIN_ENTRY_STRUCT.decoder(encoder.encode().flip()));
 
     assertThat(decoded.getKey(), is(45L));
     assertThat(decoded.getValue().isEmpty(), is(false));
@@ -180,7 +180,7 @@ public void testEmptyChainEntry() {
     StructEncoder<Void> encoder = ChainCodec.CHAIN_ENTRY_STRUCT.encoder();
     ChainCodec.encodeChainEntry(encoder, entry);
 
-    Map.Entry<Long, Chain> decoded = ChainCodec.decodeChainEntry(ChainCodec.CHAIN_ENTRY_STRUCT.decoder((ByteBuffer) encoder.encode().flip()));
+    Map.Entry<Long, Chain> decoded = ChainCodec.decodeChainEntry(ChainCodec.CHAIN_ENTRY_STRUCT.decoder(encoder.encode().flip()));
 
     assertThat(decoded.getKey(), is(46L));
     assertThat(decoded.getValue().isEmpty(), is(true));