Release 0.37.2 #172
Release 0.37.2 #172
Conversation
WalkthroughThe changes in the pull request primarily involve updates to the Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range comments (3)
build.gradle (3)
Line range hint
114-119: Consider keeping HTML reports alongside CSV.While adding CSV output is great for CI/CD integrations, consider keeping HTML reports enabled as well for better developer experience and visual coverage analysis.
jacocoTestReport { reports { csv.enabled true csv.destination file("${buildDir}/jacoco.csv") + html.enabled true } }
Line range hint
121-134: Security and task configuration improvements needed.Several issues need attention:
- MD5 is cryptographically broken and not recommended for security verification. Consider using SHA-256 instead.
- These tasks should be integrated into the build lifecycle if the agent is required for running the application.
- The
verifyFiletask has a redundantdependsOn downloadFiledeclaration.Apply these improvements:
task downloadFile(type: Download) { src 'https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/download/v1.16.0/opentelemetry-javaagent.jar' dest "${buildDir}/opentelemetry/opentelemetry-javaagent.jar" onlyIfModified true } task verifyFile(type: Verify, dependsOn: downloadFile) { - dependsOn downloadFile src new File("${buildDir}/opentelemetry/", 'opentelemetry-javaagent.jar') - algorithm 'MD5' - checksum '4f97ebd74d075e60c76ecdf47b61006a' + algorithm 'SHA-256' + checksum '7aa5fee5c8a32a6b603c9cf281c3a3c91a8a0ee4e36e8b0e1ea4843a6fb9448c' } +// Integrate with build lifecycle if the agent is required +classes.dependsOn verifyFile
Update Jackson dependency to a stable version compatible with Spring Boot 2.7.4
The project is using Spring Boot 2.7.4 which typically bundles Jackson 2.13.4. The current pinned version (2.14.0-rc2) is a release candidate of a higher major version. Since Spring Boot 2.7.x is compatible with Jackson 2.13.x series, I recommend:
- Update the Jackson version pin in
build.gradlefrom '2.14.0-rc2' to '2.13.4' which:
- Is the stable version compatible with Spring Boot 2.7.4
- Contains security fixes from the 2.13.x series
- Avoids potential compatibility issues with using a release candidate
🔗 Analysis chain
Line range hint
89-95: Verify if a stable Jackson version is available.While pinning to 2.14.0-rc2 addresses the critical vulnerability, using a release candidate in production carries risks. Let's verify if a stable version is now available.
Since the Maven Central API query didn't provide the expected results, let me try a different approach to verify Jackson versions in the codebase and its dependencies.
Let me check the Spring Boot version being used, as it typically bundles Jackson and this information will help determine the appropriate stable version recommendation.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Check Maven Central for latest stable Jackson versions curl -s "https://search.maven.org/solrsearch/select?q=g:com.fasterxml.jackson.core+AND+a:jackson-core&rows=5&wt=json" | jq -r '.response.docs[].v' | sort -V | tail -n 5Length of output: 175
Script:
#!/bin/bash # Check for Jackson dependencies and versions in Gradle files rg -A 3 "jackson" --glob "*.gradle" --glob "*.properties" # Also check for any Jackson-related dependency constraints rg -A 3 "jackson|com\.fasterxml" --glob "*.gradle" --glob "*.properties"Length of output: 1264
Script:
#!/bin/bash # Check Spring Boot version rg "org.springframework.boot" --glob "*.gradle" -A 3 # Also check for any Spring Boot dependency management rg "spring-boot-dependencies" --glob "*.gradle" -A 3Length of output: 1785
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
📒 Files selected for processing (1)
build.gradle(1 hunks)
🔇 Additional comments (1)
build.gradle (1)
16-16: Version increment looks good for this release.
The patch version increment (0.37.2) aligns with the nature of changes, particularly the security fix for Jackson dependencies.
Summary by CodeRabbit