Feat: mvc-auth-commons v2.0.0, Jakarta EE 10, Java 17, Security Fixes

.github/workflows/build-and-test.yml

@@ -2,9 +2,10 @@ name: auth0/auth0-java-mvc-common/build-and-test
 
 on:
   pull_request:
+    branches: ["master", "v2"]
   merge_group:
   push:
-    branches: ["master", "main", "v1"]
+    branches: ["master"]
 
 jobs:
   gradle:
@@ -14,13 +15,13 @@ jobs:
       - uses: actions/setup-java@v5
         with:
           distribution: temurin
-          java-version: 8
+          java-version: 17
 
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
 
       - name: Test and Assemble and ApiDiff with Gradle
-        run: ./gradlew assemble apiDiff check jacocoTestReport --continue --console=plain
+        run: ./gradlew assemble check jacocoTestReport --continue --console=plain
 
       - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2
         with:

.github/workflows/codeql.yml

@@ -2,9 +2,9 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ "master", "2.0.0-dev" ]
-  pull_request:
     branches: [ "master" ]
+  pull_request:
+    branches: [ "master", "v2" ]
   schedule:
     - cron: "30 19 * * 6"
 
@@ -26,6 +26,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
   rl-scanner:
     uses: ./.github/workflows/rl-secure.yml
     with:
-      java-version: 8
+      java-version: 17
       artifact-name: "auth0-java-mvc-common.tgz"
     secrets:
       RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
@@ -32,7 +32,7 @@ jobs:
     uses: ./.github/workflows/java-release.yml
     needs: rl-scanner
     with:
-      java-version: 8.0.382-tem
+      java-version: 17
     secrets:
       ossr-username: ${{ secrets.OSSR_USERNAME }}
       ossr-token: ${{ secrets.OSSR_TOKEN }}

.github/workflows/sca_scan.yml

@@ -4,12 +4,12 @@ on:
   push:
     branches: ["master"]
   pull_request:
-    branches: ["master"]
+    branches: ["master", "v2"]
 
 jobs:
   snyk-cli:
     uses: auth0/devsecops-tooling/.github/workflows/sca-scan.yml@main
     with:
       additional-arguments: "--exclude=README.md"
-      java-version: "8"
+      java-version: "17"
     secrets: inherit

.version

@@ -1 +1 @@
-1.12.0
+2.0.0-beta.0

build.gradle

@@ -29,87 +29,88 @@ logger.lifecycle("Using version ${version} for ${name} group $group")
 
 import me.champeau.gradle.japicmp.JapicmpTask
 
-project.afterEvaluate {
-    def versions = project.ext.testInJavaVersions
-    for (pluginJavaTestVersion in versions) {
-        def taskName = "testInJava-${pluginJavaTestVersion}"
-        tasks.register(taskName, Test) {
-            def versionToUse = taskName.split("-").getAt(1) as Integer
-            description = "Runs unit tests on Java version ${versionToUse}."
-            project.logger.quiet("Test will be running in ${versionToUse}")
-            group = 'verification'
-            javaLauncher.set(javaToolchains.launcherFor {
-                languageVersion = JavaLanguageVersion.of(versionToUse)
-            })
-            shouldRunAfter(tasks.named('test'))
-        }
-        tasks.named('check') {
-            dependsOn(taskName)
-        }
-    }
-
-    project.configure(project) {
-        def baselineVersion = project.ext.baselineCompareVersion
-        task('apiDiff', type: JapicmpTask, dependsOn: 'jar') {
-            oldClasspath.from(files(getBaselineJar(project, baselineVersion)))
-            newClasspath.from(files(jar.archiveFile))
-            onlyModified = true
-            failOnModification = true
-            ignoreMissingClasses = true
-            htmlOutputFile = file("$buildDir/reports/apiDiff/apiDiff.html")
-            txtOutputFile = file("$buildDir/reports/apiDiff/apiDiff.txt")
-            doLast {
-                project.logger.quiet("Comparing against baseline version ${baselineVersion}")
-            }
-        }
-    }
-}
-
-private static File getBaselineJar(Project project, String baselineVersion) {
-    // Use detached configuration: https://github.com/square/okhttp/blob/master/build.gradle#L270
-    def group = project.group
-    try {
-        def baseline = "${project.group}:${project.name}:$baselineVersion"
-        project.group = 'virtual_group_for_japicmp'
-        def dependency = project.dependencies.create(baseline + "@jar")
-        return project.configurations.detachedConfiguration(dependency).files.find {
-            it.name == "${project.name}-${baselineVersion}.jar"
-        }
-    } finally {
-        project.group = group
-    }
-}
+//project.afterEvaluate {
+//    def versions = project.ext.testInJavaVersions
+//    for (pluginJavaTestVersion in versions) {
+//        def taskName = "testInJava-${pluginJavaTestVersion}"
+//        tasks.register(taskName, Test) {
+//            def versionToUse = taskName.split("-").getAt(1) as Integer
+//            description = "Runs unit tests on Java version ${versionToUse}."
+//            project.logger.quiet("Test will be running in ${versionToUse}")
+//            group = 'verification'
+//            javaLauncher.set(javaToolchains.launcherFor {
+//                languageVersion = JavaLanguageVersion.of(versionToUse)
+//            })
+//            shouldRunAfter(tasks.named('test'))
+//        }
+//        tasks.named('check') {
+//            dependsOn(taskName)
+//        }
+//    }
+//
+//    project.configure(project) {
+//        def baselineVersion = project.ext.baselineCompareVersion
+//        task('apiDiff', type: JapicmpTask, dependsOn: 'jar') {
+//            oldClasspath.from(files(getBaselineJar(project, baselineVersion)))
+//            newClasspath.from(files(jar.archiveFile))
+//            onlyModified = true
+//            failOnModification = true
+//            ignoreMissingClasses = true
+//            htmlOutputFile = file("$buildDir/reports/apiDiff/apiDiff.html")
+//            txtOutputFile = file("$buildDir/reports/apiDiff/apiDiff.txt")
+//            doLast {
+//                project.logger.quiet("Comparing against baseline version ${baselineVersion}")
+//            }
+//        }
+//    }
+//}
+//
+//private static File getBaselineJar(Project project, String baselineVersion) {
+//    // Use detached configuration: https://github.com/square/okhttp/blob/master/build.gradle#L270
+//    def group = project.group
+//    try {
+//        def baseline = "${project.group}:${project.name}:$baselineVersion"
+//        project.group = 'virtual_group_for_japicmp'
+//        def dependency = project.dependencies.create(baseline + "@jar")
+//        return project.configurations.detachedConfiguration(dependency).files.find {
+//            it.name == "${project.name}-${baselineVersion}.jar"
+//        }
+//    } finally {
+//        project.group = group
+//    }
+//}
 
 ext {
     baselineCompareVersion = '1.5.0'
-    testInJavaVersions = [8, 11, 17, 21]
+    testInJavaVersions = [17, 21]
 }
 
 jacocoTestReport {
     reports {
-        xml.enabled = true
-        html.enabled = true
+        xml.required = true
+        html.required = true
     }
 }
 
 java {
     toolchain {
-        languageVersion = JavaLanguageVersion.of(8)
-    }
-    // Needed because of broken gradle metadata, see https://github.com/google/guava/issues/6612#issuecomment-1614992368
-    sourceSets.all {
-        configurations.getByName(runtimeClasspathConfigurationName) {
-            attributes.attribute(Attribute.of("org.gradle.jvm.environment", String), "standard-jvm")
-        }
-        configurations.getByName(compileClasspathConfigurationName) {
-            attributes.attribute(Attribute.of("org.gradle.jvm.environment", String), "standard-jvm")
-        }
+        languageVersion = JavaLanguageVersion.of(17)
     }
+    modularity.inferModulePath = true
 }
 
+
 compileJava {
-    sourceCompatibility '1.8'
-    targetCompatibility '1.8'
+    sourceCompatibility '17'
+    targetCompatibility '17'
+}
+
+jar {
+}
+
+javadoc {
+    exclude 'module-info.java'
+    modularity.inferModulePath = false
 }
 
 test {
@@ -121,21 +122,20 @@ test {
 }
 
 dependencies {
-    implementation 'javax.servlet:javax.servlet-api:3.1.0'
+    implementation 'jakarta.servlet:jakarta.servlet-api:6.0.0'
     implementation 'org.apache.commons:commons-lang3:3.20.0'
-    implementation 'com.google.guava:guava-annotations:r03'
+    implementation 'com.google.guava:guava:32.0.1-jre'
     implementation 'commons-codec:commons-codec:1.22.0'
 
-    api 'com.auth0:auth0:1.45.1'
-    api 'com.auth0:java-jwt:3.19.4'
-    api 'com.auth0:jwks-rsa:0.24.0'
+    api 'com.auth0:auth0:3.5.1'
+    api 'com.auth0:java-jwt:4.5.0'
+    api 'com.auth0:jwks-rsa:0.24.1'
 
-    testImplementation 'org.bouncycastle:bcprov-jdk15on:1.70'
-    testImplementation 'org.hamcrest:java-hamcrest:2.0.0.0'
-    testImplementation 'org.hamcrest:hamcrest-core:1.3'
-    testImplementation 'org.mockito:mockito-core:2.28.2'
+    testImplementation 'org.hamcrest:hamcrest:2.2'
+    testImplementation 'org.mockito:mockito-core:4.11.0'
     testImplementation 'org.junit.jupiter:junit-jupiter:5.8.1'
-    testImplementation 'org.springframework:spring-test:4.3.30.RELEASE'
+    testImplementation 'org.springframework:spring-test:6.0.14'
+    testImplementation 'org.springframework:spring-web:6.0.14'
     testImplementation 'com.squareup.okhttp3:okhttp:4.12.0'
 }
 

gradle/maven-publish.gradle

@@ -18,8 +18,8 @@ tasks.withType(Javadoc).configureEach {
 }
 
 javadoc {
-    // Specify the Java version that the project will use
-    options.addStringOption('-release', "8")
+    // Specify the Java version that the project targets
+    options.addStringOption('-release', "17")
 }
 artifacts {
     archives sourcesJar, javadocJar

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-6.9.4-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists