From 903b8c131c612bab7349b327d18688ee6ef76db4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 11 Jun 2026 04:55:07 +0000 Subject: [PATCH 1/2] build(deps): Bump the dev-dependencies group with 11 updates Bumps the dev-dependencies group with 11 updates: | Package | From | To | | --- | --- | --- | | [com.google.errorprone:error_prone_annotations](https://github.com/google/error-prone) | `2.49.0` | `2.50.0` | | software.amazon.awssdk:dynamodb | `2.46.7` | `2.46.8` | | software.amazon.awssdk:dynamodb-enhanced | `2.46.7` | `2.46.8` | | [org.springframework.boot:spring-boot-autoconfigure](https://github.com/spring-projects/spring-boot) | `4.0.6` | `4.1.0` | | [org.springframework.boot:spring-boot-starter](https://github.com/spring-projects/spring-boot) | `4.0.6` | `4.1.0` | | [org.springframework.boot:spring-boot-starter-web](https://github.com/spring-projects/spring-boot) | `4.0.6` | `4.1.0` | | [org.springframework.boot:spring-boot-starter-security](https://github.com/spring-projects/spring-boot) | `4.0.6` | `4.1.0` | | [org.springframework.boot:spring-boot-starter-test](https://github.com/spring-projects/spring-boot) | `4.0.6` | `4.1.0` | | [org.springframework.boot:spring-boot-webmvc-test](https://github.com/spring-projects/spring-boot) | `4.0.6` | `4.1.0` | | [org.springframework.boot:spring-boot-configuration-processor](https://github.com/spring-projects/spring-boot) | `4.0.6` | `4.1.0` | | [com.google.errorprone:error_prone_core](https://github.com/google/error-prone) | `2.49.0` | `2.50.0` | Updates `com.google.errorprone:error_prone_annotations` from 2.49.0 to 2.50.0 - [Release notes](https://github.com/google/error-prone/releases) - [Commits](https://github.com/google/error-prone/compare/v2.49.0...v2.50.0) Updates `software.amazon.awssdk:dynamodb` from 2.46.7 to 2.46.8 Updates `software.amazon.awssdk:dynamodb-enhanced` from 2.46.7 to 2.46.8 Updates `software.amazon.awssdk:dynamodb-enhanced` from 2.46.7 to 2.46.8 Updates `org.springframework.boot:spring-boot-autoconfigure` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-starter` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-starter-web` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-starter-security` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-starter-test` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-webmvc-test` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-configuration-processor` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-starter` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-starter-web` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-starter-security` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-starter-test` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-webmvc-test` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `org.springframework.boot:spring-boot-configuration-processor` from 4.0.6 to 4.1.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v4.0.6...v4.1.0) Updates `com.google.errorprone:error_prone_core` from 2.49.0 to 2.50.0 - [Release notes](https://github.com/google/error-prone/releases) - [Commits](https://github.com/google/error-prone/compare/v2.49.0...v2.50.0) --- updated-dependencies: - dependency-name: com.google.errorprone:error_prone_annotations dependency-version: 2.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: software.amazon.awssdk:dynamodb dependency-version: 2.46.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: software.amazon.awssdk:dynamodb-enhanced dependency-version: 2.46.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: software.amazon.awssdk:dynamodb-enhanced dependency-version: 2.46.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-autoconfigure dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-starter dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-starter-web dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-starter-security dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-starter-test dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-webmvc-test dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-configuration-processor dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-starter dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-starter-web dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-starter-security dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-starter-test dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-webmvc-test dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: org.springframework.boot:spring-boot-configuration-processor dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: com.google.errorprone:error_prone_core dependency-version: 2.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] --- examples/dropwizard-demo/build.gradle.kts | 4 ++-- gradle/libs.versions.toml | 6 +++--- pk-auth-dropwizard/build.gradle.kts | 4 ++-- pk-auth-micronaut/build.gradle.kts | 4 ++-- pk-auth-persistence-jdbi/build.gradle.kts | 4 ++-- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/examples/dropwizard-demo/build.gradle.kts b/examples/dropwizard-demo/build.gradle.kts index d7a8486..3589440 100644 --- a/examples/dropwizard-demo/build.gradle.kts +++ b/examples/dropwizard-demo/build.gradle.kts @@ -46,8 +46,8 @@ dependencies { implementation(libs.slf4j.api) runtimeOnly(libs.logback.classic) - compileOnly("com.google.errorprone:error_prone_annotations:2.49.0") - testCompileOnly("com.google.errorprone:error_prone_annotations:2.49.0") + compileOnly("com.google.errorprone:error_prone_annotations:2.50.0") + testCompileOnly("com.google.errorprone:error_prone_annotations:2.50.0") testImplementation(libs.dropwizard.testing) } diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index dace5f3..a2c1eff 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -15,7 +15,7 @@ java = "21" # this from getting bumped back. Revisit when Spotless 8 ships a fix. spotless = "8.6.0" errorprone-plugin = "5.1.0" -errorprone-core = "2.49.0" +errorprone-core = "2.50.0" google-java-format = "1.25.2" jspecify = "1.0.0" @@ -36,7 +36,7 @@ jdbi = "3.53.0" flyway = "12.8.1" postgresql = "42.7.11" hikaricp = "7.0.2" -aws-sdk = "2.46.7" +aws-sdk = "2.46.8" testcontainers = "1.21.4" # Spring Boot adapter (Phase 8). Spring Boot 4 / Spring Security 7. Spring Boot 4 standardized @@ -44,7 +44,7 @@ testcontainers = "1.21.4" # previous Jackson 2 bridge module is gone, replaced by direct registration of the core's # `PkAuthObjectMappers.pkAuthModule()` as a Spring bean. Brief §6.10 originally specified # 3.5.x / 6.5.x; the upgrade landed as a deliberate framework refresh. -spring-boot = "4.0.6" +spring-boot = "4.1.0" spring-security = "7.1.0" # H2 in the demo so reviewers can run the spring-boot-demo without an external Postgres. # Confined to the demo's runtime; the starter does not pull it in. diff --git a/pk-auth-dropwizard/build.gradle.kts b/pk-auth-dropwizard/build.gradle.kts index 379821e..ed5ea35 100644 --- a/pk-auth-dropwizard/build.gradle.kts +++ b/pk-auth-dropwizard/build.gradle.kts @@ -50,8 +50,8 @@ dependencies { // Dropwizard's transitive Jersey/Jakarta dependencies surface annotations whose enclosing // packages reference com.google.errorprone.annotations.* — same pattern as the JDBI module. - compileOnly("com.google.errorprone:error_prone_annotations:2.49.0") - testCompileOnly("com.google.errorprone:error_prone_annotations:2.49.0") + compileOnly("com.google.errorprone:error_prone_annotations:2.50.0") + testCompileOnly("com.google.errorprone:error_prone_annotations:2.50.0") implementation(libs.slf4j.api) diff --git a/pk-auth-micronaut/build.gradle.kts b/pk-auth-micronaut/build.gradle.kts index bde29fe..3806dbe 100644 --- a/pk-auth-micronaut/build.gradle.kts +++ b/pk-auth-micronaut/build.gradle.kts @@ -46,8 +46,8 @@ dependencies { // Micronaut's @Inject site references the JDBI errorprone @GuardedBy via the persistence // modules. Same trick as pk-auth-persistence-jdbi. - compileOnly("com.google.errorprone:error_prone_annotations:2.49.0") - testCompileOnly("com.google.errorprone:error_prone_annotations:2.49.0") + compileOnly("com.google.errorprone:error_prone_annotations:2.50.0") + testCompileOnly("com.google.errorprone:error_prone_annotations:2.50.0") annotationProcessor(libs.micronaut.inject.java) diff --git a/pk-auth-persistence-jdbi/build.gradle.kts b/pk-auth-persistence-jdbi/build.gradle.kts index 4a453fc..c6d0454 100644 --- a/pk-auth-persistence-jdbi/build.gradle.kts +++ b/pk-auth-persistence-jdbi/build.gradle.kts @@ -23,8 +23,8 @@ dependencies { // Without errorprone-annotations on the compile classpath, javac emits an annotation-not-found // warning that -Werror turns fatal. Pulled in compileOnly so we don't broadcast it as a // runtime dependency. - compileOnly("com.google.errorprone:error_prone_annotations:2.49.0") - testCompileOnly("com.google.errorprone:error_prone_annotations:2.49.0") + compileOnly("com.google.errorprone:error_prone_annotations:2.50.0") + testCompileOnly("com.google.errorprone:error_prone_annotations:2.50.0") implementation(libs.flyway.core) runtimeOnly(libs.flyway.postgres) runtimeOnly(libs.postgresql) From 7655f97f070b7953fe94cff1e1349d340a18704d Mon Sep 17 00:00:00 2001 From: Ned Wolpert Date: Thu, 11 Jun 2026 06:32:28 -0700 Subject: [PATCH 2/2] Error prone fix and updating to spring boot 4.1.0 --- .../persistence/jdbi/JdbiCredentialRepository.java | 12 ++++++------ .../autoconfigure/PkAuthWebAutoConfiguration.java | 10 +++++----- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/pk-auth-persistence-jdbi/src/main/java/com/codeheadsystems/pkauth/persistence/jdbi/JdbiCredentialRepository.java b/pk-auth-persistence-jdbi/src/main/java/com/codeheadsystems/pkauth/persistence/jdbi/JdbiCredentialRepository.java index 2da0a8a..e12bf28 100644 --- a/pk-auth-persistence-jdbi/src/main/java/com/codeheadsystems/pkauth/persistence/jdbi/JdbiCredentialRepository.java +++ b/pk-auth-persistence-jdbi/src/main/java/com/codeheadsystems/pkauth/persistence/jdbi/JdbiCredentialRepository.java @@ -204,12 +204,6 @@ public int deleteByUserHandle(UserHandle userHandle) { // Internal helpers // ------------------------------------------------------------------------- - /** - * Runs {@code body} and wraps any {@link JdbiException} (or other unchecked JDBC exception) in a - * {@link PkAuthPersistenceException} so adapter exception mappers can produce a uniform 503. - * {@link PkAuthPersistenceException} (including {@link DuplicateCredentialException}) is - * re-thrown unchanged so the duplicate-credential branch reaches the caller intact. - */ /** * Binds a nullable value. When non-null, defers to JDBI's standard binding. When null, calls * {@code bindNull} with the supplied SQL type so Postgres receives a typed NULL rather than the @@ -224,6 +218,12 @@ private static void bindNullable(Update update, String name, Object value, int s } } + /** + * Runs {@code body} and wraps any {@link JdbiException} (or other unchecked JDBC exception) in a + * {@link PkAuthPersistenceException} so adapter exception mappers can produce a uniform 503. + * {@link PkAuthPersistenceException} (including {@link DuplicateCredentialException}) is + * re-thrown unchanged so the duplicate-credential branch reaches the caller intact. + */ private static T wrap(String op, Supplier body) { try { return body.get(); diff --git a/pk-auth-spring-boot-starter/src/main/java/com/codeheadsystems/pkauth/spring/autoconfigure/PkAuthWebAutoConfiguration.java b/pk-auth-spring-boot-starter/src/main/java/com/codeheadsystems/pkauth/spring/autoconfigure/PkAuthWebAutoConfiguration.java index bdef5e4..544512a 100644 --- a/pk-auth-spring-boot-starter/src/main/java/com/codeheadsystems/pkauth/spring/autoconfigure/PkAuthWebAutoConfiguration.java +++ b/pk-auth-spring-boot-starter/src/main/java/com/codeheadsystems/pkauth/spring/autoconfigure/PkAuthWebAutoConfiguration.java @@ -108,11 +108,6 @@ public SecurityFilterChain pkAuthSecurityFilterChain( .build(); } - /** - * The ceremony controller is mounted explicitly via {@code @Import}, but Spring component-scan - * doesn't run on starter packages. We register the bean here so host apps don't need a - * {@code @ComponentScan(basePackages = "com.codeheadsystems.pkauth.spring.web")}. - */ /** * Shared ceremony orchestrator (JWT mint + label lookup + wire mapping). Lives in {@code * pk-auth-jwt} so every adapter holds a single dependency rather than three. @@ -126,6 +121,11 @@ public CeremonyOrchestrator pkAuthCeremonyOrchestrator( return PkAuthComposition.ceremonyOrchestrator(service, jwtIssuer, credentialRepository); } + /** + * The ceremony controller is mounted explicitly via {@code @Import}, but Spring component-scan + * doesn't run on starter packages. We register the bean here so host apps don't need a + * {@code @ComponentScan(basePackages = "com.codeheadsystems.pkauth.spring.web")}. + */ @Bean @ConditionalOnMissingBean public PkAuthCeremonyController pkAuthCeremonyController(CeremonyOrchestrator orchestrator) {