Skip to content

build: update Spring Boot to 4.1.2 and Jackson to 3.2.4 #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mosobande merged 5 commits into from
Nov 8, 2026
Merged

build: update Spring Boot to 4.1.2 and Jackson to 3.2.4 #28

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b6ae803
build(deps): bump org.springframework.boot:spring-boot-starter-parent
dependabot[bot] Oct 27, 2026
2995e8d
build(deps): bump spring-boot.version from 4.1.1 to 4.1.2
dependabot[bot] Oct 27, 2026
38b893c
build(deps): bump tools.jackson:jackson-bom from 3.1.7 to 3.2.4
dependabot[bot] Oct 27, 2026
ca3f254
build: align docs and sample app with Boot 4.1.2 and Jackson 3.2.4
Nov 8, 2026
b358eb5
Merge branch 'ori' into deps/spring-boot-4.1.2
mosobande Nov 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion PUBLISHING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

Version is `0.1.0`. The reactor publishes five coordinates under `com.quantipixels.ogiri`: `ogiri-parent` and `ogiri-bom` (POMs), plus `ogiri`, `ogiri-spring-boot-autoconfigure`, and `ogiri-spring-boot-starter` (binary, sources and Javadoc JARs with POMs). The dependency-only starter's source/Javadoc attachments contain an explanatory README. The standalone BOM aligns only the three Ogiri libraries, without importing the build parent's dependency management.

Supported runtime: Spring Boot 4.x, Java 17+, Jackson 3; current dependency baseline is Boot 4.1.1/Jackson 3.1.7. Build tools require Java 21+; the gate selects JDK 25. Boot 3/Jackson 2 are unsupported.
Supported runtime: Spring Boot 4.x, Java 17+, Jackson 3; current dependency baseline is Boot 4.1.2/Jackson 3.2.4. Build tools require Java 21+; the gate selects JDK 25. Boot 3/Jackson 2 are unsupported.

## Local unsigned rehearsal

Expand Down
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

Ogiri adds database-backed opaque sessions and devise_token_auth (DTA) account endpoints to a Spring Boot application. Existing DTA frontends keep working. Every authenticated request checks the stored session and the current account. Your application keeps its account model and authorization rules.

Requirements: Spring Boot 4.x (built against 4.1.1), Java 17+, Jackson 3, PostgreSQL or MySQL 8.4 (InnoDB). Boot 3 and Jackson 2 are unsupported. Version `0.1.0` is an unpublished prototype; before 1.0, API and schema changes can break compatibility (see the [changelog](CHANGELOG.md)).
Requirements: Spring Boot 4.x (built against 4.1.2), Java 17+, Jackson 3, PostgreSQL or MySQL 8.4 (InnoDB). Boot 3 and Jackson 2 are unsupported. Version `0.1.0` is an unpublished prototype; before 1.0, API and schema changes can break compatibility (see the [changelog](CHANGELOG.md)).

Coding agents: use the [ogiri-integration skill](skills/ogiri-integration/SKILL.md) to add Ogiri to an app, and [auth-design](skills/auth-design/SKILL.md) to plan auth first.

Expand All @@ -16,11 +16,11 @@ mise exec -- bash scripts/platform/java.sh sample

This stages the artifacts in `target/java/consumer-cache` and writes `target/java/consumer-settings.xml`; pass that file with `mvn -s` from your application. It needs no database and does not touch your shared Maven cache.

In your application's POM (with `spring-boot-starter-parent` 4.1.1):
In your application's POM (with `spring-boot-starter-parent` 4.1.2):

```xml
<properties>
<jackson-bom.version>3.1.7</jackson-bom.version>
<jackson-bom.version>3.2.4</jackson-bom.version>
<tomcat.version>11.0.27</tomcat.version>
</properties>
<dependencyManagement>
Expand All @@ -47,7 +47,7 @@ In your application's POM (with `spring-boot-starter-parent` 4.1.1):
</dependencies>
```

For MySQL use `com.mysql:mysql-connector-j`. The Jackson and Tomcat overrides pick up security fixes missing from Boot 4.1.1's defaults. The BOM aligns only Ogiri artifacts.
For MySQL use `com.mysql:mysql-connector-j`. The Jackson override matches the Jackson version Ogiri is built against; the Tomcat pin matches Boot 4.1.2's default and keeps older Boot 4.1.x releases on a patched Tomcat. The BOM aligns only Ogiri artifacts.

## 2. Create the tables

Expand Down
6 changes: 3 additions & 3 deletions examples/spring-app/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>4.1.1</version><relativePath/></parent>
<parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>4.1.2</version><relativePath/></parent>
<groupId>com.quantipixels.ogiri.examples</groupId><artifactId>spring-app</artifactId><version>0.1.0</version>
<properties><java.version>17</java.version><tomcat.version>11.0.27</tomcat.version><jackson-bom.version>3.1.7</jackson-bom.version></properties>
<!-- Boot 4.1.1 ships Tomcat 11.0.24 and Jackson 3.1.5, both with known advisories; keep Ogiri's patched 11.0.27 and 3.1.7 baseline. -->
<properties><java.version>17</java.version><tomcat.version>11.0.27</tomcat.version><jackson-bom.version>3.2.4</jackson-bom.version></properties>
<!-- Match Ogiri's build baseline: Tomcat 11.0.27 (Boot 4.1.2's default) and Jackson 3.2.4. -->
<dependencyManagement><dependencies>
<dependency><groupId>com.quantipixels.ogiri</groupId><artifactId>ogiri-bom</artifactId><version>0.1.0</version><type>pom</type><scope>import</scope></dependency>
</dependencies></dependencyManagement>
Expand Down
6 changes: 3 additions & 3 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,14 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.build.outputTimestamp>2026-09-07T00:00:00Z</project.build.outputTimestamp>
<!-- Runtime compatibility: Spring Boot 4.x, Java 17+, Jackson 3. Build tools require Java 21+. -->
<spring-boot.version>4.1.1</spring-boot.version>
<jackson.version>3.1.7</jackson.version><ogiri.test.jvm>${java.home}/bin/java</ogiri.test.jvm>
<spring-boot.version>4.1.2</spring-boot.version>
<jackson.version>3.2.4</jackson.version><ogiri.test.jvm>${java.home}/bin/java</ogiri.test.jvm>
<tomcat.version>11.0.27</tomcat.version>
<postgresql.version>42.7.13</postgresql.version>
</properties>
<dependencyManagement><dependencies>
<dependency><groupId>tools.jackson</groupId><artifactId>jackson-bom</artifactId><version>${jackson.version}</version><type>pom</type><scope>import</scope></dependency>
<!-- Boot 4.1.1 predates the fixes for CVE-2026-65905, CVE-2026-65182 and CVE-2026-68525. -->
<!-- Boot 4.1.2 ships this Tomcat; the explicit pin keeps the fixes for CVE-2026-65905, CVE-2026-65182 and CVE-2026-68525 if the Boot import changes. -->
<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>${tomcat.version}</version></dependency>
<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-el</artifactId><version>${tomcat.version}</version></dependency>
<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-websocket</artifactId><version>${tomcat.version}</version></dependency>
Expand Down