TDB-19854 - Remove vulnerable dependencies

build-logic/src/main/java/org/ehcache/build/conventions/CheckstyleConvention.java

@@ -13,10 +13,28 @@ public void apply(Project project) {
     project.getPlugins().apply(CheckstylePlugin.class);
 
     project.getExtensions().configure(CheckstyleExtension.class, checkstyle -> {
+      checkstyle.setToolVersion("10.18.1");
       checkstyle.setConfigFile(project.getRootProject().file("config/checkstyle.xml"));
       Map<String, Object> properties = checkstyle.getConfigProperties();
       properties.put("projectDir", project.getProjectDir());
       properties.put("rootDir", project.getRootDir());
     });
+
+    project.getConfigurations().named("checkstyle", config -> {
+      config.getResolutionStrategy().dependencySubstitution(subs -> {
+        subs.substitute(subs.module("org.codehaus.plexus:plexus-utils:3.1.1"))
+          .using(subs.module("org.codehaus.plexus:plexus-utils:3.3.0"))
+          .because("Checkstyle 10.18.1 pulls mismatched plexus-utils versions");
+        subs.substitute(subs.module("org.apache.commons:commons-lang3:3.7"))
+          .using(subs.module("org.apache.commons:commons-lang3:3.8.1"))
+          .because("Checkstyle transitives mix commons-lang3 versions");
+        subs.substitute(subs.module("org.apache.httpcomponents:httpcore:4.4.13"))
+          .using(subs.module("org.apache.httpcomponents:httpcore:4.4.14"))
+          .because("Align httpcore to latest bugfix release");
+        subs.substitute(subs.module("commons-codec:commons-codec:1.11"))
+          .using(subs.module("commons-codec:commons-codec:1.15"))
+          .because("Checkstyle transitive dependencies depend on different commons-codec versions");
+      });
+    });
   }
 }

build-logic/src/main/java/org/ehcache/build/conventions/JavaConvention.java

@@ -22,6 +22,8 @@ public void apply(Project project) {
 
     dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "junit:junit:" + project.property("junitVersion"));
     dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.assertj:assertj-core:" + project.property("assertjVersion"));
+    dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "net.bytebuddy:byte-buddy:" + project.property("byteBuddyVersion"));
+    dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "net.bytebuddy:byte-buddy-agent:" + project.property("byteBuddyVersion"));
     dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.hamcrest:hamcrest:" + project.property("hamcrestVersion"));
     dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.mockito:mockito-core:" + project.property("mockitoVersion"));
     ModuleDependency md = (ModuleDependency)dependencies.add(JavaPlugin.TEST_IMPLEMENTATION_CONFIGURATION_NAME, "org.terracotta:terracotta-utilities-test-tools:" + project.property("terracottaUtilitiesVersion"));
@@ -35,6 +37,14 @@ public void apply(Project project) {
         subs.substitute(subs.module("org.hamcrest:hamcrest-library:1.3")).with(subs.module("org.hamcrest:hamcrest-library:" + project.property("hamcrestVersion")));
         subs.substitute(subs.module("junit:junit:4.12")).using(subs.module("junit:junit:4.13.1"));
       });
+      config.getResolutionStrategy().eachDependency(details -> {
+        String group = details.getRequested().getGroup();
+        String name = details.getRequested().getName();
+        if ("net.bytebuddy".equals(group) && ("byte-buddy".equals(name) || "byte-buddy-agent".equals(name))) {
+          details.useVersion(project.property("byteBuddyVersion").toString());
+          details.because("Align Byte Buddy family versions across AssertJ and Mockito");
+        }
+      });
     });
   }
 }

build-logic/src/main/java/org/ehcache/build/conventions/SpotbugsConvention.java

@@ -17,8 +17,8 @@ public void apply(Project project) {
     SpotBugsExtension spotbugs = project.getExtensions().getByType(SpotBugsExtension.class);
 
     spotbugs.getIgnoreFailures().set(false);
-    // Later versions of Spotbugs have stupid heuristics for EI_EXPOSE_REP*
-    spotbugs.getToolVersion().set("4.2.3");
+    spotbugs.getToolVersion().set("4.9.8");
+    spotbugs.getOmitVisitors().addAll("FindReturnRef", "ConstructorThrow");
 
     project.getPlugins().withType(JavaBasePlugin.class).configureEach(plugin -> {
 
@@ -46,6 +46,12 @@ public void apply(Project project) {
         subs.substitute(subs.module("org.apache.commons:commons-lang3:3.11"))
           .using(subs.module("org.apache.commons:commons-lang3:3.12.0"))
           .because("Spotbugs has dependency divergences");
+        subs.substitute(subs.module("org.apache.commons:commons-lang3:3.18.0"))
+          .using(subs.module("org.apache.commons:commons-lang3:3.19.0"))
+          .because("Spotbugs 4.9.8 has dependency divergences");
+        subs.substitute(subs.module("org.apache.logging.log4j:log4j-core:2.25.2"))
+          .using(subs.module("org.apache.logging.log4j:log4j-core:2.25.3"))
+          .because("Security vulnerability fix");
       });
     });
 

clustered/ehcache-client/src/test/java/org/ehcache/clustered/client/internal/service/DefaultClusteringServiceDestroyTest.java

@@ -55,6 +55,8 @@
 import static org.mockito.Mockito.when;
 import static org.mockito.Mockito.withSettings;
 
+import org.mockito.quality.Strictness;
+
 /**
  * DefaultClusteringServiceDestroyTest
  */
@@ -194,7 +196,7 @@ public void testDestroyOnPartialDestroyState() throws Exception {
 
   private void mockLockForWriteLockSuccess() throws org.terracotta.exception.EntityNotProvidedException, org.terracotta.exception.EntityNotFoundException, org.terracotta.exception.EntityVersionMismatchException {
     when(connection.<VoltronReadWriteLockClient, Object, Void>getEntityRef(same(VoltronReadWriteLockClient.class), eq(1L), any())).thenReturn(lockEntityRef);
-    VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().lenient());
+    VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().strictness(Strictness.LENIENT));
     when(lockEntityRef.fetchEntity(null)).thenReturn(lockClient);
 
     when(lockClient.tryLock(LockMessaging.HoldType.WRITE)).thenReturn(true);
@@ -203,7 +205,7 @@ private void mockLockForWriteLockSuccess() throws org.terracotta.exception.Entit
 
   private void mockLockForReadLockSuccess() throws org.terracotta.exception.EntityNotProvidedException, org.terracotta.exception.EntityNotFoundException, org.terracotta.exception.EntityVersionMismatchException {
     when(connection.<VoltronReadWriteLockClient, Object, Void>getEntityRef(same(VoltronReadWriteLockClient.class), eq(1L), any())).thenReturn(lockEntityRef);
-    VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().lenient());
+    VoltronReadWriteLockClient lockClient = mock(VoltronReadWriteLockClient.class, withSettings().strictness(Strictness.LENIENT));
     when(lockEntityRef.fetchEntity(null)).thenReturn(lockClient);
 
     when(lockClient.tryLock(LockMessaging.HoldType.READ)).thenReturn(true);

clustered/ehcache-common-api/src/main/java/org/ehcache/clustered/common/internal/store/ValueWrapper.java

@@ -25,7 +25,6 @@
 /**
  * ValueWrapper
  */
-@SuppressFBWarnings("EI_EXPOSE_REP")
 public class ValueWrapper implements Serializable {
 
   private static final long serialVersionUID = -4794738044295644587L;

clustered/osgi-test/build.gradle

@@ -65,8 +65,10 @@ configurations.all {
       substitute(module('org.ops4j.pax.url:pax-url-link:2.6.8'))
         .using(module('org.ops4j.pax.url:pax-url-link:2.6.11'))
       substitute(module('org.ops4j.pax.url:pax-url-aether:2.6.8'))
-      //  the 2 line has CVE-2025-48924 which is preventing build
-        .using(module('org.ops4j.pax.url:pax-url-aether:3.0.1'))
+        .using(module('org.ops4j.pax.url:pax-url-aether:2.6.17'))
+      substitute(module('org.apache.commons:commons-lang3:3.12.0'))
+        .using(module('org.apache.commons:commons-lang3:3.18.0'))
+        .because('CVE-2025-48924')
       substitute(module('org.osgi:org.osgi.util.function:1.1.0'))
         .using(module('org.osgi:org.osgi.util.function:1.2.0'))
         .because('Dependency divergence in org.osgi:org.osgi.util.promise:1.2.0')

core-spi-test/src/main/java/org/ehcache/internal/store/SPIStoreTester.java

@@ -18,6 +18,8 @@
 package org.ehcache.internal.store;
 
 import org.ehcache.core.spi.store.Store;
+import org.ehcache.spi.resilience.StoreAccessException;
+import org.ehcache.spi.test.LegalSPITesterException;
 import org.ehcache.spi.test.SPITester;
 
 /**
@@ -30,10 +32,39 @@
 
 public class SPIStoreTester<K, V> extends SPITester {
 
+  protected static final String SPI_WARNING = "Warning, an exception is thrown due to the SPI test";
+
   protected final StoreFactory<K,V> factory;
 
   public SPIStoreTester(final StoreFactory<K,V> factory) {
     this.factory = factory;
   }
 
+  @FunctionalInterface
+  protected interface StoreRunnable {
+    void run() throws StoreAccessException;
+  }
+
+  protected <T extends Throwable> T expectException(Class<T> expected, StoreRunnable action)
+      throws LegalSPITesterException {
+    try {
+      action.run();
+    } catch (Throwable throwable) {
+      if (expected.isInstance(throwable)) {
+        return expected.cast(throwable);
+      }
+      if (throwable instanceof StoreAccessException) {
+        throw new LegalSPITesterException(SPI_WARNING, throwable);
+      }
+      if (throwable instanceof RuntimeException) {
+        throw (RuntimeException) throwable;
+      }
+      if (throwable instanceof Error) {
+        throw (Error) throwable;
+      }
+      throw new AssertionError("Unexpected checked exception", throwable);
+    }
+    throw new AssertionError("Expected " + expected.getSimpleName() + " to be thrown");
+  }
+
 }

core-spi-test/src/main/java/org/ehcache/internal/store/StoreContainsKeyTest.java

@@ -73,14 +73,7 @@ public void nullKeyThrowsException()
 
     K key = null;
 
-    try {
-      kvStore.containsKey(key);
-      throw new AssertionError("Expected NullPointerException because the key is null");
-    } catch (NullPointerException e) {
-      // expected
-    } catch (StoreAccessException e) {
-      throw new LegalSPITesterException("Warning, an exception is thrown due to the SPI test");
-    }
+    expectException(NullPointerException.class, () -> kvStore.containsKey(key));
   }
 
   @SPITest

core-spi-test/src/main/java/org/ehcache/internal/store/StoreGetTest.java

@@ -115,14 +115,7 @@ public void nullKeyThrowsException()
 
     K key = null;
 
-    try {
-      kvStore.get(key);
-      throw new AssertionError("Expected NullPointerException because the key is null");
-    } catch (NullPointerException e) {
-      // expected
-    } catch (StoreAccessException e) {
-      throw new LegalSPITesterException("Warning, an exception is thrown due to the SPI test");
-    }
+    expectException(NullPointerException.class, () -> kvStore.get(key));
   }
 
   @SPITest

core-spi-test/src/main/java/org/ehcache/internal/store/StorePutIfAbsentTest.java

@@ -97,34 +97,24 @@ public void doesntMapKeyToValueWhenMappingExists()
 
   @SPITest
   public void nullKeyThrowsException()
-      throws StoreAccessException, IllegalAccessException, InstantiationException {
+      throws IllegalAccessException, InstantiationException, LegalSPITesterException {
     kvStore = factory.newStore();
 
     K key = null;
     V value = factory.createValue(1);
 
-    try {
-      kvStore.putIfAbsent(key, value, b -> {});
-      throw new AssertionError("Expected NullPointerException because the key is null");
-    } catch (NullPointerException e) {
-      // expected
-    }
+    expectException(NullPointerException.class, () -> kvStore.putIfAbsent(key, value, b -> {}));
   }
 
   @SPITest
   public void nullValueThrowsException()
-      throws StoreAccessException, IllegalAccessException, InstantiationException {
+      throws IllegalAccessException, InstantiationException, LegalSPITesterException {
     kvStore = factory.newStore();
 
     K key = factory.createKey(1);
     V value = null;
 
-    try {
-      kvStore.putIfAbsent(key, value, b -> {});
-      throw new AssertionError("Expected NullPointerException because the value is null");
-    } catch (NullPointerException e) {
-      // expected
-    }
+    expectException(NullPointerException.class, () -> kvStore.putIfAbsent(key, value, b -> {}));
   }
 
   @SPITest

core-spi-test/src/main/java/org/ehcache/internal/store/StorePutTest.java

@@ -64,14 +64,7 @@ public void nullKeyThrowsException()
     K key = null;
     V value = factory.createValue(1);
 
-    try {
-      kvStore.put(key, value);
-      throw new AssertionError("Expected NullPointerException because the key is null");
-    } catch (NullPointerException e) {
-      // expected
-    } catch (StoreAccessException e) {
-      throw new LegalSPITesterException("Warning, an exception is thrown due to the SPI test");
-    }
+    expectException(NullPointerException.class, () -> kvStore.put(key, value));
   }
 
   @SPITest
@@ -82,14 +75,7 @@ public void nullValueThrowsException()
     K key = factory.createKey(1);
     V value = null;
 
-    try {
-      kvStore.put(key, value);
-      throw new AssertionError("Expected NullPointerException because the value is null");
-    } catch (NullPointerException e) {
-      // expected
-    } catch (StoreAccessException e) {
-      throw new LegalSPITesterException("Warning, an exception is thrown due to the SPI test");
-    }
+    expectException(NullPointerException.class, () -> kvStore.put(key, value));
   }
 
   @SPITest

core-spi-test/src/main/java/org/ehcache/internal/store/StoreRemoveKeyTest.java

@@ -89,14 +89,7 @@ public void nullKeyThrowsException()
       throws IllegalAccessException, InstantiationException, LegalSPITesterException {
     kvStore = factory.newStore();
 
-    try {
-      kvStore.remove(null);
-      throw new AssertionError("Expected NullPointerException because the key is null");
-    } catch (NullPointerException e) {
-      // expected
-    } catch (StoreAccessException e) {
-      throw new LegalSPITesterException("Warning, an exception is thrown due to the SPI test");
-    }
+    expectException(NullPointerException.class, () -> kvStore.remove(null));
   }
 
   @SPITest

core-spi-test/src/main/java/org/ehcache/internal/store/StoreRemoveKeyValueTest.java

@@ -164,14 +164,7 @@ public void nullKeyThrowsException()
     K key = null;
     V value = factory.createValue(1);
 
-    try {
-      kvStore.remove(key, value);
-      throw new AssertionError("Expected NullPointerException because the key is null");
-    } catch (NullPointerException e) {
-      // expected
-    } catch (StoreAccessException e) {
-      throw new LegalSPITesterException("Warning, an exception is thrown due to the SPI test");
-    }
+    expectException(NullPointerException.class, () -> kvStore.remove(key, value));
   }
 
   @SPITest
@@ -182,14 +175,7 @@ public void nullValueThrowsException()
     K key = factory.createKey(1);
     V value = null;
 
-    try {
-      kvStore.remove(key, value);
-      throw new AssertionError("Expected NullPointerException because the value is null");
-    } catch (NullPointerException e) {
-      // expected
-    } catch (StoreAccessException e) {
-      throw new LegalSPITesterException("Warning, an exception is thrown due to the SPI test");
-    }
+    expectException(NullPointerException.class, () -> kvStore.remove(key, value));
   }
 
   @SPITest

core-spi-test/src/main/java/org/ehcache/internal/store/StoreReplaceKeyValueTest.java

@@ -117,14 +117,7 @@ public void nullKeyThrowsException()
     K key = null;
     V value = factory.createValue(1);
 
-    try {
-      kvStore.replace(key, value);
-      throw new AssertionError("Expected NullPointerException because the key is null");
-    } catch (NullPointerException e) {
-      // expected
-    } catch (StoreAccessException e) {
-      throw new LegalSPITesterException("Warning, an exception is thrown due to the SPI test");
-    }
+    expectException(NullPointerException.class, () -> kvStore.replace(key, value));
   }
 
   @SPITest
@@ -134,14 +127,7 @@ public void nullValueThrowsException()
 
     K key = factory.createKey(1);
 
-    try {
-      kvStore.replace(key, null);
-      throw new AssertionError("Expected NullPointerException because the value is null");
-    } catch (NullPointerException e) {
-      // expected
-    } catch (StoreAccessException e) {
-      throw new LegalSPITesterException("Warning, an exception is thrown due to the SPI test");
-    }
+    expectException(NullPointerException.class, () -> kvStore.replace(key, null));
   }
 
   @SPITest

demos/00-NoCache/build.gradle

@@ -0,0 +1,7 @@
+plugins {
+  id 'application'
+}
+
+application {
+  mainClass = 'org.ehcache.demos.peeper.PeeperServer'
+}

demos/00-NoCache/src/main/java/org/ehcache/demos/peeper/PeeperServer.java

@@ -0,0 +1,26 @@
+/*
+ * Copyright Terracotta, Inc.
+ * Copyright IBM Corp. 2024, 2025
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.ehcache.demos.peeper;
+
+import org.ehcache.demos.server.EmbeddedPeeperServer;
+
+public class PeeperServer {
+
+  public static void main(String[] args) throws Exception {
+    EmbeddedPeeperServer.run(PeeperServletContextListener::new, PeeperServlet::new);
+  }
+}