fix: upgrade org.springframework.boot:spring-boot to 4.0.6, 3.5.14 (CVE-2026-40973)#3514
Conversation
Automated dependency upgrade by OrbisAI Security
PR SummaryUpgraded Spring Boot versions to address CVE-2026-40973; migrated codebase from javax.* to jakarta.* namespaces for Spring Boot 3.5.x; updated dependencies including Hibernate, JAXB, and annotation-api; refactored persistence code to use jakarta.persistence and safer getSingleResult with NoResultException; aligned DI imports and test infrastructure; updated module pom files and code references accordingly. Changes
autogenerated by presubmit.ai |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (1)
- 5c38bd8: fix: CVE-2026-40973 security vulnerability
Automated dependency upgrade by OrbisAI Security
Files Processed (1)
- pom.xml (1 hunk)
Actionable Comments (0)
Skipped Comments (1)
-
pom.xml [42-42]
maintainability: "Version bump alignment with target Spring Boot version"
|
It's not going to work without software changes @orbisai0security |
Spring Boot 3.x requires Jakarta EE 9+ namespaces. This commit migrates all Jakarta EE-related javax imports to jakarta equivalents to support the Spring Boot 3.5.14 upgrade from CVE-2026-40973 fix. Changes: - Migrate javax.sql.DataSource → jakarta.sql.DataSource (28 files) - Migrate javax.persistence.* → jakarta.persistence.* (JPA annotations) - Migrate javax.annotation.PostConstruct → jakarta.annotation.PostConstruct - Migrate javax.inject.Inject → jakarta.inject.Inject - Update Hibernate 5.6.15 → 6.4.4 for Jakarta compatibility - Update jaxb-runtime 2.3.3 → 4.0.5 - Remove deprecated javax.xml.bind dependencies - Update javax.annotation-api → jakarta.annotation-api 3.0.0 Modules affected: transaction-script, domain-model, data-access-object, dao-factory, table-module, serialized-entity, serialized-lob, CQRS, polling-publisher, repository, dependency-injection Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Addressed this; however, there are changes in many files now. Pls review. |
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (1)
- a330d82: fix: migrate javax to jakarta namespaces for Spring Boot 3.5.14
Spring Boot 3.x requires Jakarta EE 9+ namespaces. This commit
migrates all Jakarta EE-related javax imports to jakarta equivalents
to support the Spring Boot 3.5.14 upgrade from CVE-2026-40973 fix.
Changes:
- Migrate javax.sql.DataSource → jakarta.sql.DataSource (28 files)
- Migrate javax.persistence.* → jakarta.persistence.* (JPA annotations)
- Migrate javax.annotation.PostConstruct → jakarta.annotation.PostConstruct
- Migrate javax.inject.Inject → jakarta.inject.Inject
- Update Hibernate 5.6.15 → 6.4.4 for Jakarta compatibility
- Update jaxb-runtime 2.3.3 → 4.0.5
- Remove deprecated javax.xml.bind dependencies
- Update javax.annotation-api → jakarta.annotation-api 3.0.0
Modules affected: transaction-script, domain-model, data-access-object,
dao-factory, table-module, serialized-entity, serialized-lob, CQRS,
polling-publisher, repository, dependency-injection
Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Files Processed (29)
- command-query-responsibility-segregation/pom.xml (1 hunk)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Author.java (1 hunk)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Book.java (1 hunk)
- dao-factory/src/main/java/com/iluwatar/daofactory/H2CustomerDAO.java (1 hunk)
- dao-factory/src/main/java/com/iluwatar/daofactory/H2DataSourceFactory.java (1 hunk)
- dao-factory/src/test/java/com/iluwatar/daofactory/H2CustomerDAOTest.java (1 hunk)
- data-access-object/src/main/java/com/iluwatar/dao/App.java (1 hunk)
- data-access-object/src/main/java/com/iluwatar/dao/DbCustomerDao.java (1 hunk)
- data-access-object/src/test/java/com/iluwatar/dao/DbCustomerDaoTest.java (1 hunk)
- dependency-injection/src/main/java/com/iluwatar/dependency/injection/GuiceWizard.java (1 hunk)
- domain-model/src/main/java/com/iluwatar/domainmodel/App.java (1 hunk)
- domain-model/src/main/java/com/iluwatar/domainmodel/CustomerDaoImpl.java (1 hunk)
- domain-model/src/main/java/com/iluwatar/domainmodel/ProductDaoImpl.java (1 hunk)
- domain-model/src/test/java/com/iluwatar/domainmodel/CustomerDaoImplTest.java (1 hunk)
- domain-model/src/test/java/com/iluwatar/domainmodel/ProductDaoImplTest.java (1 hunk)
- domain-model/src/test/java/com/iluwatar/domainmodel/TestUtils.java (1 hunk)
- metadata-mapping/pom.xml (1 hunk)
- polling-publisher/polling-service/src/main/java/com/iluwatar/polling/DataRepository.java (1 hunk)
- polling-publisher/pom.xml (1 hunk)
- repository/src/main/java/com/iluwatar/repository/AppConfig.java (1 hunk)
- repository/src/test/java/com/iluwatar/repository/AppConfigTest.java (1 hunk)
- serialized-entity/src/main/java/com/iluwatar/serializedentity/App.java (1 hunk)
- serialized-entity/src/main/java/com/iluwatar/serializedentity/CountrySchemaSql.java (1 hunk)
- serialized-lob/src/main/java/com/iluwatar/slob/dbservice/DatabaseService.java (1 hunk)
- service-layer/pom.xml (1 hunk)
- table-module/src/main/java/com/iluwatar/tablemodule/App.java (1 hunk)
- table-module/src/main/java/com/iluwatar/tablemodule/UserTableModule.java (1 hunk)
- table-module/src/test/java/com/iluwatar/tablemodule/UserTableModuleTest.java (1 hunk)
- transaction-script/src/main/java/com/iluwatar/transactionscript/App.java (1 hunk)
Actionable Comments (0)
Skipped Comments (16)
-
command-query-responsibility-segregation/pom.xml [57-63]
best_practice: "Dependency upgrade for Jakarta compatibility"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Author.java [27-27]
maintainability: "Jakarta JPA imports"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Book.java [27-27]
maintainability: "Jakarta JPA imports"
-
dao-factory/src/main/java/com/iluwatar/daofactory/H2CustomerDAO.java [36-36]
maintainability: "DataSource migration to Jakarta namespace"
-
dao-factory/src/main/java/com/iluwatar/daofactory/H2DataSourceFactory.java [27-27]
maintainability: "DataSource import in factory"
-
dao-factory/src/test/java/com/iluwatar/daofactory/H2CustomerDAOTest.java [39-39]
maintainability: "Test import updated to Jakarta DataSource"
-
data-access-object/src/main/java/com/iluwatar/dao/App.java [29-29]
maintainability: "Jakarta DataSource in App"
-
domain-model/src/main/java/com/iluwatar/domainmodel/App.java [30-30]
maintainability: "Jakarta DataSource in App"
-
domain-model/src/main/java/com/iluwatar/domainmodel/CustomerDaoImpl.java [32-32]
maintainability: "Jakarta DataSource in CustomerDaoImpl"
-
domain-model/src/main/java/com/iluwatar/domainmodel/ProductDaoImpl.java [36-36]
maintainability: "Jakarta DataSource in ProductDaoImpl"
-
domain-model/src/test/java/com/iluwatar/domainmodel/CustomerDaoImplTest.java [33-33]
maintainability: "Jakarta DataSource in tests"
-
domain-model/src/test/java/com/iluwatar/domainmodel/ProductDaoImplTest.java [36-36]
maintainability: "Jakarta DataSource in tests"
-
domain-model/src/test/java/com/iluwatar/domainmodel/TestUtils.java [28-28]
maintainability: "Jakarta DataSource in TestUtils"
-
repository/src/main/java/com/iluwatar/repository/AppConfig.java [29-29]
maintainability: "Jakarta DataSource in AppConfig"
-
polling-publisher/pom.xml [87-91]
maintainability: "Add jakarta.annotation-api dependency"
-
service-layer/pom.xml [56-61]
maintainability: "Jakarta Persistence API dependency"
|
✅ Changes Applied I've updated the code based on your feedback: The PR upgraded Hibernate from 5.6.15.Final to 6.4.4.Final (to support Spring Boot 3.5.14 / Jakarta EE 9+), but did not update the Java source files in the
Files modified:
The changes have been pushed to this PR branch. Please review! |
There was a problem hiding this comment.
🚨 Pull request needs attention.
Review Summary
Commits Considered (1)
Files Processed (2)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java (9 hunks)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java (5 hunks)
Actionable Comments (4)
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [43-43]
possible issue: "Possible non-unique username risk in author lookup"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [45-45]
possible bug: "Handle potential non-unique result for author lookup"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [57-57]
possible issue: "Possible non-unique result for book lookup"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [59-59]
possible bug: "Handle potential non-unique result for book lookup"
Skipped Comments (10)
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [84-84]
best practice: "Persist new book within transaction"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [95-95]
maintainability: "Ignore return value of merge; potential detached state handling"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [51-51]
best practice: "DTO constructor expression for Author"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [52-52]
best practice: "Specify result type for constructor query"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [53-53]
readability: "Verify parameter name consistency"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [69-69]
readability: "Book DTO lookup"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [83-83]
best_practice: "Author books query filter"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [84-84]
best_practice: "Specify result type for author books query"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [85-85]
readability: "Bind username for author books"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [71-71]
best_practice: "Book DTO constructor expression"
| Author author; | ||
| try (var session = sessionFactory.openSession()) { | ||
| var query = session.createQuery("from Author where username=:username"); | ||
| var query = session.createQuery("from Author where username=:username", Author.class); |
There was a problem hiding this comment.
Potential NonUniqueResultException if username is not unique; consider enforcing a unique constraint on the username column and/or handling NonUniqueResultException to avoid runtime failures.
There was a problem hiding this comment.
@orbisai0security can you address code review comments?
| var query = session.createQuery("from Author where username=:username", Author.class); | ||
| query.setParameter("username", username); | ||
| author = (Author) query.uniqueResult(); | ||
| author = query.uniqueResult(); |
There was a problem hiding this comment.
If the username is not unique, uniqueResult may throw NonUniqueResultException. Ensure username is unique at the DB level or switch to a safe retrieval strategy (e.g., getResultList and enforce single element).
| Book book; | ||
| try (var session = sessionFactory.openSession()) { | ||
| var query = session.createQuery("from Book where title=:title"); | ||
| var query = session.createQuery("from Book where title=:title", Book.class); |
There was a problem hiding this comment.
Similar risk as above for fetching a Book by title. Ensure title column is unique or handle multiple results gracefully.
| var query = session.createQuery("from Book where title=:title", Book.class); | ||
| query.setParameter("title", title); | ||
| book = (Book) query.uniqueResult(); | ||
| book = query.uniqueResult(); |
There was a problem hiding this comment.
Retrieving a single Book with uniqueResult can throw NonUniqueResultException if multiple books share the same title. Consider DB-level constraints or safer retrieval.
|
✅ Changes Applied I've updated the code based on your feedback: The code review flagged that Files modified:
The changes have been pushed to this PR branch. Please review! |
- Sort jakarta.persistence.Column import alphabetically before Entity - Add blank lines around @Column-annotated fields in Author and Book - Fix indentation of Long.class argument in createNativeQuery call Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
🚨 Pull request needs attention.
Review Summary
Commits Considered (5)
-
7e4d545: fix: correct Spotless formatting violations in CQRS module
-
Sort jakarta.persistence.Column import alphabetically before Entity
-
Add blank lines around @Column-annotated fields in Author and Book
-
Fix indentation of Long.class argument in createNativeQuery call
Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com
- 4929b68: Apply code changes: @orbisai0security can you address code review comm...
- a76f885: Apply code changes: It's not going to work without software changes @o...
- a330d82: fix: migrate javax to jakarta namespaces for Spring Boot 3.5.14
Spring Boot 3.x requires Jakarta EE 9+ namespaces. This commit
migrates all Jakarta EE-related javax imports to jakarta equivalents
to support the Spring Boot 3.5.14 upgrade from CVE-2026-40973 fix.
Changes:
- Migrate javax.sql.DataSource → jakarta.sql.DataSource (28 files)
- Migrate javax.persistence.* → jakarta.persistence.* (JPA annotations)
- Migrate javax.annotation.PostConstruct → jakarta.annotation.PostConstruct
- Migrate javax.inject.Inject → jakarta.inject.Inject
- Update Hibernate 5.6.15 → 6.4.4 for Jakarta compatibility
- Update jaxb-runtime 2.3.3 → 4.0.5
- Remove deprecated javax.xml.bind dependencies
- Update javax.annotation-api → jakarta.annotation-api 3.0.0
Modules affected: transaction-script, domain-model, data-access-object,
dao-factory, table-module, serialized-entity, serialized-lob, CQRS,
polling-publisher, repository, dependency-injection
Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
- 5c38bd8: fix: CVE-2026-40973 security vulnerability
Automated dependency upgrade by OrbisAI Security
Files Processed (30)
- command-query-responsibility-segregation/pom.xml (1 hunk)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java (9 hunks)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Author.java (2 hunks)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Book.java (2 hunks)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java (5 hunks)
- dao-factory/src/main/java/com/iluwatar/daofactory/H2CustomerDAO.java (1 hunk)
- dao-factory/src/main/java/com/iluwatar/daofactory/H2DataSourceFactory.java (1 hunk)
- dao-factory/src/test/java/com/iluwatar/daofactory/H2CustomerDAOTest.java (1 hunk)
- data-access-object/src/main/java/com/iluwatar/dao/App.java (1 hunk)
- data-access-object/src/main/java/com/iluwatar/dao/DbCustomerDao.java (1 hunk)
- data-access-object/src/test/java/com/iluwatar/dao/DbCustomerDaoTest.java (1 hunk)
- dependency-injection/src/main/java/com/iluwatar/dependency/injection/GuiceWizard.java (1 hunk)
- domain-model/src/main/java/com/iluwatar/domainmodel/App.java (1 hunk)
- domain-model/src/main/java/com/iluwatar/domainmodel/CustomerDaoImpl.java (1 hunk)
- domain-model/src/main/java/com/iluwatar/domainmodel/ProductDaoImpl.java (1 hunk)
- domain-model/src/test/java/com/iluwatar/domainmodel/CustomerDaoImplTest.java (1 hunk)
- domain-model/src/test/java/com/iluwatar/domainmodel/ProductDaoImplTest.java (1 hunk)
- domain-model/src/test/java/com/iluwatar/domainmodel/TestUtils.java (1 hunk)
- metadata-mapping/pom.xml (1 hunk)
- polling-publisher/polling-service/src/main/java/com/iluwatar/polling/DataRepository.java (1 hunk)
- polling-publisher/pom.xml (1 hunk)
- pom.xml (1 hunk)
- repository/src/main/java/com/iluwatar/repository/AppConfig.java (1 hunk)
- repository/src/test/java/com/iluwatar/repository/AppConfigTest.java (1 hunk)
- serialized-entity/src/main/java/com/iluwatar/serializedentity/App.java (1 hunk)
- serialized-entity/src/main/java/com/iluwatar/serializedentity/CountrySchemaSql.java (1 hunk)
- serialized-lob/src/main/java/com/iluwatar/slob/dbservice/DatabaseService.java (1 hunk)
- service-layer/pom.xml (1 hunk)
- table-module/src/main/java/com/iluwatar/tablemodule/App.java (1 hunk)
- table-module/src/main/java/com/iluwatar/tablemodule/UserTableModule.java (1 hunk)
Actionable Comments (1)
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [43-46]
possible_bug: "Hibernate 6 API: uniqueResult() deprecation"
Skipped Comments (9)
-
command-query-responsibility-segregation/pom.xml [57-57]
possible issue: "Upgrade Hibernate Core to 6.x"
-
command-query-responsibility-segregation/pom.xml [62-62]
best_practice: "Migrate JAXB runtime to Jakarta"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Author.java [46-47]
maintainability: "Unique constraint on username"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Book.java [50-51]
maintainability: "Unique constraint on title"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [51-55]
readability: "Query construction with DTO"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [63-69]
readability: "Query for Book DTO"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [95-102]
readability: "Authors count native query"
-
repository/src/main/java/com/iluwatar/repository/AppConfig.java [29-30]
best_practice: "Jakarta DataSource in AppConfig"
-
pom.xml [42-42]
best_practice: "Root POM Spring Boot version"
| var query = session.createQuery("from Author where username=:username", Author.class); | ||
| query.setParameter("username", username); | ||
| author = (Author) query.uniqueResult(); | ||
| author = query.uniqueResult(); | ||
| } |
There was a problem hiding this comment.
When creating a typed query, use getSingleResult instead of uniqueResult() in Hibernate 6 to avoid deprecation/removal. If you must keep uniqueResult(), wrap in try/catch to handle NonUniqueResultException.
javax.sql.DataSource is part of the JDK standard library. There is no jakarta.sql namespace; the prior migration was incorrect. This reverts all 24 files that were incorrectly changed from javax.sql to jakarta.sql. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
🚨 Pull request needs attention.
Review Summary
Commits Considered (1)
- d545dbd: fix: revert jakarta.sql to javax.sql — jakarta.sql does not exist
javax.sql.DataSource is part of the JDK standard library. There is no
jakarta.sql namespace; the prior migration was incorrect. This reverts
all 24 files that were incorrectly changed from javax.sql to jakarta.sql.
Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com
Files Processed (10)
- command-query-responsibility-segregation/pom.xml (1 hunk)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java (9 hunks)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Author.java (2 hunks)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Book.java (2 hunks)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java (5 hunks)
- dependency-injection/src/main/java/com/iluwatar/dependency/injection/GuiceWizard.java (1 hunk)
- metadata-mapping/pom.xml (1 hunk)
- polling-publisher/polling-service/src/main/java/com/iluwatar/polling/DataRepository.java (1 hunk)
- polling-publisher/pom.xml (1 hunk)
- service-layer/pom.xml (1 hunk)
Actionable Comments (2)
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [43-45]
possible bug: "Hibernate 6: use of potentially deprecated API for single-result query"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [57-60]
possible bug: "Hibernate 6: replace uniqueResult with safe single-result retrieval"
Skipped Comments (15)
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [73-73]
maintainability: "Persisting a new entity; potential duplicate constraint risk"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [84-84]
maintainability: "Persisting child entity; ensure relationship state"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [95-95]
best_practice: "Use merge for updates (replaces update)"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [106-106]
best_practice: "Use merge for updates (replaces update) [username]"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [117-117]
best_practice: "Use merge for updates (replaces update) [email]"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [128-128]
best_practice: "Use merge for book title update"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [139-139]
best_practice: "Use merge for book price update"
-
polling-publisher/polling-service/src/main/java/com/iluwatar/polling/DataRepository.java [30-30]
maintainability: "Jakarta PostConstruct migration"
-
dependency-injection/src/main/java/com/iluwatar/dependency/injection/GuiceWizard.java [27-27]
maintainability: "Jakarta Inject import"
-
polling-publisher/pom.xml [87-91]
maintenance: "Add jakarta.annotation-api dependency"
-
service-layer/pom.xml [56-58]
maintenance: "Upgrade JAXB runtime to 4.0.5"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Author.java [27-31]
maintainability: "Migrate Author entity imports to Jakarta"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Author.java [46-47]
maintainability: "Enforce username uniqueness"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Book.java [27-33]
maintainability: "Migrate Book entity imports to Jakarta"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Book.java [50-51]
maintainability: "Enforce title uniqueness"
| var query = session.createQuery("from Author where username=:username", Author.class); | ||
| query.setParameter("username", username); | ||
| author = (Author) query.uniqueResult(); | ||
| author = query.uniqueResult(); |
There was a problem hiding this comment.
In Hibernate 6, uniqueResult() is deprecated/removed. This pattern can throw NonUniqueResultException or be removed in future. Prefer getSingleResult() wrapped in a try/catch for NoResultException, or switch to getResultList() and enforce a single element.
There was a problem hiding this comment.
@orbisai0security can you address code review comments?
| var query = session.createQuery("from Book where title=:title", Book.class); | ||
| query.setParameter("title", title); | ||
| book = (Book) query.uniqueResult(); | ||
| book = query.uniqueResult(); | ||
| } |
There was a problem hiding this comment.
Similarly, this uses uniqueResult() on a typed query for Book. Apply the same migration strategy as above to avoid runtime issues with Hibernate 6.
Spring Boot 3.5.x manages JUnit Platform 1.12.x. Keeping junit.version at 5.11.4 caused a version split where Surefire's forked JVM could not find OutputDirectoryProvider (added in Platform 1.12), crashing health-check tests. Align the pinned version with what Spring Boot 3.5.14 ships. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (1)
- 24ca501: fix: bump JUnit to 5.12.2 to match Spring Boot 3.5.x
Spring Boot 3.5.x manages JUnit Platform 1.12.x. Keeping junit.version
at 5.11.4 caused a version split where Surefire's forked JVM could not
find OutputDirectoryProvider (added in Platform 1.12), crashing health-check
tests. Align the pinned version with what Spring Boot 3.5.14 ships.
Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com
Files Processed (1)
- pom.xml (1 hunk)
Actionable Comments (0)
Skipped Comments (1)
-
pom.xml [42-43]
enhancement: "Mismatch between PR description and actual dependency versions"
mockito-junit-jupiter:5.16.1 (pinned in partial-response and microservices-log-aggregation) pulls junit-jupiter-api:5.12.1 transitively. Without an explicit management entry, the api jar lands as 5.12.1 while the engine is 5.12.2, causing the Jupiter TestEngine to fail at test discovery. Adding the api entry to dependencyManagement enforces 5.12.2 across all modules. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (1)
- 32c3b2d: fix: pin junit-jupiter-api in dependencyManagement to 5.12.2
mockito-junit-jupiter:5.16.1 (pinned in partial-response and
microservices-log-aggregation) pulls junit-jupiter-api:5.12.1
transitively. Without an explicit management entry, the api jar
lands as 5.12.1 while the engine is 5.12.2, causing the Jupiter
TestEngine to fail at test discovery. Adding the api entry to
dependencyManagement enforces 5.12.2 across all modules.
Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com
Files Processed (1)
- pom.xml (2 hunks)
Actionable Comments (0)
Skipped Comments (2)
-
pom.xml [42-43]
maintainability: "Clarify upgrade target and consistency"
-
pom.xml [316-321]
maintainability: "JUnit 5 API alignment"
Spring Boot 3.5.x targets Jakarta EE 9+; javax.annotation is no longer on the classpath. Replace the fully-qualified @javax.annotation.PreDestroy with the jakarta equivalent. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
spring-kafka-test:3.3.2 (pulled by polling-publisher) is built on Spring Framework 6.2.x which ships JUnit Platform 1.11.x. That 1.11.x transitive wins Maven's nearest-wins resolution for junit-platform-commons, leaving junit-jupiter-engine:5.12.2 unable to initialize against a 1.11.x commons jar — causing "TestEngine failed to discover tests". Replacing the four individual junit-jupiter-* dependencyManagement entries with a single junit-bom import (5.12.2) locks every Platform and Jupiter artifact to aligned 1.12.2/5.12.2 versions, overriding the Kafka transitive. This also covers the same latent conflict in microservices-log-aggregation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (10)
- 614909c: fix: import junit-bom to align all platform+jupiter versions
spring-kafka-test:3.3.2 (pulled by polling-publisher) is built on Spring
Framework 6.2.x which ships JUnit Platform 1.11.x. That 1.11.x transitive
wins Maven's nearest-wins resolution for junit-platform-commons, leaving
junit-jupiter-engine:5.12.2 unable to initialize against a 1.11.x commons
jar — causing "TestEngine failed to discover tests".
Replacing the four individual junit-jupiter-* dependencyManagement entries
with a single junit-bom import (5.12.2) locks every Platform and Jupiter
artifact to aligned 1.12.2/5.12.2 versions, overriding the Kafka transitive.
This also covers the same latent conflict in microservices-log-aggregation.
Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com
- db466ef: fix: migrate javax.annotation.PreDestroy to jakarta in DataSourceService
Spring Boot 3.5.x targets Jakarta EE 9+; javax.annotation is no longer
on the classpath. Replace the fully-qualified @javax.annotation.PreDestroy
with the jakarta equivalent.
Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com
- 32c3b2d: fix: pin junit-jupiter-api in dependencyManagement to 5.12.2
mockito-junit-jupiter:5.16.1 (pinned in partial-response and
microservices-log-aggregation) pulls junit-jupiter-api:5.12.1
transitively. Without an explicit management entry, the api jar
lands as 5.12.1 while the engine is 5.12.2, causing the Jupiter
TestEngine to fail at test discovery. Adding the api entry to
dependencyManagement enforces 5.12.2 across all modules.
Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com
- 24ca501: fix: bump JUnit to 5.12.2 to match Spring Boot 3.5.x
Spring Boot 3.5.x manages JUnit Platform 1.12.x. Keeping junit.version
at 5.11.4 caused a version split where Surefire's forked JVM could not
find OutputDirectoryProvider (added in Platform 1.12), crashing health-check
tests. Align the pinned version with what Spring Boot 3.5.14 ships.
Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com
- d545dbd: fix: revert jakarta.sql to javax.sql — jakarta.sql does not exist
javax.sql.DataSource is part of the JDK standard library. There is no
jakarta.sql namespace; the prior migration was incorrect. This reverts
all 24 files that were incorrectly changed from javax.sql to jakarta.sql.
Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com
-
7e4d545: fix: correct Spotless formatting violations in CQRS module
-
Sort jakarta.persistence.Column import alphabetically before Entity
-
Add blank lines around @Column-annotated fields in Author and Book
-
Fix indentation of Long.class argument in createNativeQuery call
Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com
- 4929b68: Apply code changes: @orbisai0security can you address code review comm...
- a76f885: Apply code changes: It's not going to work without software changes @o...
- a330d82: fix: migrate javax to jakarta namespaces for Spring Boot 3.5.14
Spring Boot 3.x requires Jakarta EE 9+ namespaces. This commit
migrates all Jakarta EE-related javax imports to jakarta equivalents
to support the Spring Boot 3.5.14 upgrade from CVE-2026-40973 fix.
Changes:
- Migrate javax.sql.DataSource → jakarta.sql.DataSource (28 files)
- Migrate javax.persistence.* → jakarta.persistence.* (JPA annotations)
- Migrate javax.annotation.PostConstruct → jakarta.annotation.PostConstruct
- Migrate javax.inject.Inject → jakarta.inject.Inject
- Update Hibernate 5.6.15 → 6.4.4 for Jakarta compatibility
- Update jaxb-runtime 2.3.3 → 4.0.5
- Remove deprecated javax.xml.bind dependencies
- Update javax.annotation-api → jakarta.annotation-api 3.0.0
Modules affected: transaction-script, domain-model, data-access-object,
dao-factory, table-module, serialized-entity, serialized-lob, CQRS,
polling-publisher, repository, dependency-injection
Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
- 5c38bd8: fix: CVE-2026-40973 security vulnerability
Automated dependency upgrade by OrbisAI Security
Files Processed (12)
- command-query-responsibility-segregation/pom.xml (1 hunk)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java (9 hunks)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Author.java (2 hunks)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Book.java (2 hunks)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java (5 hunks)
- dependency-injection/src/main/java/com/iluwatar/dependency/injection/GuiceWizard.java (1 hunk)
- metadata-mapping/pom.xml (1 hunk)
- polling-publisher/polling-service/src/main/java/com/iluwatar/polling/DataRepository.java (1 hunk)
- polling-publisher/polling-service/src/main/java/com/iluwatar/polling/DataSourceService.java (2 hunks)
- polling-publisher/pom.xml (1 hunk)
- pom.xml (2 hunks)
- service-layer/pom.xml (1 hunk)
Actionable Comments (0)
Skipped Comments (12)
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [40-46]
possible issue: "Hibernate 6: avoid deprecated uniqueResult for single-result queries"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [57-63]
possible issue: "Hibernate 6: avoid deprecated uniqueResult for single-result queries (Book)"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Author.java [43-50]
maintainability: "Database-level uniqueness for username"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Book.java [47-54]
maintainability: "Database-level uniqueness for title"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [48-55]
possible bug: "Hibernate 6: replace uniqueResult with getSingleResult in author query"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [63-70]
possible bug: "Hibernate 6: replace uniqueResult with getSingleResult in book query"
-
polling-publisher/pom.xml [83-91]
maintainability: "Migrate annotation API to Jakarta"
-
polling-publisher/polling-service/src/main/java/com/iluwatar/polling/DataSourceService.java [96-99]
maintenance: "Add Jakarta PreDestroy lifecycle hook"
-
polling-publisher/pom.xml [42-44]
maintainability: "Bump Spring Boot and test BOM versions"
-
service-layer/pom.xml [56-60]
maintainability: "Migrate JAXB dependencies to Jakarta"
-
metadata-mapping/pom.xml [55-60]
maintainability: "Remove javax.xml.bind JAXB API (Jakarta migration)"
-
polling-publisher/pom.xml [83-91]
maintainability: "Migrate annotation API to Jakarta"
jakarta.annotation.PostConstruct must come before java.util.* imports (alphabetically: jakarta < java). The previous jakarta migration placed it after the java imports, violating Google Java Format ordering. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| <version>6.4.4.Final</version> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.glassfish.jaxb</groupId> |
There was a problem hiding this comment.
Same Hibernate 6 migration issue as above, but for Book retrieval by title. Consider using getSingleResult() with appropriate exception handling or getResultList() to guard against multiple results.
There was a problem hiding this comment.
@orbisai0security can you address code review comments?
| Author.class); | ||
| sqlQuery.setParameter(AppConstants.USER_NAME, username); | ||
| authorDto = sqlQuery.uniqueResult(); | ||
| } |
There was a problem hiding this comment.
This typed HQL uses uniqueResult on a typed query. In Hibernate 6, getSingleResult() is preferred, and exceptions should be handled to cover no result or multiple results. Consider switching to getSingleResult() with try/catch or getResultList() with a single element check.
| Book.class); | ||
| sqlQuery.setParameter("title", title); | ||
| bookDto = sqlQuery.uniqueResult(); | ||
| } |
There was a problem hiding this comment.
See note above about uniqueResult in Hibernate 6 for book DTO retrieval. Prefer getSingleResult() or safe getResultList() usage.
| bookcount = (BigInteger) sqlQuery.uniqueResult(); | ||
| bookcount = BigInteger.valueOf(sqlQuery.uniqueResult()); | ||
| } | ||
| return bookcount; |
There was a problem hiding this comment.
Using native query for count is fine, but ensure mapping of id and username works; in Hibernate 6, uniqueResult() should be replaced with getSingleResult() or getResultList() with single element; handle NoResultException.
| authorcount = BigInteger.valueOf(sqlQuery.uniqueResult()); | ||
| } | ||
| return authorcount; | ||
| } |
There was a problem hiding this comment.
Replace uniqueResult with getSingleResult or getResultList to handle null/no results and deprecation in Hibernate 6.
| Author.class); | ||
| sqlQuery.setParameter(AppConstants.USER_NAME, username); | ||
| authorDto = sqlQuery.uniqueResult(); | ||
| } |
There was a problem hiding this comment.
Deprecated uniqueResult on typed query; migrate to getSingleResult with proper exception handling.
| <junit.version>5.11.4</junit.version> | ||
| <spring-boot.version>3.5.14</spring-boot.version> | ||
| <junit.version>5.12.2</junit.version> | ||
| <mockito.version>5.14.2</mockito.version> |
There was a problem hiding this comment.
Spring Boot version configured to 3.5.14 and JUnit version 5.12.2. The PR title mentions 4.0.6; make sure the intended target aligns with your upgrade plan and CI compatibility.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #3514 +/- ##
============================================
- Coverage 83.30% 83.29% -0.01%
- Complexity 4025 4027 +2
============================================
Files 1060 1060
Lines 14246 14250 +4
Branches 686 688 +2
============================================
+ Hits 11867 11870 +3
Misses 2094 2094
- Partials 285 286 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
✅ Changes Applied I've updated the code based on your feedback: The review feedback consistently flagged that Changes in
Changes in
Files modified:
The changes have been pushed to this PR branch. Please review! |
There was a problem hiding this comment.
🚨 Pull request needs attention.
Review Summary
Commits Considered (1)
- 679b8e3: Apply code changes: @orbisai0security can you address code review comm...
Files Processed (2)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java (8 hunks)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java (4 hunks)
Actionable Comments (2)
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [47-50]
possible_bug: "Do not close SessionFactory on NoResultException."
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [55-60]
possible_bug: "Do not close SessionFactory on NoResultException (Book lookup)."
Skipped Comments (2)
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [90-90]
best_practice: "Replace list() with getResultList() for typed query."
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java [106-109]
best_practice: "Count queries: simplify NoResultException handling; consider getSingleResult without catch."
| } catch (NoResultException e) { | ||
| HibernateUtil.getSessionFactory().close(); | ||
| throw new NullPointerException("Author " + username + " doesn't exist!"); | ||
| } |
There was a problem hiding this comment.
Do not close the global SessionFactory when a query returns no result. Closing the SessionFactory will make subsequent DB operations fail. Prefer returning a null/Optional or throwing a domain-specific exception instead of a NullPointerException.
There was a problem hiding this comment.
@orbisai0security can you address code review comments?
| try (var session = sessionFactory.openSession()) { | ||
| var query = session.createQuery("from Book where title=:title"); | ||
| var query = session.createQuery("from Book where title=:title", Book.class); | ||
| query.setParameter("title", title); | ||
| book = (Book) query.uniqueResult(); | ||
| } | ||
| if (book == null) { | ||
| HibernateUtil.getSessionFactory().close(); | ||
| throw new NullPointerException("Book " + title + " doesn't exist!"); | ||
| try { | ||
| return query.getSingleResult(); | ||
| } catch (NoResultException e) { |
There was a problem hiding this comment.
Similar issue for missing Book: avoid closing the SessionFactory on NoResultException and avoid throwing a NullPointerException. Align behavior with author lookup or return null.
|
✅ Changes Applied I've updated the code based on your feedback: The review flagged two issues in
Both fixes are applied to Files modified:
The changes have been pushed to this PR branch. Please review! |
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (1)
- 6e44a5b: Apply code changes: @orbisai0security can you address code review comm...
Files Processed (1)
- command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java (8 hunks)
Actionable Comments (0)
Skipped Comments (10)
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [30-30]
best practice: "Import for NoResultException"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [43-50]
possible issue: "Handle single-result query for author lookup"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [55-62]
possible issue: "Handle single-result query for book lookup"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [68-72]
best_practice: "Persist new Author"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [78-83]
best_practice: "Persist new Book"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [89-94]
maintainability: "Merge detached Author when updating"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [100-105]
maintainability: "Merge detached Author when updating username"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [111-116]
maintainability: "Merge detached Author when updating email"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [122-127]
maintainability: "Merge detached Book when updating title"
-
command-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java [133-137]
maintainability: "Merge detached Book when updating price"
Done. Pls review. |
3 participants
Summary
Upgrade org.springframework.boot:spring-boot from 3.4.5 to 4.0.6, 3.5.14 to fix CVE-2026-40973.
Vulnerability
CVE-2026-40973anti-corruption-layer/pom.xmlDescription: Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory
Evidence
Scanner confirmation: trivy rule
CVE-2026-40973flagged this pattern.Production code: This file is in the production codebase, not test-only code.
Threat Model Context
This is a Java service - vulnerabilities in servlets/controllers are remotely exploitable.
Changes
pom.xmlVerification
This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.
Automated security fix by OrbisAI Security