Skip to content

fix(deps): update maven dependencies (major)#1914

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/major-maven-dependencies
Open

fix(deps): update maven dependencies (major)#1914
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/major-maven-dependencies

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 16, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
biz.aQute.bnd:bnd-maven-plugin (source) 6.4.07.2.1 age confidence
org.springframework:spring-framework-bom 6.2.167.0.6 age confidence
org.flywaydb:flyway-maven-plugin (source) 11.20.312.1.0 age confidence
org.flywaydb:flyway-core (source) 11.20.312.1.0 age confidence
org.eclipse.jgit:org.eclipse.jgit 6.10.1.202505221210-r7.6.0.202603022253-r age confidence
org.eclipse.lsp4j:org.eclipse.lsp4j.jsonrpc (source) 0.24.01.0.0 age confidence
org.codehaus.mojo:native2ascii-maven-plugin (source) 1.0-beta-12.1.1 age confidence
org.jetbrains.kotlin:kotlin-bom (source) 1.9.252.3.20 age confidence
org.junit.jupiter:junit-jupiter-engine (source) 5.14.36.0.3 age confidence
org.junit.jupiter:junit-jupiter-params (source) 5.14.36.0.3 age confidence
org.junit.jupiter:junit-jupiter-api (source) 5.14.36.0.3 age confidence
org.slf4j:slf4j-api (source, changelog) 1.7.362.0.17 age confidence

Release Notes

bndtools/bnd (biz.aQute.bnd:bnd-maven-plugin)

v7.2.1: Bnd/Bndtools 7.2.1

Compare Source

See Release Notes.

Full Changelog: bndtools/bnd@7.2.0...7.2.1

v7.2.0: Bnd/Bndtools 7.2.0

Compare Source

See Release Notes.

What's Changed


Configuration

📅 Schedule: Branch creation - "after 7am every weekday,before 7pm every weekday" in timezone CET, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@sonar-review-alpha
Copy link

sonar-review-alpha bot commented Mar 16, 2026

Summary

⚠️ Major Dependency Upgrades - Careful Testing Required

This PR contains significant major version bumps across several core dependencies, some of which may introduce breaking changes:

Most Notable Upgrades:

  • JUnit 5 → 6 (5.14.3 → 6.0.3) - Requires careful review of any test infrastructure changes
  • Kotlin 1.9 → 2.3 - Minor/patch language version jump but includes breaking changes
  • Spring Framework 6 → 7 - Major framework upgrade that may affect backend code
  • LSP4j 0.24 → 1.0 - Explicitly a 1.0 release, likely API stability improvements
  • Flyway 11 → 12 - Database migration tool upgrade
  • JGit 6 → 7 - Git operations library (note: upgrading to Java 17+ compatible version)
  • SLF4j 1.7 → 2.0 - Significant logging framework update

Key Considerations:

  • These upgrades span infrastructure (plugins), frameworks, libraries, and testing tools
  • The Renovate summary is truncated—check release notes for each package's breaking changes
  • Integration tests are included (custom-sensor-plugin, global-extension-plugin) and will validate API compatibility
  • Pay special attention to the Spring 7 and JUnit 6 upgrades, as they're most likely to have code-level impacts

Recommend running the full CI pipeline and manual integration testing before merge.

What reviewers should know

This comment highlights the significance of major version upgrades across testing frameworks, language runtime, and core libraries. It alerts reviewers to potential breaking changes while focusing on the most impactful upgrades (JUnit 6, Spring 7, Kotlin 2.3) that are most likely to require code changes. The comment complements the Renovate-generated description by emphasizing testing requirements and cross-cutting concerns.


  • Generate Walkthrough
  • Generate Diagram

🗣️ Give feedback

@hashicorp-vault-sonar-prod
Copy link

hashicorp-vault-sonar-prod bot commented Mar 16, 2026

Renovate Jira issue ID: SLCORE-2235

Copy link

@sonar-review-alpha sonar-review-alpha bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is one bug that needs fixing before merge.

🗣️ Give feedback


<!-- JGit 7 rely on Java 17 and only used by the backend, JGit 6 relying on Java 11 for the Java clients -->
<jgit6.version>6.10.1.202505221210-r</jgit6.version>
<jgit6.version>7.6.0.202603022253-r</jgit6.version>

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

jgit6.version has been set to a JGit 7.x release (7.6.0.202603022253-r), but the comment directly above this line explicitly states this property exists to pin JGit to version 6 for the Java 11 clients. client/java-client-utils (<maven.compiler.release>11</maven.compiler.release>) and client/java-client-dependencies both reference ${jgit6.version}. JGit 7 requires Java 17, so this will break compilation or runtime for the Eclipse/OSGi client.

On top of that, jgit6.version is now 7.6.0newer than jgit7.version (7.5.0), which is an obvious version inversion.

Renovate seems to have treated this as an ordinary bump without understanding the architectural split. jgit6.version should stay on the latest 6.x release; any JGit 7.x upgrade belongs solely in jgit7.version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants