Repository navigation
Backport: Bump cyclonedx-core-java and json-schema-validtor libs - #6963
Merged
Merged
Conversation
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Up to standards ✅🟢 Issues
|
| Category | Results |
|---|---|
| Security | 1 critical |
🟢 Metrics 9 complexity
Metric Results Complexity 9
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
MockServer 5.15.0 depends on json-schema-validator 1.0.76, and every MockServer release since (7.0.0 through 7.5.0) requires json-schema-validator 3.x. Every cyclonedx-core-java release from 12.2.0 onwards requires json-schema-validator 2.x. There is no version pairing in which MockServer and an up-to-date cyclonedx-core-java can coexist, so MockServer blocks that dependency from ever being bumped again. WireMock is already used for HTTP mocking throughout the test suite, and the shaded wiremock-jre8-standalone artifact carries no json-schema-validator dependency of its own. Migrating the five remaining MockServer test classes to WireMock lets MockServer be dropped entirely. Signed-off-by: nscuro <nscuro@protonmail.com>
Bumps cyclonedx-core-java to 12.2.0 and json-schema-validator to 2.0.3 (the latter was blocking the former). Addresses a variety of breaking changes in json-schema-validator, among them: * Renaming and relocation of classes * Changes in default error message content Additionally, moves the schema validation logic entirely into our own `CycloneDxValidator` instead of delegating to cyclonedx-core-java. The reason for this is that I noticed during testing that cyclonedx-core-java does not cache schemas after first use, so every validation call would reload schemas from disk, and recompile them, which is just wasted work. Signed-off-by: nscuro <nscuro@protonmail.com>
nscuro
force-pushed
the
backport-pr-6515
branch
from
August 12, 2026 11:29
d03c772 to
16c9188
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Bumps cyclonedx-core-java to 12.2.0 and json-schema-validator to 2.0.3 (the latter was blocking the former).
Addresses a variety of breaking changes in json-schema-validator, among them:
Additionally, moves the schema validation logic entirely into our own
CycloneDxValidatorinstead of delegating to cyclonedx-core-java. The reason for this is that I noticed during testing that cyclonedx-core-java does not cache schemas after first use, so every validation call would reload schemas from disk, and recompile them, which is just wasted work.Addressed Issue
Backports #6515
Additional Details
This is a prerequisite for backporting CycloneDX 1.7 support.
It was necessary to migrate all remaining tests that still used
mockserverto WireMock, becausemockserverdepends on ajson-schema-validatorversion that is incompatible with whatcyclondedx-coreneeds. Unfortunately that creates a lot of noise in this PR, but it's all test code.Checklist
This PR fixes a defect, and I have provided tests to verify that the fix is effectiveThis PR introduces changes to the database model, and I have updated the migration changelog accordinglyThis PR introduces new or alters existing behavior, and I have updated the documentation accordinglyThis PR is a substantial change (per the ADR criteria), and I have added an ADR underdocs/adr/