fix: promote jsr305 and opentelemetry-api to api scope#360
fix: promote jsr305 and opentelemetry-api to api scope#360curfew-marathon wants to merge 2 commits into
Conversation
WireMock 3.x pulls in handlebars 4.3.1 which has a path traversal vulnerability (GHSA-r4gv-qr8j-p3pg) fixed in 4.5.2. WireMock 3.x has not backported the fix, so we force the core jar directly. handlebars-helpers cannot be forced to 4.5.2 as NumberHelper moved packages, breaking WireMock at runtime.
jsr305 annotations appear on public model method signatures. opentelemetry-api types appear in public return types of Attributes and Metrics.
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
WalkthroughGradle now pins Handlebars 4.5.2 for test runtime resolution and exposes JSR305 and OpenTelemetry dependencies through the library’s API configuration. ChangesGradle dependency updates
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (38.47%) is below the target coverage (80.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #360 +/- ##
=========================================
Coverage 38.47% 38.47%
Complexity 1267 1267
=========================================
Files 198 198
Lines 7704 7704
Branches 900 900
=========================================
Hits 2964 2964
Misses 4591 4591
Partials 149 149 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
build.gradle (1)
61-67: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAdd a Handlebars/WireMock templating compatibility test.
This forces only
handlebarscore to 4.5.2 while retaining WireMock’s transitive helper version. The suppliedApiExecutorTestcovers a literal body, so it does not exercise the helper linkage this mixed graph could break. Add a templated-response test before relying on./gradlew test; Gradle force rules override conflicting dependency requests. (docs.gradle.org)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build.gradle` around lines 61 - 67, Add a WireMock templated-response compatibility test alongside the existing ApiExecutorTest, exercising a response template helper rather than only a literal body. Ensure the test runs through the mixed Handlebars core/helper dependency graph created by the resolutionStrategy.force rule and verifies the templated response is rendered successfully.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@build.gradle`:
- Around line 61-67: Add a WireMock templated-response compatibility test
alongside the existing ApiExecutorTest, exercising a response template helper
rather than only a literal body. Ensure the test runs through the mixed
Handlebars core/helper dependency graph created by the resolutionStrategy.force
rule and verifies the templated response is rendered successfully.
Summary
Three dependencies were declared as
implementationinbuild.gradlebut expose their types through public method signatures. Consumers of this library need these types on the compile classpath, whichimplementationdoes not provide. This change promotes them toapiscope.jsr305 (
@Nonnull/@Nullable)These annotations appear on public method signatures across the model package. With
implementationscope, downstream consumers that reference those methods cannot resolve the annotation types at compile time.opentelemetry-api
Attributes.prepare()returnsio.opentelemetry.api.common.AttributesandMetrics.getMeter()returnsio.opentelemetry.api.metrics.Meter. Both are public methods, so the OTel types must be on the consumer compile classpath.opentelemetry-bom (platform)
Promoted alongside
opentelemetry-apiso that the BOM version constraint is propagated to consumers, consistent with how the Jackson BOM is handled.What was not changed
jackson-datatype-jsr310remainsimplementation: the module is registered internally and no JSR-310 serializer types appear in the public API.jackson-databind-nullableremainsimplementation:JsonNullabledoes not appear in any public method signature.Test plan
./gradlew testpasses with no failuresSummary by CodeRabbit
Security
Compatibility
Library API