build: jakarta-ready dependencies (PR 1 of jakarta migration #861) by ismisepaul · Pull Request #877 · OWASP/SecurityShepherd

ismisepaul · 2026-06-04T21:39:24Z

PR 1 of the Jakarta migration (#861) — build config only

First sub-PR of the stacked javax.* → jakarta.* migration. Targets the integration branch feat/jakarta-migration, not dev.

What this changes (pom.xml + .env only)

jakarta.servlet:jakarta.servlet-api:6.0.0 (was javax.servlet:javax.servlet-api:4.0.1)
Jakarta JSTL 3.0 API + Glassfish impl (was jstl:jstl:1.2)
org.eclipse.angus:angus-mail:2.0.3 (was com.sun.mail:javax.mail:1.6.2)
Remove javax:javaee-api:8.0.1 — pulls the legacy javax.* namespace back onto the classpath
Align Spring to 6.1.21 — spring-test (5.3.31), spring-core (6.0.2), spring-context (5.3.31) were inconsistent
Remove spring-mock:2.0.8 — Spring 6 spring-test provides the Jakarta MockHttpServletRequest / MockServletConfig
Remove fongo — unused (its only tests are @Disabled); rescue tracked in Modernize MongoDatabase off legacy com.mongodb.DB API + Testcontainers; rescue disabled MongoDatabaseIT tests #876
.env Tomcat base image 9.0 → 10.1 (first Jakarta-namespace Tomcat)

⚠️ Expected: this does not compile on its own

Source still imports javax.* until the next sub-PR (OpenRewrite mechanical rename). CI will be red on this PR by design — it's intentionally isolated as a small, reviewable build-config delta. Green build returns once the stack is complete.

Scope target

Spring 6.1.x (Jakarta EE 9 / Servlet 6.0 / Tomcat 10.1), not Spring 7 — per discussion on #869.

Refs #861. Rescue of disabled Mongo tests: #876.

🤖 Generated with Claude Code

@disabled

Build-config-only step of the javax -> jakarta migration. Does not compile on its own (source still imports javax.*); the mechanical import rename follows in the next sub-PR. - jakarta.servlet:jakarta.servlet-api:6.0.0 (was javax.servlet:javax.servlet-api:4.0.1) - jakarta JSTL 3.0 api + glassfish impl (was jstl:jstl:1.2) - org.eclipse.angus:angus-mail:2.0.3 (was com.sun.mail:javax.mail:1.6.2) - remove javax:javaee-api:8.0.1 (pulls the legacy javax namespace back in) - align Spring to 6.1.21 (spring-test 5.3.31, spring-core 6.0.2, spring-context 5.3.31 were inconsistent) - remove spring-mock:2.0.8 (Spring 6 spring-test provides the Jakarta mocks) - remove fongo (unused; tests @disabled, rescue tracked in #876) - .env Tomcat base image 9.0 -> 10.1 (first Jakarta-namespace Tomcat) Refs #861. Targets Spring 6.1.x (not 7) per discussion on #869.

Copilot

Pull request overview

Build-configuration-only step toward the javax.* → jakarta.* migration by updating core dependencies to Jakarta-ready equivalents and aligning versions for the upcoming codebase rename work.

Changes:

Replace legacy Java EE dependencies with Jakarta equivalents (Servlet 6.0, JSTL 3.0, Jakarta Mail via Angus) and remove javax:javaee-api.
Align Spring dependencies to 6.1.21 and remove obsolete spring-mock and unused fongo.
Bump the Tomcat Docker base tag to Tomcat 10.1 (Jakarta namespace).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pom.xml	Updates dependencies to Jakarta-ready artifacts (Servlet/JSTL/Mail), aligns Spring versions, and removes legacy/unused test deps.
.env	Switches the Tomcat Docker tag to 10.1 to match the Jakarta servlet stack.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

ismisepaul · 2026-06-04T21:53:08Z

CI dispatch — Build and Test

Manually dispatched "Build and Test" against this branch (sub-PRs into feat/jakarta-migration don't auto-trigger CI; the workflow only fires pull_request on master/dev, but it has workflow_dispatch):

▶️ https://github.com/OWASP/SecurityShepherd/actions/runs/26981822455

⚠️ Expected red: PR 1 is build-config only — the source still imports javax.* on this branch, so it won't compile alone. The green signal is on #878 (PR 1 + PR 2 combined), which compiles.

SeanDuggan

JSTL: API jar is redundant alongside the impl

Both are added at compile scope:

jakarta.servlet.jsp.jstl-api
jakarta.servlet.jsp.jstl

Drop the API artifact, keep only the impl

ismisepaul · 2026-06-05T14:07:10Z

JSTL: API jar is redundant alongside the impl

I verified this and we do need both. The Glassfish impl declares jakarta.servlet.jsp.jstl-api at provided scope, and Maven doesn't propagate provided transitively or package it into the WAR. Resolving the impl alone:

$ mvn dependency:tree   # impl only, no explicit API
\- org.glassfish.web:jakarta.servlet.jsp.jstl:jar:3.0.1:compile
   (no API on the classpath)

Tomcat 10.1 doesn't ship JSTL (it only provides servlet/jsp/el), so the API has to be bundled in the WAR ourselves. Dropping it would give ClassNotFoundException on jakarta.servlet.jsp.jstl.* at JSP render time.

…a-migration Brings the mechanical javax->jakarta import rename onto the integration branch so it carries the jakarta-ready dependencies (#877) and the renamed source (#878) together. Completes #861's integration branch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

@disabled

…a migration #861) (#946) * build: jakarta-ready dependencies (PR 1 of jakarta migration #861) Build-config-only step of the javax -> jakarta migration. Does not compile on its own (source still imports javax.*); the mechanical import rename follows in the next sub-PR. - jakarta.servlet:jakarta.servlet-api:6.0.0 (was javax.servlet:javax.servlet-api:4.0.1) - jakarta JSTL 3.0 api + glassfish impl (was jstl:jstl:1.2) - org.eclipse.angus:angus-mail:2.0.3 (was com.sun.mail:javax.mail:1.6.2) - remove javax:javaee-api:8.0.1 (pulls the legacy javax namespace back in) - align Spring to 6.1.21 (spring-test 5.3.31, spring-core 6.0.2, spring-context 5.3.31 were inconsistent) - remove spring-mock:2.0.8 (Spring 6 spring-test provides the Jakarta mocks) - remove fongo (unused; tests @disabled, rescue tracked in #876) - .env Tomcat base image 9.0 -> 10.1 (first Jakarta-namespace Tomcat) Refs #861. Targets Spring 6.1.x (not 7) per discussion on #869. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * build: jakarta-ready dependencies (PR 1 of jakarta migration #861) (#877) * build: jakarta-ready dependencies (PR 1 of jakarta migration #861) Build-config-only step of the javax -> jakarta migration. Does not compile on its own (source still imports javax.*); the mechanical import rename follows in the next sub-PR. - jakarta.servlet:jakarta.servlet-api:6.0.0 (was javax.servlet:javax.servlet-api:4.0.1) - jakarta JSTL 3.0 api + glassfish impl (was jstl:jstl:1.2) - org.eclipse.angus:angus-mail:2.0.3 (was com.sun.mail:javax.mail:1.6.2) - remove javax:javaee-api:8.0.1 (pulls the legacy javax namespace back in) - align Spring to 6.1.21 (spring-test 5.3.31, spring-core 6.0.2, spring-context 5.3.31 were inconsistent) - remove spring-mock:2.0.8 (Spring 6 spring-test provides the Jakarta mocks) - remove fongo (unused; tests @disabled, rescue tracked in #876) - .env Tomcat base image 9.0 -> 10.1 (first Jakarta-namespace Tomcat) Refs #861. Targets Spring 6.1.x (not 7) per discussion on #869. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * refactor: mechanical javax->jakarta import rename (PR 2 of jakarta migration #861) (#878) * refactor: javax->jakarta imports in servlets/module/challenge (PR2 #861) Mechanical OpenRewrite rename (JavaxMigrationToJakarta), imports only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: javax->jakarta imports in servlets/admin (PR2 #861) Mechanical OpenRewrite rename, imports only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: javax->jakarta imports in remaining servlets (module/lesson, api, root) (PR2 #861) Mechanical OpenRewrite rename, imports only. The invalidate()->logout() behavioral change OpenRewrite bundled into Login/Logout/MobileLogin/SLS/ACS was reverted; these commits are pure import renames. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: javax->jakarta imports in remaining src/main (PR2 #861) Mechanical OpenRewrite rename, imports only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: javax->jakarta imports in src/it and src/test (PR2 #861) Mechanical OpenRewrite rename, imports only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * style: re-sort imports after javax->jakarta rename (spotless) The OpenRewrite rename left jakarta.* imports ordered where javax.* used to sit, which fails google-java-format's import ordering in the lint-java job. Import order only; no code changes. Refs #861 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * build: make the bottom of the stack build on its own (Tomcat 10.1, no java-saml) Every PR in the Jakarta migration stack must pass CI by itself. This one didn't compile: ACS, Logout, SLS and SSOLogin passed jakarta servlet types to java-saml 2.9.0, which only accepts javax.servlet and has no Jakarta release. Its Docker build would also have failed: the Tomcat 9 era server.xml patch doesn't apply to Tomcat 10.1. - Remove java-saml. The SSO endpoints (ACS, SSOLogin, SLS, SSOMetadata) answer 503 "SAML SSO is unavailable during migration", and Logout drops its java-saml branch. SSO is off unless sso.enabled=true, and is reimplemented on pac4j-saml in #939 further up the stack, so the final code on dev is unchanged. - Regenerate serverxml.patch / webxml.patch against Tomcat 10.1.61's conf files (HTTPS via <SSLHostConfig>/<Certificate>), with the matching Dockerfile substitutions. Both apply exactly with the image's GNU patch. Verified locally: spotless, 169 unit tests, 312 integration tests, mvn -Pdocker install, docker compose build, and a Tomcat 10.1.61 smoke test (deploys, HTTP->HTTPS, TLS 1.3, login page, SSO endpoints 503). Refs #861 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: substitute HTTPS_PORT when redirectPort is on its own line Addresses review on #946. Tomcat 10.1's server.xml puts the HTTP connector's attributes on separate lines, so in the regenerated serverxml.patch redirectPort="HTTPS_PORT" is not followed by " />". The Dockerfile's sed required that suffix, left the literal HTTPS_PORT in conf/server.xml, and HTTP->HTTPS redirects ignored the configured port (it went unnoticed with the default 443). The sed now matches just the attribute, which works for both the Tomcat 10.1 and 11 patch layouts. Test: src/test/scripts/tomcat-config-test.sh, run in CI's build job after docker compose build, checks the built image's conf/server.xml redirects to HTTPS_PORT and has no HTTPS_PORT / TLS_KEYSTORE_* / ALIAS placeholders left. It fails on the previous Dockerfile (HTTPS_PORT=8443) and passes with the fix for 8443 and 443. Refs #861 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: SeanDuggan <sean.duggan4@gmail.com>

github-project-automation Bot added this to Security Shepherd Jun 4, 2026

github-project-automation Bot moved this to Backlog in Security Shepherd Jun 4, 2026

ismisepaul requested review from SeanDuggan and Copilot June 4, 2026 21:40

Copilot started reviewing on behalf of ismisepaul June 4, 2026 21:40

View session

Copilot AI reviewed Jun 4, 2026

View reviewed changes

Comment thread pom.xml Outdated

Potential fix for pull request finding

c53f6d3

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

ismisepaul mentioned this pull request Jun 4, 2026

refactor: mechanical javax->jakarta import rename (PR 2 of jakarta migration #861) #878

Merged

ismisepaul mentioned this pull request Jun 4, 2026

Migrate from javax.* (Java EE) to jakarta.* (Jakarta EE 9+) to enable Spring 6 / modern stack #861

Open

12 tasks

SeanDuggan reviewed Jun 5, 2026

View reviewed changes

ismisepaul merged commit a105fcb into feat/jakarta-migration Jun 5, 2026
3 of 6 checks passed

ismisepaul mentioned this pull request Jun 5, 2026

Migrate javax.* → jakarta.* (Jakarta EE 9+ / Servlet 6.0 / Tomcat 10.1) #881

Closed

ismisepaul mentioned this pull request Oct 23, 2026

build: Jakarta EE namespace migration and lint fix (PRs 1-3 of jakarta migration #861) #946

Merged

Navigation Menu

Repository navigation

build: jakarta-ready dependencies (PR 1 of jakarta migration #861) - #877

build: jakarta-ready dependencies (PR 1 of jakarta migration #861)#877
ismisepaul merged 2 commits into
feat/jakarta-migrationfrom
pr1-jakarta-build-config

ismisepaul commented Jun 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

ismisepaul commented Jun 4, 2026

Uh oh!

SeanDuggan left a comment

Uh oh!

ismisepaul commented Jun 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

ismisepaul commented Jun 4, 2026

PR 1 of the Jakarta migration (#861) — build config only

What this changes (pom.xml + .env only)

⚠️ Expected: this does not compile on its own

Scope target

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

ismisepaul commented Jun 4, 2026

CI dispatch — Build and Test

Uh oh!

SeanDuggan left a comment

Choose a reason for hiding this comment

Uh oh!

ismisepaul commented Jun 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants