[GEODE-10466] Complete Jakarta EE 10, Spring 6.x, Spring Shell 3.x, Apache HttpComponents 5.x, and Jetty 12 migration

.github/workflows/gradle.yml

@@ -435,7 +435,7 @@ jobs:
             geode-connectors:distributedTest \
             geode-old-client:distributedTest \
             extensions:geode-modules:distributedTest \
-            extensions:geode-modules-tomcat8:distributedTest --console=plain --no-daemon
+            extensions:geode-modules-tomcat10:distributedTest --console=plain --no-daemon
       - uses: actions/upload-artifact@v4
         if: failure()
         with:

TESTING.md

@@ -13,8 +13,10 @@ Tests are broken up into five types - unit, integration, distributed, acceptance
   `./gradlew distributedTest`
 * Acceptance tests: test Geode from end user perspective  
   `./gradlew acceptanceTest`
-* Upgrade tests: test compatibility between versions of Geode and rolling upgrades  
+* Upgrade tests: test backwards compatibility and rolling upgrades between versions of Geode  
   `./gradlew upgradeTest`
+
+  **Note**: Rolling upgrades are **NOT supported** across the Jakarta EE 10 migration boundary (pre-migration → post-migration) for Tomcat session replication due to the javax.servlet → jakarta.servlet API incompatibility. Rolling upgrades within the same API era continue to work.
 
 ## Running Individual Tests
 To run an individual test, you can either

boms/geode-all-bom/src/test/resources/expected-pom.xml

@@ -50,7 +50,7 @@
       <dependency>
         <groupId>com.arakelian</groupId>
         <artifactId>java-jq</artifactId>
-        <version>1.3.0</version>
+        <version>2.0.0</version>
       </dependency>
       <dependency>
         <groupId>com.carrotsearch.randomizedtesting</groupId>
@@ -195,7 +195,7 @@
       <dependency>
         <groupId>io.micrometer</groupId>
         <artifactId>micrometer-core</artifactId>
-        <version>1.9.1</version>
+        <version>1.14.0</version>
       </dependency>
       <dependency>
         <groupId>io.swagger.core.v3</groupId>
@@ -415,7 +415,7 @@
       <dependency>
         <groupId>org.slf4j</groupId>
         <artifactId>slf4j-api</artifactId>
-        <version>1.7.36</version>
+        <version>2.0.17</version>
       </dependency>
       <dependency>
         <groupId>org.springframework.hateoas</groupId>

build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy

@@ -37,32 +37,52 @@ class DependencyConstraints {
     deps.put("commons-lang3.version", "3.18.0")
     deps.put("commons-validator.version", "1.7")
     deps.put("fastutil.version", "8.5.8")
-    deps.put("javax.activation.version", "1.2.0")
-    deps.put("javax.transaction-api.version", "1.3")
+    deps.put("jakarta.activation.version", "2.1.3")
+    deps.put("jakarta.transaction.version", "2.0.1")
+    deps.put("jakarta.xml.bind.version", "4.0.2")
+    deps.put("jakarta.servlet.version", "6.0.0")
+    deps.put("jakarta.resource.version", "2.1.0")
+    deps.put("jakarta.mail.version", "2.1.2")
+    deps.put("jakarta.annotation.version", "2.1.1")
+    deps.put("jakarta.ejb.version", "4.0.1")
     deps.put("jgroups.version", "3.6.20.Final")
     deps.put("log4j.version", "2.17.2")
-    deps.put("micrometer.version", "1.9.1")
+    deps.put("log4j-slf4j2-impl.version", "2.23.1")
+    deps.put("micrometer.version", "1.14.0")
     deps.put("shiro.version", "1.13.0")
-    deps.put("slf4j-api.version", "1.7.36")
+    deps.put("slf4j-api.version", "2.0.17")
+    deps.put("jakarta.transaction-api.version", "2.0.1")
     deps.put("jboss-modules.version", "1.11.0.Final")
     deps.put("jackson.version", "2.17.0")
     deps.put("jackson.databind.version", "2.17.0")
-    deps.put("springshell.version", "1.2.0.RELEASE")
-    deps.put("springframework.version", "5.3.21")
+    // Spring Framework 6.x Migration
+    deps.put("springshell.version", "3.3.3")
+    deps.put("springframework.version", "6.1.14")
+    deps.put("springboot.version", "3.3.5")
+    deps.put("springsecurity.version", "6.3.4")
+    deps.put("springhateoas.version", "2.3.3")
+    deps.put("springldap.version", "3.2.7")
+    deps.put("springdoc.version", "2.6.0")
 
     // These version numbers are used in testing various versions of tomcat and are consumed explicitly
     // in will be called explicitly in the relevant extensions module, and respective configurations
     // in geode-assembly.gradle.  Moreover, dependencyManagement does not seem to play nicely when
     // specifying @zip in a dependency, the manner in which we consume them in custom configurations.
     // This would possibly be corrected if they were proper source sets.
+    // Note: Tomcat 6/7/8/9 versions kept for upgradeTest (downloads old Geode releases)
     deps.put("tomcat6.version", "6.0.37")
     deps.put("tomcat7.version", "7.0.109")
     deps.put("tomcat8.version", "8.5.66")
     deps.put("tomcat9.version", "9.0.62")
+    // Jakarta EE - Tomcat 10.1+ and 11.x support
+    deps.put("tomcat10.version", "10.1.33")
+    deps.put("tomcat11.version", "11.0.11")
 
     // The jetty version is also hard-coded in geode-assembly:test
     // at o.a.g.sessions.tests.GenericAppServerInstall.java
-    deps.put("jetty.version", "9.4.57.v20241219")
+    // Jetty 12.0.x for Jakarta EE 10 (Servlet 6.0) compatibility
+    // Jetty 12 reorganized modules under ee10, ee9, ee8 packages
+    deps.put("jetty.version", "12.0.27")
 
     // These versions are referenced in test.gradle, which is aggressively injected into all projects.
     deps.put("junit.version", "4.13.2")
@@ -88,7 +108,8 @@ class DependencyConstraints {
         // informal, inter-group dependencySet
         api(group: 'antlr', name: 'antlr', version: get('antlr.version'))
         api(group: 'cglib', name: 'cglib', version: get('cglib.version'))
-        api(group: 'com.arakelian', name: 'java-jq', version: '1.3.0')
+        // GEODE-10466: Requires native library support for both x86_64 and ARM Mac
+        api(group: 'com.arakelian', name: 'java-jq', version: '2.0.0')
         api(group: 'com.carrotsearch.randomizedtesting', name: 'randomizedtesting-runner', version: '2.7.9')
         api(group: 'com.github.davidmoten', name: 'geo', version: '0.8.0')
         api(group: 'com.github.stefanbirkner', name: 'system-rules', version: '1.19.0')
@@ -100,10 +121,12 @@ class DependencyConstraints {
         api(group: 'com.nimbusds', name:'nimbus-jose-jwt', version:'8.11')
         // Pinning transitive dependency from spring-security-oauth2 to clean up our licenses.
         api(group: 'com.nimbusds', name: 'oauth2-oidc-sdk', version: '8.9')
-        api(group: 'com.sun.activation', name: 'javax.activation', version: get('javax.activation.version'))
+        api(group: 'jakarta.activation', name: 'jakarta.activation-api', version: get('jakarta.activation.version'))
         api(group: 'com.sun.istack', name: 'istack-commons-runtime', version: '4.0.1')
-        api(group: 'com.sun.mail', name: 'javax.mail', version: '1.6.2')
-        api(group: 'com.sun.xml.bind', name: 'jaxb-impl', version: '2.3.2')
+        api(group: 'jakarta.mail', name: 'jakarta.mail-api', version: get('jakarta.mail.version'))
+        api(group: 'jakarta.xml.bind', name: 'jakarta.xml.bind-api', version: get('jakarta.xml.bind.version'))
+        api(group: 'org.glassfish.jaxb', name: 'jaxb-runtime', version: '4.0.2')
+        api(group: 'org.glassfish.jaxb', name: 'jaxb-core', version: '4.0.2')
         api(group: 'com.tngtech.archunit', name:'archunit-junit4', version: '0.15.0')
         api(group: 'com.zaxxer', name: 'HikariCP', version: '4.0.3')
         api(group: 'commons-beanutils', name: 'commons-beanutils', version: '1.11.0')
@@ -124,13 +147,14 @@ class DependencyConstraints {
         api(group: 'io.swagger.core.v3', name: 'swagger-annotations', version: '2.2.22')
         api(group: 'org.hdrhistogram', name: 'HdrHistogram', version: '2.2.2')
         api(group: 'it.unimi.dsi', name: 'fastutil', version: get('fastutil.version'))
-        api(group: 'javax.annotation', name: 'javax.annotation-api', version: '1.3.2')
-        api(group: 'javax.annotation', name: 'jsr250-api', version: '1.0')
-        api(group: 'javax.ejb', name: 'ejb-api', version: '3.0')
-        api(group: 'javax.mail', name: 'javax.mail-api', version: '1.6.2')
-        api(group: 'javax.resource', name: 'javax.resource-api', version: '1.7.1')
-        api(group: 'javax.servlet', name: 'javax.servlet-api', version: '3.1.0')
-        api(group: 'javax.xml.bind', name: 'jaxb-api', version: '2.3.1')
+        api(group: 'jakarta.annotation', name: 'jakarta.annotation-api', version: get('jakarta.annotation.version'))
+        api(group: 'jakarta.annotation', name: 'jsr250-api', version: '1.0')
+        api(group: 'jakarta.ejb', name: 'jakarta.ejb-api', version: get('jakarta.ejb.version'))
+        api(group: 'jakarta.mail', name: 'jakarta.mail-api', version: get('jakarta.mail.version'))
+        api(group: 'jakarta.resource', name: 'jakarta.resource-api', version: get('jakarta.resource.version'))
+        api(group: 'jakarta.servlet', name: 'jakarta.servlet-api', version: get('jakarta.servlet.version'))
+        api(group: 'jakarta.transaction', name: 'jakarta.transaction-api', version: get('jakarta.transaction.version'))
+        api(group: 'jakarta.xml.bind', name: 'jakarta.xml.bind-api', version: get('jakarta.xml.bind.version'))
         api(group: 'joda-time', name: 'joda-time', version: '2.12.7')
         api(group: 'junit', name: 'junit', version: get('junit.version'))
         api(group: 'mx4j', name: 'mx4j-tools', version: '3.0.1')
@@ -146,15 +170,25 @@ class DependencyConstraints {
         api(group: 'org.apache.commons', name: 'commons-lang3', version: get('commons-lang3.version'))
         api(group: 'org.apache.commons', name: 'commons-text', version: 1.9)
         api(group: 'org.apache.derby', name: 'derby', version: '10.14.2.0')
+        // Apache HttpComponents 5.x - Modern HTTP client with HTTP/2 support
+        api(group: 'org.apache.httpcomponents.client5', name: 'httpclient5', version: '5.4.4')
+        api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5', version: '5.3.4')
+        api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5-h2', version: '5.3.4')
+        // Legacy HttpComponents 4.x (keep temporarily during migration, remove after complete)
         api(group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.13')
         api(group: 'org.apache.httpcomponents', name: 'httpcore', version: '4.4.15')
         api(group: 'org.apache.shiro', name: 'shiro-core', version: get('shiro.version'))
         api(group: 'org.assertj', name: 'assertj-core', version: '3.22.0')
         api(group: 'org.awaitility', name: 'awaitility', version: '4.2.0')
         api(group: 'org.buildobjects', name: 'jproc', version: '2.8.0')
-        api(group: 'org.codehaus.cargo', name: 'cargo-core-uberjar', version: '1.9.12')
+        api(group: 'org.codehaus.cargo', name: 'cargo-core-uberjar', version: '1.10.24')
+        // Jetty 12: Core server module stays in org.eclipse.jetty
         api(group: 'org.eclipse.jetty', name: 'jetty-server', version: get('jetty.version'))
-        api(group: 'org.eclipse.jetty', name: 'jetty-webapp', version: get('jetty.version'))
+        // Jetty 12: Servlet and webapp modules moved to ee10 package for Jakarta EE 10
+        api(group: 'org.eclipse.jetty.ee10', name: 'jetty-ee10-servlet', version: get('jetty.version'))
+        api(group: 'org.eclipse.jetty.ee10', name: 'jetty-ee10-webapp', version: get('jetty.version'))
+        // Jetty 12: Annotations module for ServletContainerInitializer discovery
+        api(group: 'org.eclipse.jetty.ee10', name: 'jetty-ee10-annotations', version: get('jetty.version'))
         api(group: 'org.eclipse.persistence', name: 'javax.persistence', version: '2.2.1')
         api(group: 'org.httpunit', name: 'httpunit', version: '1.7.3')
         api(group: 'org.iq80.snappy', name: 'snappy', version: '0.5')
@@ -166,9 +200,11 @@ class DependencyConstraints {
         api(group: 'org.postgresql', name: 'postgresql', version: '42.2.8')
         api(group: 'org.skyscreamer', name: 'jsonassert', version: '1.5.0')
         api(group: 'org.slf4j', name: 'slf4j-api', version: get('slf4j-api.version'))
-        api(group: 'org.springframework.hateoas', name: 'spring-hateoas', version: '1.5.0')
-        api(group: 'org.springframework.ldap', name: 'spring-ldap-core', version: '2.4.0')
-        api(group: 'org.springframework.shell', name: 'spring-shell', version: get('springshell.version'))
+        api(group: 'org.apache.logging.log4j', name: 'log4j-slf4j2-impl', version: get('log4j-slf4j2-impl.version'))
+        api(group: 'jakarta.transaction', name: 'jakarta.transaction-api', version: get('jakarta.transaction-api.version'))
+        api(group: 'org.springframework.hateoas', name: 'spring-hateoas', version: get('springhateoas.version'))
+        api(group: 'org.springframework.ldap', name: 'spring-ldap-core', version: get('springldap.version'))
+        api(group: 'org.springframework.shell', name: 'spring-shell-starter', version: get('springshell.version'))
         api(group: 'org.testcontainers', name: 'testcontainers', version: '1.21.3')
         api(group: 'pl.pragmatists', name: 'JUnitParams', version: '1.1.0')
         api(group: 'xerces', name: 'xercesImpl', version: '2.12.0')
@@ -206,8 +242,8 @@ class DependencyConstraints {
       entry('junit-quickcheck-generators')
     }
 
-    dependencySet(group: 'org.springdoc', version: '1.6.8') {
-      entry('springdoc-openapi-ui')
+    dependencySet(group: 'org.springdoc', version: get('springdoc.version')) {
+      entry('springdoc-openapi-starter-webmvc-ui')
     }
 
     dependencySet(group: 'mx4j', version: '3.0.2') {
@@ -223,9 +259,13 @@ class DependencyConstraints {
       entry('log4j-slf4j-impl')
     }
 
-    dependencySet(group: 'org.apache.lucene', version: '6.6.6') {
-      entry('lucene-analyzers-common')
-      entry('lucene-analyzers-phonetic')
+    // Apache Lucene 9.12.3 - Upgraded for Jakarta EE 10 compatibility
+    // Previous: 6.6.6 (2017) - Incompatible with modern Jakarta EE stack
+    // Lucene 9.x requires Java 11+ and is designed for Jakarta EE compatibility
+    // NOTE: Artifact names changed in Lucene 9.x: analyzers-* → analysis-*
+    dependencySet(group: 'org.apache.lucene', version: '9.12.3') {
+      entry('lucene-analysis-common')     // was: lucene-analyzers-common
+      entry('lucene-analysis-phonetic')   // was: lucene-analyzers-phonetic
       entry('lucene-core')
       entry('lucene-queryparser')
       entry('lucene-test-framework')
@@ -252,7 +292,7 @@ class DependencyConstraints {
       entry('selenium-support')
     }
 
-    dependencySet(group: 'org.springframework.security', version: '5.6.5') {
+    dependencySet(group: 'org.springframework.security', version: get('springsecurity.version')) {
       entry('spring-security-config')
       entry('spring-security-core')
       entry('spring-security-ldap')
@@ -264,22 +304,30 @@ class DependencyConstraints {
     }
 
     dependencySet(group: 'org.springframework', version: get('springframework.version')) {
+      // Spring 6.x requires explicit spring-aop dependency declaration
+      // Previously implicit via transitive dependencies, now must be declared explicitly.
+      // Missing this causes ClassNotFoundException: org.springframework.aop.TargetSource
+      // during Spring context initialization, preventing HTTP service and WAN gateway startup.
+      entry('spring-aop')
       entry('spring-aspects')
       entry('spring-beans')
       entry('spring-context')
       entry('spring-core')
       entry('spring-expression')
+      entry('spring-messaging')
       entry('spring-oxm')
       entry('spring-test')
       entry('spring-tx')
       entry('spring-web')
       entry('spring-webmvc')
     }
 
-    dependencySet(group: 'org.springframework.boot', version: '2.6.7') {
+    dependencySet(group: 'org.springframework.boot', version: get('springboot.version')) {
       entry('spring-boot-starter')
       entry('spring-boot-starter-jetty')
+      entry('spring-boot-starter-validation')
       entry('spring-boot-starter-web')
+      entry('spring-boot-autoconfigure')
     }
 
     dependencySet(group: 'org.jetbrains', version: '23.0.0') {

build-tools/scripts/src/main/groovy/geode-rat.gradle

@@ -40,7 +40,6 @@ rat {
     'wrapper/**',
     '**/build/**',
     '**/build-*/**',
-    '**/bin/**',
     '.buildinfo',
     '**/release-features.rendered', // just for jenkins
 

build.gradle

@@ -58,7 +58,30 @@ allprojects {
 
   repositories {
     mavenCentral()
-    maven { url "https://repo.spring.io/release" }
+    maven { 
+      url "https://jakarta.oss.sonatype.org/content/repositories/releases/"
+      name "Jakarta EE Releases"
+    }
+  }
+
+  // CRITICAL: Fix for Log4j/SLF4J circular binding conflict introduced during Jakarta/Spring Boot 3.x migration
+  // 
+  // Root Cause:
+  // - Geode uses Log4j Core directly and includes 'log4j-slf4j-impl' (routes SLF4J calls → Log4j)
+  // - Spring Boot 3.x includes 'spring-boot-starter-logging' which brings in 'log4j-to-slf4j' (routes Log4j calls → SLF4J)
+  // - Having BOTH creates a circular binding: SLF4J → Log4j → SLF4J
+  // 
+  // Symptoms:
+  // - ClassCastException: org.apache.logging.slf4j.SLF4JLogger cannot be cast to org.apache.logging.log4j.core.Logger
+  // - ClassCastException: org.apache.logging.slf4j.SLF4JLoggerContext cannot be cast to org.apache.logging.log4j.core.LoggerContext
+  // - Occurs in Log4jLoggingProvider.getRootLoggerContext() when LogManager.getRootLogger() returns SLF4J logger instead of Log4j logger
+  //
+  // Solution:
+  // Exclude 'log4j-to-slf4j' globally. Geode's logging architecture requires Log4j Core to be the primary logging implementation,
+  // with SLF4J calls being routed TO Log4j (via log4j-slf4j-impl), not the other way around.
+  //
+  configurations.all {
+    exclude group: 'org.apache.logging.log4j', module: 'log4j-to-slf4j'
   }
 
   buildRoot = buildRoot.trim()