Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Gradle migration follow-ups (post-#326)

未关闭
  • 哪里不对？
#337 2 条评论 2 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 2 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
28/100
Issue 类型
重构
描述清晰度
基本清楚
活跃度
冷清
技术栈
java, kotlin
领域
build-system, developer-experience, tooling

调研方向

This is an umbrella follow-up to PR #326, not a single change. Start from the Gradle wrapper (currently 8.14.1), verifyDistributionPlacement (Task.project-at-execution deprecation), the Groovy build scripts, and the version catalog. Pick one checkbox only: Gradle 9 bump, Kotlin DSL, .gitignore header cleanup, BOM alignment (#389), or a named CVE bump. Done means that one item is complete with the existing byte-identical parity harness still green; do not treat the whole list as one first issue.

由索引模型根据 Issue 内容生成。

描述

licensing

PR #326 migrated the build from Ant to Gradle with output verified byte-identical. To keep that PR reviewable and parity-checkable, several improvements were deliberately deferred. This issue tracks them. Parent: #52.

Build tooling
  • Try Gradle 9. The wrapper ships on 8.14.1. Confirm the build runs clean under Gradle 9 and bump when it does. One known item to clear first: a Task.project-at-execution-time deprecation in verifyDistributionPlacement that Gradle 9 warns on and Gradle 10 removes. (raised by @jbeckers in #326)
  • Consider the Kotlin DSL for the build scripts. Currently Groovy; Kotlin is Gradle's official recommendation. (raised in #326, agreed as a follow-up)
  • Clean up stale .gitignore headers. ~111 inert commented section headers (# /client/src/com/...) date to the original 2017 .gitignore and still reference the pre-move layout. Update to src/main/java or drop them. (raised by @jbeckers in #326)
Dependencies
  • Align multi-artifact dependency families with BOMs. The catalog versions every artifact of a family independently, so a bot can bump part of a set and leave it incoherent with nothing to catch it. That is #389: log4j-api stayed at 2.25.3 while log4j-core and log4j-1.2-api moved to 2.25.4, and the server would not boot. Import platform(libs.<x>.bom) for log4j, jackson, netty, jetty, and the AWS SDK. Constrains versions only, pulls nothing transitively, flat explicit list stays intact.
  • Normalize to transitive resolution, one library at a time. The migration intentionally pins a non-transitive, audited set matching the historical vendored jars. Enable transitivity per library during routine version bumps, diff against the flat list, reconcile, re-verify with the parity harness. Flat lists remain better for scanning accuracy, so this is a slow bridge with no deadline. (objection from @jbeckers in the comments)
  • CVE burn-down. An initial dependency-check baseline flagged ~54 distinct CVEs across ~46 jars. Start with the one-line, parity-checkable bumps (netty, jackson-databind, pdfbox), then the harder ones: Jetty 9.4.57 (EOL line), MyBatis (#320), Derby, iText -> OpenPDF (#289), commons-httpclient -> httpclient5. See also #304.
  • Adopt byte-identical repackaged jars from Maven Central. 13 vendored jars are content-identical to Central artifacts (the HAPI 2.3 set, jtds, sqlite-jdbc, rsyntaxtextarea, autocomplete) and can be sourced from Central. The 3 genuine forks (javaparser 1.0.8, zip4j 1.3.3, not-going-to-be-commons-ssl) stay vendored.
主要语言
Java
星标
227
派生
81
平均合并
3 天 6 小时
30 天内合并 PR
15

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

OpenIntegrationEngine/engine 的其他 Issue

查看 OpenIntegrationEngine/engine 的全部 Issue

相似的 Issue

更多 Java Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。