Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -76,8 +76,10 @@ allprojects {
utilities
}
configurations.configureEach {
// exclude log4j, which may come in transitively, from all configurations to avoid its potential vulnerabilities
// exclude log4j 1.x, which may come in transitively, from all configurations to avoid its potential vulnerabilities
exclude group: "log4j", module:"log4j"
// exclude to ensure we don't have Log4J to SLFJ adapters or other unwanted logging libraries added to modules
exclude group: "org.springframework.boot", module:"spring-boot-starter-logging"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@labkey-susanh this is how I suppressed this transitive dependency from being pulled into modules. Happy to shift to a better place if you have a recommendation.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

}
configurations.driver.setDescription("Dependencies used for Gradle SetUpProperties task")
configurations.utilities.setDescription("Utility binaries for use on Windows platform")
Expand Down Expand Up @@ -202,6 +204,13 @@ allprojects {
configurations.configureEach
{Configuration config ->
resolutionStrategy {
// spring-ai pulls a different version of antr-ST4 than the version pulled by query (via antlr)
force "org.antlr:ST4:${antlrST4Version}"
// also it pulls in a bunch of com.google.api dependencies which conflict with DiscvrLabKeyModules:SequenceAnalysis and wnprc-modules:WNPRC_EHR
force "com.google.api:api-common:${googleApiVersion}"
force "com.google.auth:google-auth-library-oauth2-http:${googleAuthVersion}"
force "com.google.auth:google-auth-library-credentials:${googleAuthVersion}"

// we force this version because we have compilation problems with version 1.9.2 of commons-beanutils, which is the version
// that is brought in by Gradle's conflict resolution as a result of our chosen versions for commons-validator (1.5.0) and commons-digester (1.8.1)
force "commons-beanutils:commons-beanutils:${commonsBeanutilsVersion}"
Expand Down
5 changes: 5 additions & 0 deletions gradle.properties
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,8 @@ annotationsVersion=15.0

antVersion=1.10.13

antlrST4Version=4.3.4

#Unifying version used by DISCVR and Premium
apacheDirectoryVersion=2.1.7
#Transitive dependency of Apache directory: 2.0.18 contains some regressions
Expand Down Expand Up @@ -153,6 +155,8 @@ flyingsaucerVersion=R8
fopVersion=2.11

# Force latest for consistency
googleApiVersion=2.47.0
googleAuthVersion=1.33.0
googleAutoValueAnnotationsVersion=1.10.4
googleErrorProneAnnotationsVersion=2.45.0
googleHttpClientVersion=2.0.2
Expand Down Expand Up @@ -288,6 +292,7 @@ snappyJavaVersion=1.1.10.8
springBootVersion=4.0.1
# This usually matches the Spring Framework version dictated by springBootVersion
springVersion=7.0.2
springAiVersion=1.1.2
Copy link
Contributor

@labkey-jeckels labkey-jeckels Jan 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need this at the root? Looks like it's only used in the API module. Do you expect other modules will need it before long?

Regardless, we need to resolve the handful of dependency version conflicts before this can be merged.


sqliteJdbcVersion=3.51.1.0

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,7 @@ public File extractExecutableJar(File destDirectory, boolean distribution, boole
}
if (remotePipeline)
{
// Keep this code in sync with org.labkey.pipeline.api.PipelineServiceImpl.extractBootstrapFromEmbedded()
// Keep this code in sync with org.labkey.pipeline.api.PipelineServiceImpl.getClusterStartupArguments()
bootstrapJar = extractIfMatch(bootstrapJar, entry, jar, "labkeyBootstrap", "labkeyBootstrap.jar", destDirectory);
servletApiJar = extractIfMatch(servletApiJar, entry, jar, "tomcat-embed-core", "servletApi.jar", pipelineLib);
log4JCoreJar = extractIfMatch(log4JCoreJar, entry, jar, "log4j-core", "log4j-core.jar", pipelineLib);
Expand Down