search

ktorio / ktor-build-plugins

Ktor Plugins for Build Systems
Apache License 2.0
56 stars 10 forks source link

KTOR-5389 Update shadow to 7.1.2 (Gradle 7.0+) #69

Closed IRus closed 1 year ago

IRus commented 1 year ago
  1. Shadow 7.1.2 uses log4j 2.17.1 without known vulnerabilities
  2. Updated fat.jar with new one generated with newer version of Shadow plugin
  3. Removed Gradle 6.7.1 from tests, added Gradle 7.6 instead
jvmusin commented 1 year ago

Hi! Does your PR bring any value except for updating shadow plugin version? We're aiming to support Gradle v6 and we won't drop its support without any major reasons. Right now we're replacing the vulnerable log4j version in dependencies, so there should be no vulnerabilities.

IRus commented 1 year ago

@jvmusin It brings support with Gradle 8.0 which should be released soon, there are already Milestone builds of it available.

jvmusin commented 1 year ago

@IRus Thanks, I just checked Gradle v8 RC1 and the plugin fails because of really old version of the shadow plugin. We'll think what we can do to support that. I want to make sure that dropping Gradle v6 support and updating ShadowJar is the only reasonable way to support Gradle v8.

Nek-12 commented 1 year ago

Hi! Any updates on this? This is currently the only thing blocking our upgrade to Gradle 8.0. In my humble opinion, there is no need to maintain gradle 6 compatibility for future versions of the ktor plugin.

jvmusin commented 1 year ago

Hi @Nek-12! I agree there is no need to maintain Gradle v6. However, I'm not in Ktor team anymore, and all future updates will be made by the team if they find someone to do it. Maybe @e5l can just merge the PR.