chore(pom): add support for Spring Boot 3.4.1

[mboskamp]

Related to #4657

[github-actions]

Java dependency diff

Omitted due to character limit. See workflow artifacts for full diff file.

Module details

Omitted due to character limit. See workflow artifacts for full diff file.

Checklist

Unique changes

• spring-jcl: 6.1.15 ✔ => 6.2.1 ✔
• spring-core: 6.1.15 ✔ => 6.2.1 ✔
• spring-beans: 6.1.15 ✔ => 6.2.1 ✔
• spring-aop: 6.1.15 ✔ => 6.2.1 ✔
• spring-expression: 6.1.15 ✔ => 6.2.1 ✔
• micrometer-commons: 1.12.12 ✔ => 1.14.2 ✔
• micrometer-observation: 1.12.12 ✔ => 1.14.2 ✔
• spring-context: 6.1.15 ✔ => 6.2.1 ✔
• spring-tx: 6.1.15 ✔ => 6.2.1 ✔
• spring-jdbc: 6.1.15 ✔ => 6.2.1 ✔
• spring-orm: 6.1.15 ✔ => 6.2.1 ✔
• spring-web: 6.1.15 ✔ => 6.2.1 ✔
• byte-buddy: 1.14.19 ✔ => 1.15.11 ✔
• assertj-core: 3.25.3 ✔ => 3.26.3 ✔
• spring-boot: 3.3.6 ✔ => 3.4.1 ✔
• spring-boot-autoconfigure: 3.3.6 ✔ => 3.4.1 ✔
• log4j-api: 2.23.1 ✔ => 2.24.3 ✔
• log4j-to-slf4j: 2.23.1 ✔ => 2.24.3 ✔
• spring-boot-starter-logging: 3.3.6 ✔ => 3.4.1 ✔
• snakeyaml: 2.2 ✔ => 2.3 ✔
• spring-boot-starter: 3.3.6 ✔ => 3.4.1 ✔
• spring-test: 6.1.15 ✔ => 6.2.1 ✔
• spring-boot-test: 3.3.6 ✔ => 3.4.1 ✔
• spring-boot-test-autoconfigure: 3.3.6 ✔ => 3.4.1 ✔
• junit-platform-commons: 1.10.5 ⚠ => 1.11.4 ⚠
• junit-jupiter-api: 5.10.5 ⚠ => 5.11.4 ⚠
• junit-jupiter-params: 5.10.5 ⚠ => 5.11.4 ⚠
• junit-platform-engine: 1.10.5 ⚠ => 1.11.4 ⚠
• junit-jupiter-engine: 5.10.5 ⚠ => 5.11.4 ⚠
• junit-jupiter: 5.10.5 ⚠ => 5.11.4 ⚠
• byte-buddy-agent: 1.14.19 ✔ => 1.15.11 ✔
• mockito-core: 5.11.0 ✔ => 5.14.2 ✔
• mockito-junit-jupiter: 5.11.0 ✔ => 5.14.2 ✔
• xmlunit-core: 2.9.1 ✔ => 2.10.0 ✔
• spring-boot-starter-test: 3.3.6 ✔ => 3.4.1 ✔
• junit-vintage-engine: 5.10.5 ⚠ => 5.11.4 ⚠
• spring-boot-starter-jdbc: 3.3.6 ✔ => 3.4.1 ✔
• jboss-logging: 3.5.3.Final ✔ => 3.6.1.Final ✔
• hibernate-commons-annotations: 6.0.6.Final ❓ => 7.0.3.Final ✔
• jandex: 3.1.2 ✔ => 3.2.0 ✔
• hibernate-core: 6.5.3.Final ❓ => 6.6.4.Final ❓
• spring-data-commons: 3.3.6 ✔ => 3.4.1 ✔
• spring-data-jpa: 3.3.6 ✔ => 3.4.1 ✔
• spring-aspects: 6.1.15 ✔ => 6.2.1 ✔
• spring-boot-starter-data-jpa: 3.3.6 ✔ => 3.4.1 ✔
• spring-boot-actuator: 3.3.6 ✔ => 3.4.1 ✔
• jackson-annotations: 2.17.3 ✔ => 2.18.2 ✔
• jackson-core: 2.17.3 ✔ => 2.18.2 ✔
• jackson-databind: 2.17.3 ✔ => 2.18.2 ✔
• jackson-datatype-jsr310: 2.17.3 ✔ => 2.18.2 ✔
• spring-boot-actuator-autoconfigure: 3.3.6 ✔ => 3.4.1 ✔
• micrometer-commons: 1.13.8 ✔ => 1.14.2 ✔
• micrometer-observation: 1.13.8 ✔ => 1.14.2 ✔
• micrometer-core: 1.13.8 ✔ => 1.14.2 ✔
• micrometer-jakarta9: 1.13.8 ✔ => 1.14.2 ✔
• spring-boot-starter-actuator: 3.3.6 ✔ => 3.4.1 ✔
• jackson-datatype-jdk8: 2.17.3 ✔ => 2.18.2 ✔
• jackson-module-parameter-names: 2.17.3 ✔ => 2.18.2 ✔
• spring-boot-starter-json: 3.3.6 ✔ => 3.4.1 ✔
• tomcat-embed-core: 10.1.33 ✔ => 10.1.34 ✔
• tomcat-embed-el: 10.1.33 ✔ => 10.1.34 ✔
• tomcat-embed-websocket: 10.1.33 ✔ => 10.1.34 ✔
• spring-boot-starter-tomcat: 3.3.6 ✔ => 3.4.1 ✔
• spring-webmvc: 6.1.15 ✔ => 6.2.1 ✔
• spring-boot-starter-web: 3.3.6 ✔ => 3.4.1 ✔
• hibernate-validator: 8.0.1.Final ✔ => 8.0.2.Final ✔
• spring-boot-starter-validation: 3.3.6 ✔ => 3.4.1 ✔
• jersey-bean-validation: 3.1.9 ⚠❓‼ => 3.1.9 ⚠❓‼
• jackson-module-jakarta-xmlbind-annotations: 2.17.3 ✔ => 2.18.2 ✔
• jersey-media-json-jackson: 3.1.9 ⚠❓‼ => 3.1.9 ⚠❓‼
• spring-boot-starter-jersey: 3.3.6 ✔ => 3.4.1 ✔
• spring-boot-configuration-processor: 3.3.6 ✔ => 3.4.1 ✔
• spring-boot-devtools: 3.3.6 ✔ => 3.4.1 ✔
• commons-lang3: 3.14.0 ✔ => 3.17.0 ✔
• spring-security-crypto: 6.3.5 ✔ => 6.4.2 ✔
• spring-security-core: 6.3.5 ✔ => 6.4.2 ✔
• spring-security-config: 6.3.5 ✔ => 6.4.2 ✔
• spring-security-web: 6.3.5 ✔ => 6.4.2 ✔
• spring-boot-starter-security: 3.3.6 ✔ => 3.4.1 ✔
• spring-security-oauth2-core: 6.3.5 ✔ => 6.4.2 ✔
• spring-security-oauth2-client: 6.3.5 ✔ => 6.4.2 ✔
• spring-security-oauth2-jose: 6.3.5 ✔ => 6.4.2 ✔
• spring-boot-starter-oauth2-client: 3.3.6 ✔ => 3.4.1 ✔
• httpcore5: 5.2.4 ✔ => 5.3.1 ✔
• httpcore5-h2: 5.2.4 ✔ => 5.3.1 ✔
• httpclient5: 5.3 ✔ => 5.4.1 ✔
• commons-text: 1.11.0 ✔ => 1.12.0 ✔
• opencsv: 5.9 ✔ => 5.9 ✔
• liquibase-core: 4.27.0 ✔ => 4.29.2 ✔
• hibernate-validator: 8.0.1.Final ✔ => 8.0.1.Final ✔
• wildfly-ejb3: 33.0.1.Final ✔ => 33.0.1.Final ✔

Unique additions

• spring-boot-starter: 3.4.1 ✔
• spring-beans: 6.2.1 ✔
• spring-context: 6.2.1 ✔
• spring-aop: 6.2.1 ✔
• spring-core: 6.2.1 ✔
• spring-jcl: 6.2.1 ✔
• spring-expression: 6.2.1 ✔
• micrometer-observation: 1.14.2 ✔
• micrometer-commons: 1.14.2 ✔
• spring-boot: 3.4.1 ✔
• spring-boot-autoconfigure: 3.4.1 ✔
• spring-boot-starter-logging: 3.4.1 ✔
• logback-classic: 1.5.12 ⚠❓‼
• logback-core: 1.5.12 ⚠❓‼
• log4j-to-slf4j: 2.24.3 ✔
• log4j-api: 2.24.3 ✔
• jul-to-slf4j: 2.0.16 ✔
• jakarta.annotation-api: 2.1.1 ⚠‼
• snakeyaml: 2.3 ✔
• slf4j-api: 2.0.16 ✔
• commons-io: 2.16.1 ✔

Developer comments

Glossary

Limitations

• The reported transitive dependencies may not always be accurate in a multi-module project.
  The SBOM file format represents a unique dependency (coordinates + type) only once. In a multi-module
  project a dependency can be declared in multiple locations with different exclusions of transitive dependencies
  or different version overrides for transitive dependencies.

Emojies

• ✔: All licenses are on the Go list
• ⚠: (At least one) license is on the Caution list
• ❌: (At least one) license is on the Stop list
• ❓: (At least one) license cannot be determined or is unknown
• ‼: Dependency has multiple licenses declared
• ⬆: New dependency version is higher than previous
• ⬇: New dependency version is lower than previous
• 🔄: Dependency version is equal and the dependencies of this component changed (e.g. when comparing snapshots)
• 🤷: The change of the dependency version can not be determined further (e.g. because the version does not follow semantic versioning)

[mboskamp]

artifact	old license	new license	output	comment	ok?
junit	EPL 2.0	EPL 2.0	junit-platform-commons: 1.10.5 ⚠ => 1.11.4 ⚠		✔
junit	EPL 2.0	EPL 2.0	junit-jupiter-api: 5.10.5 ⚠ => 5.11.4 ⚠		✔
junit	EPL 2.0	EPL 2.0	junit-jupiter-params: 5.10.5 ⚠ => 5.11.4 ⚠		✔
junit	EPL 2.0	EPL 2.0	junit-platform-engine: 1.10.5 ⚠ => 1.11.4 ⚠		✔
junit	EPL 2.0	EPL 2.0	junit-jupiter-engine: 5.10.5 ⚠ => 5.11.4 ⚠		✔
junit	EPL 2.0	EPL 2.0	junit-jupiter: 5.10.5 ⚠ => 5.11.4 ⚠		✔
hibernate	LGPL 2.1	LGPL 2.1	hibernate-core: 6.5.3.Final ❓ => 6.6.4.Final ❓		✔
jersey	EPL 2.0	EPL 2.0	jersey-bean-validation: 3.1.9 ⚠❓‼ => 3.1.9 ⚠❓‼		✔
jersey	EPL 2.0	EPL 2.0	jersey-media-json-jackson: 3.1.9 ⚠❓‼ => 3.1.9 ⚠❓‼		✔
logback	LGPL 2.1	LGPL 2.1	logback-classic: 1.5.12 ⚠❓‼	not a new library	✔
logback	LGPL 2.1	LGPL 2.1	logback-core: 1.5.12 ⚠❓‼	not a new library	✔
jakarta	EPL 2.0	EPL 2.0	jakarta.annotation-api: 2.1.1 ⚠‼	not a new library	✔

Some of the libraries above are reported as new additions. But this is false; we have used and shipped them in previous Spring Boot environments.

[psavidis]

Reviewer Notes

• License check and CI passed successfully ✔️
• After the latest bump, camunda-run is updated to use spring boot 3.4.1 (see screenshot)
  • relevant to task for bumping the spring boot version of camunda-run