Skip to content
This repository has been archived by the owner on Nov 29, 2024. It is now read-only.

Upgrade to Spring Boot 3 #378

Merged
merged 1 commit into from
Jan 29, 2024
Merged

Upgrade to Spring Boot 3 #378

merged 1 commit into from
Jan 29, 2024

Conversation

jackjii79
Copy link
Contributor

@jackjii79 jackjii79 commented Dec 12, 2023

https://github.com/h2oai/mlops/issues/208

Motivation

The sole purpose of this PR is to minimize JAVA MOJO scorer vulnerability, in order to do that Several challenges have been solved.

Upgrade to spring boot 3. However due to the diversity of multiple different subprojects coexist in the same repo and their dependencies tightly coupled through the entire gradle multi-project flows, plus the necessity to update JAVA from 8 to 17 (https://spring.io/blog/2022/05/24/preparing-for-spring-boot-3-0/#upgrade-to-java-17).

The scope of changes is not feasible to be further minimize. Though the scope of changes is not common practice, but the outcome is no question will outweight the rest.
Following changes contribute the PR becomes quick a huge milestone.

Scope of changes

Vulnerability Result

Screen Shot 2024-01-26 at 1 31 42 PM

E2E

http://jenkins:8080/view/Model%20Ops/job/mlops/job/environments-helm/job/jh-helm/job/manual/job/test-golang-21/11/allure/

Console

Picked up _JAVA_OPTIONS: -Dmojo.path=/data/model                                                                                                                                                   
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts                                               │
                                                                                                                                                                                                    │
   .   ____          _            __ _ _                                                                                                                                                            │
  /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \                                                                                                                                                           
 ( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \                                                                                                                                                          
  \\/  ___)| |_)| | | | | || (_| |  ) ) ) )                                                                                                                                                         │
   '  |____| .__|_| |_|_| |_\__, | / / / /                                                                                                                                                          
  =========|_|==============|___/=/_/_/_/                                                                                                                                                           
  :: Spring Boot ::                (v3.2.0)                                                                                                                                                         
                                                                                                                                                                                                    │
2024-01-24T20:59:27.813Z  INFO 1 --- [           main] a.h.m.d.local.rest.ScorerApplication     : Starting ScorerApplication using Java 17.0.9 with PID 1 (/app/classes started by ? in /)         │
2024-01-24T20:59:27.862Z  INFO 1 --- [           main] a.h.m.d.local.rest.ScorerApplication     : No active profile set, falling back to 1 default profile: "default"                              │
2024-01-24T20:59:32.372Z  INFO 1 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat initialized with port 8080 (http)                                                         │
2024-01-24T20:59:32.397Z  INFO 1 --- [           main] o.apache.catalina.core.StandardService   : Starting service [Tomcat]                                                                        │
2024-01-24T20:59:32.398Z  INFO 1 --- [           main] o.apache.catalina.core.StandardEngine    : Starting Servlet engine: [Apache Tomcat/10.1.16]                                                 │
2024-01-24T20:59:32.541Z  INFO 1 --- [           main] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring embedded WebApplicationContext                                               │
2024-01-24T20:59:32.549Z  INFO 1 --- [           main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 3854 ms                                  │
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts                                               │
2024-01-24T20:59:32.711Z  INFO 1 --- [           main] a.h.m.d.common.transform.MojoScorer      : Loading Mojo pipeline from path /data/model                                                      │
2024-01-24T20:59:32.722Z  INFO 1 --- [           main] a.h.m.r.a.backend.ZipFileReaderBackend   : Opening mojo file: /data/model                                                                   │
2024-01-24T20:59:33.531Z  INFO 1 --- [           main] a.h.m.d.common.transform.MojoScorer      : Loading Mojo pipeline from path /data/model                                                      │
2024-01-24T20:59:33.532Z  INFO 1 --- [           main] a.h.m.r.a.backend.ZipFileReaderBackend   : Opening mojo file: /data/model                                                                   │
2024-01-24T20:59:33.650Z  INFO 1 --- [           main] a.h.m.d.common.transform.MojoScorer      : Mojo pipeline successfully loaded (39583b02-ba59-11ee-a175-1218ab93ff6c).                        │
2024-01-24T20:59:34.557Z  INFO 1 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat started on port 8080 (http) with context path ''                                          │
2024-01-24T20:59:34.581Z  INFO 1 --- [           main] a.h.m.d.local.rest.ScorerApplication     : Started ScorerApplication in 8.3 seconds (process running for 9.279)                             │
2024-01-24T20:59:34.849Z  INFO 1 --- [nio-8080-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'                                        │
2024-01-24T20:59:34.850Z  INFO 1 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'                                                         │
2024-01-24T20:59:34.859Z  INFO 1 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : Completed initialization in 8 ms                

@jackjii79 jackjii79 added the enhancement New feature or request label Dec 12, 2023
@jackjii79 jackjii79 self-assigned this Dec 12, 2023
@jackjii79 jackjii79 force-pushed the fix-critical-vulnerability branch 2 times, most recently from ad90176 to b4caf7f Compare December 13, 2023 02:36
@jackjii79 jackjii79 changed the title Address critical vulnerability Upgrade to Spring Boot 3 Jan 24, 2024
@jackjii79 jackjii79 marked this pull request as ready for review January 24, 2024 21:10
@jackjii79 jackjii79 marked this pull request as draft January 26, 2024 00:58
@jackjii79 jackjii79 marked this pull request as ready for review January 26, 2024 04:45
Copy link
Member

@shsma shsma left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great job. Thanks @jackjii79

@jackjii79 jackjii79 merged commit 2fcfbae into master Jan 29, 2024
9 of 10 checks passed
@jackjii79 jackjii79 deleted the fix-critical-vulnerability branch January 29, 2024 21:26
jakubhava pushed a commit that referenced this pull request Aug 26, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants