chore: release v2.3.0#244
Conversation
📝 WalkthroughWalkthroughMaven artifact versions across the entire Kinde Java SDK project are bumped from ChangesVersion Bump 2.2.0 → 2.3.0
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
kinde-management/pom.xml (1)
93-98:⚠️ Potential issue | 🟠 Major | ⚡ Quick win
junit-jupiter-apiis missing<scope>test</scope>— it will be a compile-time dependency ofkinde-management.Without an explicit scope, Maven defaults to
compile. This meansjunit-jupiter-apiwill be included in the published artifact's transitive dependency graph, leaking a test-only library into consumers' compile classpaths.🐛 Proposed fix
<dependency> <groupId>org.junit.jupiter</groupId> <artifactId>junit-jupiter-api</artifactId> <version>5.13.4</version> + <scope>test</scope> </dependency>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@kinde-management/pom.xml` around lines 93 - 98, The junit-jupiter-api dependency is missing a test scope and is currently pulled in as a compile dependency; update the dependency declaration for artifactId "junit-jupiter-api" (groupId "org.junit.jupiter") to include a <scope>test</scope> element so it is treated as a test-only dependency and not propagated to consumers' compile classpaths.
🧹 Nitpick comments (6)
kinde-core/pom.xml (2)
148-193: ⚡ Quick winOkHttp component version mismatch within
kinde-core.
okhttpis pinned at5.3.0whilelogging-interceptoris at5.1.0. These should be at the same version to avoid binary incompatibilities.♻️ Proposed fix
<dependency> <groupId>com.squareup.okhttp3</groupId> <artifactId>logging-interceptor</artifactId> - <version>5.1.0</version> + <version>5.3.0</version> ... </dependency>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@kinde-core/pom.xml` around lines 148 - 193, The okhttp and logging-interceptor dependencies have mismatched versions (okhttp: 5.3.0 vs logging-interceptor: 5.1.0) which can cause binary incompatibilities; update the logging-interceptor dependency (artifactId logging-interceptor) to match okhttp's version (5.3.0) or, better, introduce a shared property (e.g., <okhttp.version>) and use it for both the okhttp and logging-interceptor <version> elements so they remain identical going forward; keep existing exclusions as-is.
17-73: ⚡ Quick winFive duplicate dependency declarations.
The following are each declared twice in
kinde-core/pom.xml:
Artifact First occurrence Second occurrence com.nimbusds:oauth2-oidc-sdkLines 19–22 Lines 45–48 com.nimbusds:nimbus-jose-jwtLines 24–27 Lines 49–52 junit:junitLines 29–32 Lines 59–62 junit-jupiter-apiLines 34–38 Lines 64–68 junit-jupiter-engineLines 39–43 Lines 69–73 Maven silently ignores the second declaration. Remove the duplicates.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@kinde-core/pom.xml` around lines 17 - 73, Remove the duplicated Maven dependency declarations for the artifacts com.nimbusds:oauth2-oidc-sdk, com.nimbusds:nimbus-jose-jwt, junit:junit, org.junit.jupiter:junit-jupiter-api, and org.junit.jupiter:junit-jupiter-engine by keeping only one declaration of each artifactId/groupId pair in the <dependencies> block; locate the duplicate blocks referencing those artifactIds and delete the second occurrences so each dependency (oauth2-oidc-sdk, nimbus-jose-jwt, junit, junit-jupiter-api, junit-jupiter-engine) appears exactly once.pom.xml (1)
187-212: ⚡ Quick winJackson component versions are inconsistent with the BOM.
jackson-bomis pinned at2.20.0, butjackson-coreis explicitly overridden to2.21.1whilejackson-databindremains at2.20.0. Jackson core and databind must track the same version for binary compatibility. Additionally,jackson-annotationsis declared as2.20(no patch segment), which is non-standard.Consider aligning all explicit Jackson overrides to a single version (e.g.
2.21.1) or, better yet, removing the per-artifact overrides entirely and letting the BOM drive all Jackson versions.♻️ Proposed alignment
- <version>2.20.0</version> <!-- jackson-bom --> + <version>2.21.1</version> <!-- jackson-bom, aligns all Jackson artifacts --> ... - <version>2.21.1</version> <!-- jackson-core --> + <!-- remove: managed by BOM --> - <version>2.20</version> <!-- jackson-annotations --> + <!-- remove: managed by BOM --> - <version>2.20.0</version> <!-- jackson-databind, datatype-joda, datatype-jsr310 --> + <!-- remove: managed by BOM -->🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pom.xml` around lines 187 - 212, The POM declares inconsistent Jackson versions: jackson-bom is 2.20.0 but jackson-core is 2.21.1 and jackson-annotations is "2.20" (missing patch), which breaks binary compatibility; update the explicit dependency declarations (jackson-core, jackson-annotations, jackson-databind, jackson-datatype-joda, jackson-datatype-jsr310) so they all use a single consistent version (either remove the per-artifact <version> entries to let jackson-bom drive versions, or set them all to the same explicit version such as 2.21.1 and also update the jackson-bom to 2.21.1), and normalize jackson-annotations to a full semantic version string (e.g., 2.21.1) if keeping explicit overrides.kinde-management/pom.xml (1)
114-159: ⚡ Quick winOkHttp component version mismatch within
kinde-management.
okhttpis at5.1.0andlogging-interceptoris at5.2.1. Additionally,kinde-coreusesokhttp:5.3.0, so when both modules are on the classpath, there are three different OkHttp artifact versions in play. Align all OkHttp components to the same version across both modules.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@kinde-management/pom.xml` around lines 114 - 159, The pom has an OkHttp version mismatch: com.squareup.okhttp3:okhttp is 5.1.0 while com.squareup.okhttp3:logging-interceptor is 5.2.1 and kinde-core uses 5.3.0; unify these to a single version (best to choose the highest tested version, e.g., 5.3.0). Update the com.squareup.okhttp3:okhttp and com.squareup.okhttp3:logging-interceptor dependency entries to the chosen version (or introduce a shared property like okhttp.version and use it for both artifacts) so all modules (including kinde-core) reference the same OkHttp version and avoid classpath conflicts.kinde-springboot/pom.xml (1)
7-11: Bothkinde-springboot-coreandkinde-springboot-starterhardcode dependency versions—inconsistent with the rest of the project.
kinde-springboot-coredeclares<version>2.3.0</version>forcom.kinde:kinde-core, andkinde-springboot-starterhardcodes versions for bothkinde-springboot-coreandkinde-core. Meanwhile,kinde-managementandkinde-j2eeomit versions and inherit from the root pom'sdependencyManagement. Future version bumps require manual updates in two separate files, creating maintenance risk and inconsistency.Remove the hardcoded version declarations from both submodules to inherit from the parent pom:
♻️ Fixes required
In
kinde-springboot/kinde-springboot-core/pom.xml:<dependency> <groupId>com.kinde</groupId> <artifactId>kinde-core</artifactId> - <version>2.3.0</version> </dependency>In
kinde-springboot/kinde-springboot-starter/pom.xml:<dependency> <groupId>com.kinde.spring</groupId> <artifactId>kinde-springboot-core</artifactId> - <version>2.3.0</version> </dependency> <dependency> <groupId>com.kinde</groupId> <artifactId>kinde-core</artifactId> - <version>2.3.0</version> </dependency>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@kinde-springboot/pom.xml` around lines 7 - 11, Remove the hardcoded <version> elements so the modules inherit versions from the parent dependencyManagement: in the kinde-springboot-core pom remove the explicit <version>2.3.0</version> for com.kinde:kinde-core, and in the kinde-springboot-starter pom remove the explicit version entries for com.kinde:kinde-springboot-core and com.kinde:kinde-core so both dependencies rely on the parent POM's dependencyManagement; ensure only the groupId and artifactId remain for those dependencies and run a Maven build to verify resolution.kinde-springboot/kinde-springboot-core/pom.xml (1)
56-59: ⚡ Quick winPre-existing:
spring-boot-starter-securitydeclared twice.The same dependency (
org.springframework.boot:spring-boot-starter-security:3.5.6) appears at lines 56–59 and again at lines 77–81. Maven will emit a duplicate dependency warning; one declaration should be removed.Similarly,
org.mockito:mockito-core:5.19.0is declared twice (lines 102–107 and lines 145–150).🔧 Suggested removal
- <!-- Spring deps--> - <dependency> - <groupId>org.springframework.boot</groupId> - <artifactId>spring-boot-starter-security</artifactId> - <version>3.5.6</version> - </dependency>And remove the second
mockito-coreblock (lines 145–150) since the one at lines 102–107 already covers it with the correcttestscope.Also applies to: 77-82
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@kinde-springboot/kinde-springboot-core/pom.xml` around lines 56 - 59, Remove the duplicate dependency declarations in the POM: keep a single org.springframework.boot:spring-boot-starter-security (remove the other spring-boot-starter-security block) and keep only one org.mockito:mockito-core entry — ensure the remaining mockito-core uses the test scope (remove the other mockito-core block). Update the dependency list so each artifactId (spring-boot-starter-security, mockito-core) appears only once to eliminate Maven duplicate dependency warnings.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@kinde-management/pom.xml`:
- Around line 93-98: The junit-jupiter-api dependency is missing a test scope
and is currently pulled in as a compile dependency; update the dependency
declaration for artifactId "junit-jupiter-api" (groupId "org.junit.jupiter") to
include a <scope>test</scope> element so it is treated as a test-only dependency
and not propagated to consumers' compile classpaths.
---
Nitpick comments:
In `@kinde-core/pom.xml`:
- Around line 148-193: The okhttp and logging-interceptor dependencies have
mismatched versions (okhttp: 5.3.0 vs logging-interceptor: 5.1.0) which can
cause binary incompatibilities; update the logging-interceptor dependency
(artifactId logging-interceptor) to match okhttp's version (5.3.0) or, better,
introduce a shared property (e.g., <okhttp.version>) and use it for both the
okhttp and logging-interceptor <version> elements so they remain identical going
forward; keep existing exclusions as-is.
- Around line 17-73: Remove the duplicated Maven dependency declarations for the
artifacts com.nimbusds:oauth2-oidc-sdk, com.nimbusds:nimbus-jose-jwt,
junit:junit, org.junit.jupiter:junit-jupiter-api, and
org.junit.jupiter:junit-jupiter-engine by keeping only one declaration of each
artifactId/groupId pair in the <dependencies> block; locate the duplicate blocks
referencing those artifactIds and delete the second occurrences so each
dependency (oauth2-oidc-sdk, nimbus-jose-jwt, junit, junit-jupiter-api,
junit-jupiter-engine) appears exactly once.
In `@kinde-management/pom.xml`:
- Around line 114-159: The pom has an OkHttp version mismatch:
com.squareup.okhttp3:okhttp is 5.1.0 while
com.squareup.okhttp3:logging-interceptor is 5.2.1 and kinde-core uses 5.3.0;
unify these to a single version (best to choose the highest tested version,
e.g., 5.3.0). Update the com.squareup.okhttp3:okhttp and
com.squareup.okhttp3:logging-interceptor dependency entries to the chosen
version (or introduce a shared property like okhttp.version and use it for both
artifacts) so all modules (including kinde-core) reference the same OkHttp
version and avoid classpath conflicts.
In `@kinde-springboot/kinde-springboot-core/pom.xml`:
- Around line 56-59: Remove the duplicate dependency declarations in the POM:
keep a single org.springframework.boot:spring-boot-starter-security (remove the
other spring-boot-starter-security block) and keep only one
org.mockito:mockito-core entry — ensure the remaining mockito-core uses the test
scope (remove the other mockito-core block). Update the dependency list so each
artifactId (spring-boot-starter-security, mockito-core) appears only once to
eliminate Maven duplicate dependency warnings.
In `@kinde-springboot/pom.xml`:
- Around line 7-11: Remove the hardcoded <version> elements so the modules
inherit versions from the parent dependencyManagement: in the
kinde-springboot-core pom remove the explicit <version>2.3.0</version> for
com.kinde:kinde-core, and in the kinde-springboot-starter pom remove the
explicit version entries for com.kinde:kinde-springboot-core and
com.kinde:kinde-core so both dependencies rely on the parent POM's
dependencyManagement; ensure only the groupId and artifactId remain for those
dependencies and run a Maven build to verify resolution.
In `@pom.xml`:
- Around line 187-212: The POM declares inconsistent Jackson versions:
jackson-bom is 2.20.0 but jackson-core is 2.21.1 and jackson-annotations is
"2.20" (missing patch), which breaks binary compatibility; update the explicit
dependency declarations (jackson-core, jackson-annotations, jackson-databind,
jackson-datatype-joda, jackson-datatype-jsr310) so they all use a single
consistent version (either remove the per-artifact <version> entries to let
jackson-bom drive versions, or set them all to the same explicit version such as
2.21.1 and also update the jackson-bom to 2.21.1), and normalize
jackson-annotations to a full semantic version string (e.g., 2.21.1) if keeping
explicit overrides.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 3e5152de-5a69-4303-8b44-cb89f87c3516
📒 Files selected for processing (16)
kinde-core/pom.xmlkinde-j2ee/pom.xmlkinde-management/pom.xmlkinde-report-aggregate/pom.xmlkinde-springboot/kinde-springboot-core/pom.xmlkinde-springboot/kinde-springboot-starter/pom.xmlkinde-springboot/pom.xmlkinde-test-utils/pom.xmlplayground/kinde-accounts-example/pom.xmlplayground/kinde-core-example/pom.xmlplayground/kinde-j2ee-app/pom.xmlplayground/kinde-management-example/pom.xmlplayground/kinde-springboot-pkce-client-example/pom.xmlplayground/kinde-springboot-starter-example/pom.xmlplayground/kinde-springboot-thymeleaf-full-example/pom.xmlpom.xml
2 participants
Explain your changes
Release v2.3.0 - bumps version in pom files and update maven publishing version to 0.9.0
Checklist
🛟 If you need help, consider asking for advice over in the Kinde community.
Summary by CodeRabbit