Upgrade example app to Spring Boot 3.x to resolve Dependabot alerts

.github/workflows/java-ci.yml

@@ -8,14 +8,41 @@ on:
       - main
 
 jobs:
-   build-and-test:
-     name: Java CI - test
+   sdk-build-and-test:
+     name: SDK - Java ${{ matrix.java-version }}
      runs-on: ubuntu-latest
 
      strategy:
        matrix:
         java-version: [8, 11, 17, 21]
 
+     steps:
+       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+       - name: Set up Java
+         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+         with:
+           distribution: 'temurin'
+           java-version: ${{ matrix.java-version }}
+
+       - name: Build and test SDK
+         run: mvn -B install -pl duo-universal-sdk
+
+       - name: Lint SDK with checkstyle
+         run: mvn checkstyle:check -pl duo-universal-sdk
+
+       - name: Verify release profile works
+         run: mvn -P release package -pl duo-universal-sdk
+
+   example-build-and-test:
+     name: Example App - Java ${{ matrix.java-version }}
+     runs-on: ubuntu-latest
+     needs: sdk-build-and-test
+
+     strategy:
+       matrix:
+        java-version: [17, 21]
+
      steps:
        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -28,16 +55,26 @@ jobs:
        - name: Inject dummy example config
          working-directory: duo-example
          run: printf "duo.clientId=DIAAAAAAAAAAAAAAAAAA\nduo.clientSecret=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nduo.api.host=example.duosecurity.com\nduo.redirect.uri=http://localhost:8080\nduo.failmode=CLOSED\n" > ./src/main/resources/application.properties
-       
-       - name: Build and test with Maven
-         run: mvn -B install
-       
-       - name: Lint with checkstyle
-         run: mvn checkstyle:check
-       
+
+       - name: Build example app with dependencies
+         run: mvn -B install -pl duo-example -am
+
+       - name: Lint example with checkstyle
+         run: mvn checkstyle:check -pl duo-example
+
        - name: Verify example starts
          working-directory: duo-example
          run: mvn spring-boot:start
-
-       - name: Verify release profile works
-         run: mvn -P release package
+
+   ci-pass:
+     name: CI Pass
+     runs-on: ubuntu-latest
+     if: always()
+     needs: [sdk-build-and-test, example-build-and-test]
+     steps:
+       - name: Check job results
+         run: |
+           if [[ "${{ needs.sdk-build-and-test.result }}" != "success" || "${{ needs.example-build-and-test.result }}" != "success" ]]; then
+             echo "One or more jobs failed"
+             exit 1
+           fi

duo-example/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>2.6.15</version>
+        <version>3.4.7</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 
@@ -34,52 +34,27 @@
         <url>http://github.com/duosecurity/duo_universal_java/tree/main</url>
     </scm>
 
+    <properties>
+        <maven.compiler.source>17</maven.compiler.source>
+        <maven.compiler.target>17</maven.compiler.target>
+    </properties>
+
     <dependencies>
         <dependency>
             <groupId>com.duosecurity</groupId>
             <artifactId>duo-universal-sdk</artifactId>
             <version>1.3.3-SNAPSHOT</version>
         </dependency>
-        <dependency>
-            <groupId>org.springframework</groupId>
-            <artifactId>spring-webmvc</artifactId>
-            <version>5.3.24</version>
-        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-autoconfigure</artifactId>
-            <version>2.6.15</version>
+            <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-tomcat</artifactId>
-            <version>2.6.15</version>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.tomcat</groupId>
-            <artifactId>tomcat-util-scan</artifactId>
-            <version>9.0.21</version>
-          </dependency>
         <!-- Need this to compile JSP -->
         <dependency>
             <groupId>org.apache.tomcat.embed</groupId>
             <artifactId>tomcat-embed-jasper</artifactId>
-            <version>9.0.21</version>
             <scope>provided</scope>
         </dependency>
-
-        <dependency>
-            <groupId>org.eclipse.jdt.core.compiler</groupId>
-            <artifactId>ecj</artifactId>
-            <version>4.6.1</version>
-            <scope>provided</scope>
-        </dependency>
-
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-core</artifactId>
-            <version>2.16.0</version>
-        </dependency>
     </dependencies>
 
     <build>

duo-example/src/main/java/com/duosecurity/controller/LoginController.java

@@ -7,9 +7,9 @@
 import com.duosecurity.model.Token;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.annotation.PostConstruct;
 import java.util.HashMap;
 import java.util.Map;
-import javax.annotation.PostConstruct;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.ExceptionHandler;

duo-universal-sdk/pom.xml

@@ -139,7 +139,7 @@
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
-                <version>2.3.6.RELEASE</version>
+                <version>3.4.7</version>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>