From 7e75aeb8ef0699f312fbc62578fd2c46884bd22f Mon Sep 17 00:00:00 2001
From: Vladimir Gavrilenko <vladi.a.gavri@gmail.com>
Date: Wed, 21 Oct 2026 19:21:39 +0000
Subject: [PATCH] fix(deps): drop spring-boot-starter-web and unused
 commons-configuration

**Which sample(s) or area?**
Build (build.gradle), spring and hello samples

**What changed?**
- Replaced `spring-boot-starter-web` with `spring-boot-starter`.
- Bumped the Spring Boot plugin from 2.7.15 to 2.7.18.
- Removed `commons-configuration`.
- Declared `commons-lang3` and `jackson-annotations` explicitly, since
  they were only on the classpath transitively. `HelloSignal` and
  `HelloSignalAndResponse` now import `RandomStringUtils` from lang3.

**Why?**
Most Snyk findings come from the transitive dependencies of
`spring-boot-starter-web` (Tomcat, spring-web, spring-webmvc). The spring
sample uses no web features.

**How did you test it?**
- `./gradlew build` on JDK 11: BUILD SUCCESSFUL.
- Count unique Snyk issues per severity, on master and on this branch:
  `snyk test --org=cadence --json | jq -r '[.vulnerabilities[]] | unique_by(.id) | group_by(.severity)[] | "\(.[0].severity) \(length)"'`

**Potential risks**
Low. Code relying on embedded Tomcat or Spring MVC would break, but
nothing in `src` does.

**Release notes**
N/A

**Documentation Changes**
N/A

Signed-off-by: Vladimir Gavrilenko <vladi.a.gavri@gmail.com>
---
 build.gradle                                               | 7 ++++---
 .../java/com/uber/cadence/samples/hello/HelloSignal.java   | 2 +-
 .../uber/cadence/samples/hello/HelloSignalAndResponse.java | 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/build.gradle b/build.gradle
index 8dfbd5a8..a266a32f 100644
--- a/build.gradle
+++ b/build.gradle
@@ -2,7 +2,7 @@ plugins {
     id 'com.github.hierynomus.license' version '0.16.1'
     id "com.github.sherter.google-java-format" version "0.9"
     id "net.ltgt.errorprone" version "3.1.0"
-    id 'org.springframework.boot' version '2.7.15'
+    id 'org.springframework.boot' version '2.7.18'
 }
 
 apply plugin: 'java'
@@ -38,7 +38,8 @@ repositories {
 dependencies {
     errorprone("com.google.errorprone:error_prone_core:2.23.0")
     implementation group: 'com.uber.cadence', name: 'cadence-client', version: '3.12.7'
-    implementation group: 'commons-configuration', name: 'commons-configuration', version: '1.9'
+    implementation 'org.apache.commons:commons-lang3'
+    implementation 'com.fasterxml.jackson.core:jackson-annotations'
     implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.2.3'
     implementation group: 'com.uber.m3', name: 'tally-core', version: '0.10.0'
     implementation group: 'com.uber.m3', name: 'tally-prometheus', version: '0.10.0'
@@ -47,7 +48,7 @@ dependencies {
     testImplementation group: 'junit', name: 'junit', version: '4.13.2'
     testImplementation group: 'org.mockito', name: 'mockito-all', version: '1.10.19'
     testImplementation group: 'org.powermock', name: 'powermock-api-mockito', version: '1.7.4'
-    implementation 'org.springframework.boot:spring-boot-starter-web'
+    implementation 'org.springframework.boot:spring-boot-starter'
 }
 
 compileJava {
diff --git a/src/main/java/com/uber/cadence/samples/hello/HelloSignal.java b/src/main/java/com/uber/cadence/samples/hello/HelloSignal.java
index 76d7ee19..64a7d735 100644
--- a/src/main/java/com/uber/cadence/samples/hello/HelloSignal.java
+++ b/src/main/java/com/uber/cadence/samples/hello/HelloSignal.java
@@ -34,7 +34,7 @@
 import java.time.Duration;
 import java.util.ArrayList;
 import java.util.List;
-import org.apache.commons.lang.RandomStringUtils;
+import org.apache.commons.lang3.RandomStringUtils;
 
 /**
  * Demonstrates asynchronous signalling of a workflow. Requires a local instance of Cadence server
diff --git a/src/main/java/com/uber/cadence/samples/hello/HelloSignalAndResponse.java b/src/main/java/com/uber/cadence/samples/hello/HelloSignalAndResponse.java
index 1c03a2a1..10362439 100644
--- a/src/main/java/com/uber/cadence/samples/hello/HelloSignalAndResponse.java
+++ b/src/main/java/com/uber/cadence/samples/hello/HelloSignalAndResponse.java
@@ -47,7 +47,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import org.apache.commons.lang.RandomStringUtils;
+import org.apache.commons.lang3.RandomStringUtils;
 
 /**
  * Demonstrates signalling a workflow, and wait until it's applied and get a response. This should