Skip to content

Propose: Upgrade gradle wrapper, junit, dom4j, and approvalTests to address vulnerabilities and modernize test setup #1

@ibanFR

Description

@ibanFR

This repository currently uses older test and runtime dependencies and an older Gradle version. I propose upgrading the test platform to JUnit (via BOM + junit-jupiter), bumping ApprovalTests to 25.7.0, updating dom4j to 2.1.4, and upgrading Gradle to 9.2.0. These upgrades address known security/maintenance concerns and modernize the build and test stack.

Current versions

  • gradle wrapper: 6.3
  • junit: 4.11
  • dom4j: 2.1.0
  • ApprovalTests: 6.0.1

Proposed upgrades

Upgrade Gradle Wrapper

  • Update the Gradle wrapper to use Gradle 9.2.0.

Migrate to JUnit 5 (Jupiter)

  • Adopt the JUnit Platform with useJUnitPlatform() in Gradle.
  • Use the official JUnit BOM (org.junit:junit-bom) to manage test dependency versions.
  • Replace legacy org.junit imports with org.junit.jupiter equivalents.

Upgrade other dependencies

  • org.dom4j:dom4j → 2.1.4 (latest in the 2.1.x line).
  • com.approvaltests:approvaltests → 25.7.0 (latest stable release).

Why

  • Build Tool: Upgrading Gradle lets us use newer plugin APIs, improved performance, and long-term tooling support.
  • Security: Older versions of dom4j and JUnit 4 contain known CVEs. Upgrading reduces potential vulnerabilities.
  • Maintainability: Newer releases are actively maintained and compatible with modern build and IDE tooling.
  • Testing Improvements: JUnit 5 provides a modern testing platform, better extensions, and long-term support; aligning the project will make future maintenance easier.
  • Future Compatibility: Using a JUnit BOM simplifies future upgrades and dependency alignment.

Note

Happy to open a PR implementing these upgrades if you’re okay with the proposal, @davef77 .

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions