upgrade jdbi to remove older caffeine dependency
What the developer wrote
Authored by Craig Raw
upgrade jdbi to remove older caffeine dependency
What changed, and why it matters
This commit updates the JDBI database library to a newer version and removes some manual module configuration. The stated reason is to drop an older Caffeine caching dependency. It is a routine dependency maintenance change, not a clearly security-focused patch. There is no direct evidence in the commit that it fixes a known vulnerability, but keeping dependencies current is generally good security hygiene.
Treat as routine dependency hygiene. Review JDBI and Caffeine release notes for any security advisories if performing a security audit, but no immediate action is required based solely on this commit.
Security signals we found
Dependency upgrade (JDBI 3.20.0 -> 3.49.5)
Removal of older Caffeine transitive dependency
No explicit security fix or CVE reference in commit message or diff
Routine maintenance / compatibility change
Evidence from the diff
The patch upgrades org.jdbi:jdbi3-core and jdbi3-sqlobject from 3.20.0 to 3.49.5. It removes explicit extraJavaModuleInfo declarations for jdbi3-core and geantyref, presumably because newer JDBI artifacts provide proper module metadata. It also adjusts BasicThreadFactory construction in Storage.java to use a static builder() method instead of new Builder(), matching an API change in the newer transitive dependency (likely commons-lang3). module-info.java adds an explicit requires for io.leangen.geantyref. No vulnerability identifiers, CVEs, or security advisories are referenced in the commit materials.
Changed components
build.gradle dependency declarationsJDBI database access layerStorage.java thread executor initializationJava module configuration (module-info.java)Inspect captured patch +5 / −19
diff --git a/build.gradle b/build.gradle
index 45514ba..7c21d22 100644
--- a/build.gradle
+++ b/build.gradle
@@ -51,10 +51,10 @@ dependencies {
implementation('com.zaxxer:HikariCP:4.0.3') {
exclude group: 'org.slf4j'
}
- implementation('org.jdbi:jdbi3-core:3.20.0') {
+ implementation('org.jdbi:jdbi3-core:3.49.5') {
exclude group: 'org.slf4j'
}
- implementation('org.jdbi:jdbi3-sqlobject:3.20.0') {
+ implementation('org.jdbi:jdbi3-sqlobject:3.49.5') {
exclude group: 'org.slf4j'
}
implementation('org.flywaydb:flyway-core:9.22.3')
@@ -407,21 +407,6 @@ extraJavaModuleInfo {
module('com.google.guava:listenablefuture|empty-to-avoid-conflict-with-guava', 'com.google.guava.listenablefuture')
module('com.google.code.findbugs:jsr305', 'com.google.code.findbugs.jsr305')
module('j2objc-annotations-2.8.jar', 'com.google.j2objc.j2objc.annotations', '2.8')
- module('org.jdbi:jdbi3-core', 'org.jdbi.v3.core') {
- exports('org.jdbi.v3.core')
- exports('org.jdbi.v3.core.mapper')
- exports('org.jdbi.v3.core.statement')
- exports('org.jdbi.v3.core.result')
- exports('org.jdbi.v3.core.h2')
- exports('org.jdbi.v3.core.spi')
- requires('io.leangen.geantyref')
- requires('java.sql')
- requires('org.slf4j')
- requires('com.github.benmanes.caffeine')
- }
- module('io.leangen.geantyref:geantyref', 'io.leangen.geantyref') {
- exports('io.leangen.geantyref')
- }
module('org.fxmisc.richtext:richtextfx', 'org.fxmisc.richtext') {
exports('org.fxmisc.richtext')
exports('org.fxmisc.richtext.event')
diff --git a/src/main/java/com/sparrowwallet/sparrow/io/Storage.java b/src/main/java/com/sparrowwallet/sparrow/io/Storage.java
index 15efe19..dd7d737 100644
--- a/src/main/java/com/sparrowwallet/sparrow/io/Storage.java
+++ b/src/main/java/com/sparrowwallet/sparrow/io/Storage.java
@@ -684,7 +684,7 @@ public class Storage {
public static Executor getSingleThreadedExecutor() {
if(singleThreadedExecutor == null) {
- BasicThreadFactory factory = new BasicThreadFactory.Builder().namingPattern("LoadWalletService-single").daemon(true).priority(Thread.MIN_PRIORITY).build();
+ BasicThreadFactory factory = BasicThreadFactory.builder().namingPattern("LoadWalletService-single").daemon(true).priority(Thread.MIN_PRIORITY).build();
singleThreadedExecutor = Executors.newSingleThreadScheduledExecutor(factory);
}
diff --git a/src/main/java/module-info.java b/src/main/java/module-info.java
index 8aa8e53..3c8073e 100644
--- a/src/main/java/module-info.java
+++ b/src/main/java/module-info.java
@@ -27,6 +27,7 @@ open module com.sparrowwallet.sparrow {
requires com.google.gson;
requires org.jdbi.v3.core;
requires org.jdbi.v3.sqlobject;
+ requires io.leangen.geantyref;
requires org.flywaydb.core;
requires com.zaxxer.hikari;
requires com.h2database;
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.