Files
langsmith-java/langsmith-java-example/build.gradle.kts
T
stainless-app[bot] c904c2d278 release: 0.1.0-beta.6 (#154)
* fix: patch security alerts — OTel, Tomcat, Jetty, Logback, Spring, SnakeYAML (#153)

Resolves open Dependabot security alerts across critical+high severity tiers.

Key change: opentelemetry-api/sdk/exporter-otlp 1.32.0 → 1.62.0 (CVE-2026-45292,
published dep). Semconv 1.23.1-alpha → 1.41.1 (stable GA); migrates
ResourceAttributes.SERVICE_* → ServiceAttributes.SERVICE_* (class removed in 1.30+).

Other fixes (test/example scope, non-published):
- Jetty 9.4.57 → 9.4.58.v20250814 (CVE-2025-5115 in http2-common)
- Logback 1.2.13 → 1.5.32 (CVE-2025-11226, CVE-2024-12798, CVE-2024-12801, CVE-2026-1225;
  the 1.2.13 pin was overly conservative — CVE-2023-6481/6378 are fixed since 1.3.12)
- Tomcat 9.0.115 → 9.0.118 in example module (14 alerts, 4 critical)
- Spring 5.3.34 → 5.3.39 + spring-expression constraint (CVE-2024-38809, CVE-2024-38808)
- SnakeYAML 1.31 → 1.32 (CVE-2022-38752, CVE-2022-41854)

Adds SECURITY_FIX_PLAN.md tracking open/stale/no-fix-available alert status.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* release: 0.1.0-beta.6

---------

Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: stainless-app[bot] <142633134+stainless-app[bot]@users.noreply.github.com>
2026-05-20 11:19:28 -07:00

118 lines
5.5 KiB
Kotlin

plugins {
application
kotlin("jvm")
id("org.jetbrains.kotlin.plugin.spring") version "2.1.20"
id("org.springframework.boot") version "2.7.18" apply false
}
repositories {
mavenCentral()
}
// Align with Kotlin JVM target (Kotlin plugin applies Java plugin; keep targets consistent)
java {
sourceCompatibility = JavaVersion.VERSION_21
targetCompatibility = JavaVersion.VERSION_21
}
dependencies {
implementation(project(":langsmith-java"))
implementation(kotlin("stdlib"))
// Jackson for JSON handling in examples
implementation("com.fasterxml.jackson.core:jackson-databind:2.13.4")
// Spring Boot dependencies (optional - only needed for Spring Boot example)
implementation(platform("org.springframework.boot:spring-boot-dependencies:2.7.18"))
implementation("org.springframework.boot:spring-boot-starter-web")
implementation("org.springframework.boot:spring-boot-starter")
// Simple logging for examples. This lets smoke tests show SDK debug/trace logs.
runtimeOnly("org.slf4j:slf4j-simple:2.0.17")
// Security: constrain vulnerable transitive dependencies from Spring Boot 2.7.18.
// Spring Boot 2.7.x is EOL; these constraints override the managed versions in-place.
// None of these affect published artifacts (this is a non-published example module).
constraints {
// CVE-2025-24813 (CRITICAL), CVE-2026-24734, CVE-2025-55752, CVE-2025-53506,
// CVE-2025-52520, CVE-2025-48989, CVE-2025-48988, CVE-2024-56337, CVE-2024-50379, CVE-2024-34750,
// CVE-2026-29145, CVE-2026-29129, CVE-2026-34483, CVE-2026-34487, CVE-2026-34500, CVE-2026-32990,
// CVE-2026-25854, CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512, CVE-2026-43513,
// CVE-2026-43514, CVE-2026-43515
// Remove this constraint when upgrading to Spring Boot 3.x (which manages Tomcat 10+).
implementation("org.apache.tomcat.embed:tomcat-embed-core") { version { require("9.0.118") } }
implementation("org.apache.tomcat.embed:tomcat-embed-websocket") { version { require("9.0.118") } }
// CVE-2024-22243, CVE-2024-22259, CVE-2024-22262, CVE-2024-38809, CVE-2024-38808
// Note: CVE-2016-1000027 (CRITICAL) requires spring-web 6.0.0 — needs Spring Boot 3.x upgrade.
implementation("org.springframework:spring-web") { version { require("5.3.39") } }
implementation("org.springframework:spring-webmvc") { version { require("5.3.39") } }
implementation("org.springframework:spring-expression") { version { require("5.3.39") } }
// CVE-2023-6481, CVE-2023-6378, CVE-2025-11226, CVE-2024-12798, CVE-2024-12801, CVE-2026-1225
implementation("ch.qos.logback:logback-core") { version { require("1.5.32") } }
implementation("ch.qos.logback:logback-classic") { version { require("1.5.32") } }
// CVE-2022-25857, CVE-2022-38752, CVE-2022-41854
// (note: CVE-2022-1471 requires snakeyaml 2.0 which is incompatible with Spring Boot 2.7.x)
implementation("org.yaml:snakeyaml") { version { require("1.32") } }
}
}
tasks.withType<org.jetbrains.kotlin.gradle.tasks.KotlinCompile>().configureEach {
compilerOptions {
jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_21)
}
}
application {
// Require -Pexample=Name to run an example (e.g. -Pexample=ListRuns, -Pexample=OtelLangSmith)
mainClass = if (project.hasProperty("example")) {
var exampleName = project.property("example") as String
val aliases = mapOf(
"OtelLangSmithSimple" to "OtelLangSmith",
"PromptManagmentExample" to "PromptManagement",
"PromptManagment" to "PromptManagement",
)
exampleName = aliases[exampleName] ?: exampleName
val baseName = if (exampleName.endsWith("Example")) exampleName else "${exampleName}Example"
val searchPaths = listOf(
"" to "com.langchain.smith.example",
"otel/" to "com.langchain.smith.example.otel"
)
var foundPackage = ""
for ((subdir, packageName) in searchPaths) {
val kotlinFile = file("src/main/kotlin/com/langchain/smith/example/${subdir}${baseName}.kt")
if (kotlinFile.exists()) {
foundPackage = packageName
break
}
}
if (foundPackage.isNotEmpty()) {
"${foundPackage}.${baseName}Kt"
} else {
throw GradleException(
"Example '$exampleName' not found. No ${baseName}.kt in " +
"src/main/kotlin/.../example/ or .../example/otel/. " +
"Use -Pexample=ListRuns, -Pexample=OtelLangSmith, -Pexample=OtelLangSmithSimple, -Pexample=OtelOpenAI, etc."
)
}
} else {
"Main" // placeholder; run task doFirst will require -Pexample=
}
}
// Export stdin to examples for readln(); require -Pexample= when running (configuration-cache safe: no project access in doFirst)
tasks.named<JavaExec>("run") {
standardInput = System.`in`
systemProperty("org.slf4j.simpleLogger.defaultLogLevel", "info")
systemProperty("org.slf4j.simpleLogger.log.com.langchain.smith.client.AutoBatchQueue", "trace")
systemProperty("org.slf4j.simpleLogger.showDateTime", "false")
systemProperty("org.slf4j.simpleLogger.showShortLogName", "true")
doFirst {
if (mainClass.get() == "Main") {
throw GradleException(
"Example module requires -Pexample=ExampleName. " +
"e.g. ./gradlew :langsmith-java-example:run -Pexample=ListRuns"
)
}
}
}