Merge remote-tracking branch 'origin/develop' into fb_authorizedfiles…

…ystem

gradle.properties

@@ -100,7 +100,7 @@ apacheDirectoryVersion=2.1.3
 apacheMinaVersion=2.2.1
 
 # Keep in sync with springBootTomcatVersion below
-apacheTomcatVersion=10.1.26
+apacheTomcatVersion=10.1.30
 
 # (mothership) -> json-path -> json-smart -> accessor-smart
 # (core) -> graalvm
@@ -284,12 +284,12 @@ slf4jLog4jApiVersion=2.0.13
 # This is a dependency for HTSJDK. Force version for CVE-2023-43642
 snappyJavaVersion=1.1.10.5
 
-springBootVersion=3.3.2
+springBootVersion=3.3.4
 # This usually matches the Tomcat version dictated by springBootVersion
 # Also, keep this in sync with apacheTomcatVersion above
-springBootTomcatVersion=10.1.26
+springBootTomcatVersion=10.1.30
 # This usually matches the Spring Framework version dictated by springBootVersion
-springVersion=6.1.12
+springVersion=6.1.13
 
 sqliteJdbcVersion=3.46.0.0
 

gradle/global_gradle.properties_template

@@ -1,17 +1,11 @@
 # Set 'deployMode=prod' to build modules suitable for running on a production-mode server
 deployMode=dev
 
-# We need to know the tomcat home directory for some of the dependencies in our build process.  IntelliJ does not
-# pick up the CATALINA_HOME environment variable, so if working with the IDE, you need to set the tomcat.home
-# system property either here as shown below or on the command line with -Dtomcat.home=/path/to/tomcat/home
-# Regardless of OS, use the forward slash (/) as a file separator in the path (yes, even on Windows)
-# Note: Only required for legacy (non-embedded) LabKey builds
-#systemProp.tomcat.home=/path/to/tomcat/home
-
 # uncomment to enable artifactory password authentication
 #artifactory_user=<your user>
-# the artifactory password or API key for the user above
-#artifactory_password=<your password or API key>
+# the artifactory password or identity token for the user above
+# note: if you've configured a .npmrc file then you'll likely need to provide a base64-encoded credential there as well
+#artifactory_password=<your password or identity token>
 
 # Uncomment to include version control information in the generated module.xml files for locally built modules
 #includeVcs

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

server/embedded/src/org/labkey/embedded/LabKeySpringBootClassLoader.java

@@ -1,10 +1,14 @@
 package org.labkey.embedded;
 
+import org.jboss.logging.Logger;
 import org.labkey.bootstrap.LabKeyBootstrapClassLoader;
 
 import java.io.IOException;
+import java.io.InputStream;
 import java.net.URL;
+import java.net.URLClassLoader;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.Enumeration;
 import java.util.List;
@@ -15,6 +19,8 @@
  */
 public class LabKeySpringBootClassLoader extends LabKeyBootstrapClassLoader
 {
+    private static final Logger LOG = Logger.getLogger(LabKeySpringBootClassLoader.class);
+
     public LabKeySpringBootClassLoader()
     {
         super();
@@ -23,6 +29,28 @@ public LabKeySpringBootClassLoader()
     public LabKeySpringBootClassLoader(ClassLoader parent)
     {
         super(parent);
+
+        // HACK: This ensures that the jar containing our canonical log4j2.xml file gets added first, so it's found
+        // even if dependencies include their own version. See Issue 51286.
+        if (parent instanceof URLClassLoader ucl)
+        {
+            Arrays.stream(ucl.getURLs())
+                .forEach(url -> {
+                    // Test this url via a class loader with no parent; if URL resolves a log4j2.xml file, add it and log.
+                    try (URLClassLoader loader = new URLClassLoader(new URL[]{url}, null); InputStream is = loader.getResourceAsStream("log4j2.xml"))
+                    {
+                        if (is != null)
+                        {
+                            addURL(url);
+                            LOG.info("Added URL that resolves log4j2.xml to class loader: " + url);
+                        }
+                    }
+                    catch (IOException e)
+                    {
+                        throw new RuntimeException(e);
+                    }
+                });
+        }
     }
 
     @Override
@@ -50,7 +78,7 @@ public Enumeration<URL> getResources(String name) throws IOException
         // Eventually we should shift to only configuring and loading SLF4J and Log4J via Spring Boot and not
         // from inside the webapp.
         if (name.equalsIgnoreCase("META-INF/services/org.apache.logging.log4j.util.PropertySource") ||
-           name.equalsIgnoreCase("META-INF/services/org.apache.logging.log4j.spi.Provider") ||
+            name.equalsIgnoreCase("META-INF/services/org.apache.logging.log4j.spi.Provider") ||
             name.equalsIgnoreCase("META-INF/org/apache/logging/log4j/core/config/plugins/Log4j2Plugins.dat"))
         {
             List<URL> urls = new ArrayList<>();

server/embedded/src/org/labkey/embedded/LabKeyTomcatServletWebServerFactory.java

@@ -146,10 +146,7 @@ protected TomcatWebServer getTomcatWebServer(Tomcat tomcat)
                 // Add the SMTP config
                 context.getNamingResources().addResource(getMailResource());
 
-                // Signal that we started up via Embedded Tomcat for reporting purposes
-                context.addParameter("embeddedTomcat", "true");
-
-                // And the master encryption key
+                // Add the encryption key(s)
                 context.addParameter("EncryptionKey", contextProperties.getEncryptionKey());
                 if (contextProperties.getOldEncryptionKey() != null)
                 {