From ebff39353a17903a856afb04bd381638dd735e69 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 31 Jul 2026 02:35:49 +0000
Subject: [PATCH 1/6] chore(deps): bump github/codeql-action/upload-sarif
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)
---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot]
---
.github/workflows/scorecard.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5889fd3219..a37427b4c8 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -55,6 +55,6 @@ jobs:
retention-days: 5
- name: "Upload to code-scanning"
- uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+ uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
with:
sarif_file: results.sarif
From 9009e2e03349cd746901fd5bfa7feaa99fba1c80 Mon Sep 17 00:00:00 2001
From: honeyverma1
Date: Fri, 31 Jul 2026 13:57:12 +0530
Subject: [PATCH 2/6] refactor(fossology): replaced field injection with
construction injection
---
.../main/java/org/eclipse/sw360/fossology/FossologyHandler.java | 2 +-
.../main/java/org/eclipse/sw360/fossology/FossologyServlet.java | 2 +-
.../org/eclipse/sw360/fossology/config/FossologyRestConfig.java | 2 +-
.../org/eclipse/sw360/fossology/rest/FossologyRestClient.java | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyHandler.java b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyHandler.java
index 91069c531f..ce792455d6 100644
--- a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyHandler.java
+++ b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyHandler.java
@@ -70,7 +70,7 @@ public class FossologyHandler implements FossologyService.Iface {
boolean reportStep = false;
- @Autowired
+
public FossologyHandler(
FossologyRestConfig fossologyRestConfig,
FossologyRestClient fossologyRestClient, AttachmentConnector attachmentConnector) {
diff --git a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyServlet.java b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyServlet.java
index 6a6b122269..ea5fc17690 100644
--- a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyServlet.java
+++ b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyServlet.java
@@ -25,7 +25,7 @@
@Controller
public class FossologyServlet extends SpringTServlet {
- @Autowired
+
public FossologyServlet(FossologyHandler fossologyHandler) throws MalformedURLException {
// Create a service processor using the provided handler
super(new FossologyService.Processor<>(fossologyHandler), new TCompactProtocol.Factory());
diff --git a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/config/FossologyRestConfig.java b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/config/FossologyRestConfig.java
index abf36e09bf..b74d9bf6d5 100644
--- a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/config/FossologyRestConfig.java
+++ b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/config/FossologyRestConfig.java
@@ -52,7 +52,7 @@ public class FossologyRestConfig {
private static final String BASEURL_VERSION_SUFFIX = "/api/v2";
- @Autowired
+
public FossologyRestConfig(ConfigContainerRepository repository) throws SW360Exception {
this.repository = repository;
// eager loading (or initial insert)
diff --git a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/rest/FossologyRestClient.java b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/rest/FossologyRestClient.java
index 0fdc819668..3a115e12e2 100644
--- a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/rest/FossologyRestClient.java
+++ b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/rest/FossologyRestClient.java
@@ -92,7 +92,7 @@ public class FossologyRestClient {
private final String expectedVersionPrefix = "2.";
- @Autowired
+
public FossologyRestClient(ObjectMapper objectMapper, FossologyRestConfig restConfig, RestTemplate restTemplate) {
this.objectMapper = objectMapper;
this.restConfig = restConfig;
From 3247068211ae8f6699fa5579e4b8cae6cf349748 Mon Sep 17 00:00:00 2001
From: honeyverma1
Date: Fri, 31 Jul 2026 18:47:30 +0530
Subject: [PATCH 3/6] refactor(rest): remove redundant @Autowired annotations
and implemented Contructor injections.
Signed-off-by: honeyverma1
---
.../client/rest/OAuthClientController.java | 17 +++++++++++------
.../service/Sw360ClientDetailsService.java | 7 +++++--
.../cache/CacheAdminController.java | 6 +++++-
.../changelog/ChangeLogController.java | 4 ++--
.../ClearingRequestController.java | 4 ++--
.../ModerationRequestController.java | 4 ++--
.../resourceserver/search/SearchController.java | 4 ++--
.../jwt/Sw360JWTAccessTokenConverter.java | 8 +++++---
.../Sw360AuthorizationServerConfiguration.java | 1 -
.../service/Sw360OidcUserInfoService.java | 8 ++++++--
.../client/service/Sw360UserDetailsService.java | 12 ++++++++----
.../security/Sw360TokenCustomizerConfig.java | 8 ++++++--
.../Sw360UserAuthenticationProvider.java | 11 +++++++----
13 files changed, 61 insertions(+), 33 deletions(-)
diff --git a/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/rest/OAuthClientController.java b/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/rest/OAuthClientController.java
index edee10ebea..4226db7294 100644
--- a/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/rest/OAuthClientController.java
+++ b/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/rest/OAuthClientController.java
@@ -68,17 +68,22 @@ public class OAuthClientController {
*/
public static final String UNUSED_REDIRECT_URI = "https://localhost/unused-redirect";
- @Autowired
- private PasswordEncoder passwordEncoder;
+
+ private final PasswordEncoder passwordEncoder;
@Value("${security.oauth2.resource.id}")
private String resourceId;
- @Autowired
- private OAuthClientRepository repo;
- @Autowired
- private Sw360UserMirrorService userMirrorService;
+ private final OAuthClientRepository repo;
+
+ private final Sw360UserMirrorService userMirrorService;
+
+ OAuthClientController(PasswordEncoder passwordEncoder, OAuthClientRepository oAuthClientRepository, Sw360UserMirrorService sw360UserMirrorService) {
+ this.passwordEncoder = passwordEncoder;
+ this.repo = oAuthClientRepository;
+ this.userMirrorService = sw360UserMirrorService;
+ }
/**
* Normalize a caller-supplied {@code scope} set to the canonical
diff --git a/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/service/Sw360ClientDetailsService.java b/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/service/Sw360ClientDetailsService.java
index a516197767..b8ada0e299 100644
--- a/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/service/Sw360ClientDetailsService.java
+++ b/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/service/Sw360ClientDetailsService.java
@@ -49,8 +49,11 @@ public class Sw360ClientDetailsService implements RegisteredClientRepository {
@Value("${security.refreshtoken.validity:360}")
private Integer defaultRefreshTokenValiditySeconds;
- @Autowired
- private OAuthClientRepository clientRepo;
+ private final OAuthClientRepository clientRepo;
+
+ Sw360ClientDetailsService(OAuthClientRepository oAuthClientRepository) {
+ this.clientRepo = oAuthClientRepository;
+ }
@Override
public RegisteredClient findByClientId(@Nonnull String clientId) {
diff --git a/rest/resource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/cache/CacheAdminController.java b/rest/resource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/cache/CacheAdminController.java
index 86fba41a5f..30291d0a0a 100644
--- a/rest/resource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/cache/CacheAdminController.java
+++ b/rest/resource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/cache/CacheAdminController.java
@@ -47,7 +47,6 @@
* for all READ-only users on all endpoints — not just admin endpoints.
*/
@BasePathAwareController
-@RequiredArgsConstructor(onConstructor = @__(@Autowired))
@RestController
@SecurityRequirement(name = "tokenAuth")
@SecurityRequirement(name = "basic")
@@ -63,6 +62,11 @@ public class CacheAdminController implements RepresentationModelProcessor tokenCustomizer() {
diff --git a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java
index 05528b19a8..6399b93908 100644
--- a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java
+++ b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java
@@ -23,11 +23,14 @@
@Service
public class Sw360UserAuthenticationProvider implements AuthenticationProvider {
- @Autowired
- private Sw360UserDetailsService userDetailsService;
+ private final Sw360UserDetailsService userDetailsService;
- @Autowired
- private PasswordEncoder passwordEncoder;
+ private final PasswordEncoder passwordEncoder;
+
+ Sw360UserAuthenticationProvider(PasswordEncoder passwordEncoder, Sw360UserDetailsService sw360UserDetailsService) {
+ this.passwordEncoder = passwordEncoder;
+ this.userDetailsService = sw360UserDetailsService;
+ }
/**
* @param authentication the authentication request object.
From 9b4bc3f0e08f8f5974d2d4e24983c5e8b02f3128 Mon Sep 17 00:00:00 2001
From: honeyverma1
Date: Sat, 1 Aug 2026 18:27:43 +0530
Subject: [PATCH 4/6] refactor(tests): removed @Autowired annotations from
tests and implemented constructor injections
---
.../security/jwt/Sw360JWTAccessTokenConverterTest.java | 2 +-
.../authproviders/Sw360UserAuthenticationProvider.java | 2 +-
.../authproviders/Sw360UserAuthenticationProviderTest.java | 3 ++-
3 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/security/jwt/Sw360JWTAccessTokenConverterTest.java b/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/security/jwt/Sw360JWTAccessTokenConverterTest.java
index 90867fd3d5..800beac4fc 100644
--- a/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/security/jwt/Sw360JWTAccessTokenConverterTest.java
+++ b/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/security/jwt/Sw360JWTAccessTokenConverterTest.java
@@ -44,7 +44,7 @@ public class Sw360JWTAccessTokenConverterTest {
@BeforeEach
public void setUp() {
- converter = new Sw360JWTAccessTokenConverter();
+ converter = new Sw360JWTAccessTokenConverter(userService);
ReflectionTestUtils.setField(converter, "userService", userService);
ReflectionTestUtils.setField(converter, "principleAttribute", "email");
}
diff --git a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java
index 6399b93908..77aff95dce 100644
--- a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java
+++ b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java
@@ -27,7 +27,7 @@ public class Sw360UserAuthenticationProvider implements AuthenticationProvider {
private final PasswordEncoder passwordEncoder;
- Sw360UserAuthenticationProvider(PasswordEncoder passwordEncoder, Sw360UserDetailsService sw360UserDetailsService) {
+ public Sw360UserAuthenticationProvider(PasswordEncoder passwordEncoder, Sw360UserDetailsService sw360UserDetailsService) {
this.passwordEncoder = passwordEncoder;
this.userDetailsService = sw360UserDetailsService;
}
diff --git a/rest/rest-common/src/test/java/org/eclipse/sw360/rest/authserver/security/authproviders/Sw360UserAuthenticationProviderTest.java b/rest/rest-common/src/test/java/org/eclipse/sw360/rest/authserver/security/authproviders/Sw360UserAuthenticationProviderTest.java
index 63ca548084..bb9970f03a 100644
--- a/rest/rest-common/src/test/java/org/eclipse/sw360/rest/authserver/security/authproviders/Sw360UserAuthenticationProviderTest.java
+++ b/rest/rest-common/src/test/java/org/eclipse/sw360/rest/authserver/security/authproviders/Sw360UserAuthenticationProviderTest.java
@@ -33,11 +33,12 @@ public class Sw360UserAuthenticationProviderTest {
@Test
public void shouldAddPasswordFactorAuthority_onSuccessfulAuthentication() {
- Sw360UserAuthenticationProvider provider = new Sw360UserAuthenticationProvider();
Sw360UserDetailsService userDetailsService = mock(Sw360UserDetailsService.class);
PasswordEncoder passwordEncoder = mock(PasswordEncoder.class);
+ Sw360UserAuthenticationProvider provider = new Sw360UserAuthenticationProvider(passwordEncoder, userDetailsService);
+
ReflectionTestUtils.setField(provider, "userDetailsService", userDetailsService);
ReflectionTestUtils.setField(provider, "passwordEncoder", passwordEncoder);
From f5d8e8df87bb6221f208b49e7ba8b6e4114c3e59 Mon Sep 17 00:00:00 2001
From: honeyverma1
Date: Sat, 1 Aug 2026 18:35:12 +0530
Subject: [PATCH 5/6] refactor(tests): removed @Autowired annotations from
import statements
---
.../security/authproviders/Sw360UserAuthenticationProvider.java | 1 -
1 file changed, 1 deletion(-)
diff --git a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java
index 77aff95dce..71497a309d 100644
--- a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java
+++ b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java
@@ -5,7 +5,6 @@
package org.eclipse.sw360.rest.common.security.authproviders;
import org.eclipse.sw360.rest.common.client.service.Sw360UserDetailsService;
-import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
From 4eff9a7ba4463d4e18e25d7d19892fe30c6a0755 Mon Sep 17 00:00:00 2001
From: honeyverma1
Date: Tue, 4 Aug 2026 09:22:59 +0530
Subject: [PATCH 6/6] refactor(Sw360AuthorizationServerConfiguration): added
@Autowired annotations back
---
.../security/Sw360AuthorizationServerConfiguration.java | 1 +
1 file changed, 1 insertion(+)
diff --git a/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/configuration/security/Sw360AuthorizationServerConfiguration.java b/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/configuration/security/Sw360AuthorizationServerConfiguration.java
index 8cbce9b421..db293284d8 100644
--- a/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/configuration/security/Sw360AuthorizationServerConfiguration.java
+++ b/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/configuration/security/Sw360AuthorizationServerConfiguration.java
@@ -49,6 +49,7 @@ public SecurityFilterChain appSecurity(HttpSecurity httpSecurity) {
return httpSecurity.build();
}
+ @Autowired
public void authenticationManagerBuilder(AuthenticationManagerBuilder authenticationManagerBuilder,
PasswordEncoder passwordEncoder, Sw360CustomUserDetailsService userDetailsService) {
authenticationManagerBuilder.authenticationProvider(