Migrate to openapi-request-validator-mockmvc (3.x) when Spring Boot 4 upgrade lands

[amavashev]

Background

Atlassian renamed and re-versioned the OpenAPI request validator library. The 3.0.0 release of com.atlassian.oai:swagger-request-validator-mockmvc is a final-rename release that requires Spring Framework 7 / Spring Boot 4 (Jakarta namespace upgrade), per the 3.0.0 release notes.

Going forward, the active line lives at:

• com.atlassian.oai:openapi-request-validator-mockmvc (new artifact ID under the same com.atlassian.oai group)
• New repo: https://github.com/atlassian/openapi-request-validator

The old artifact (swagger-request-validator-mockmvc) is frozen at 2.46.1 for Spring Boot 3.x; nothing newer ships there.

What this repo is on today

• Spring Boot 3.5.14 (Java 21)
• com.atlassian.oai:swagger-request-validator-mockmvc 2.46.1 (last release in the old line)

This is in scope for cycles-admin-service/cycles-admin-service-api/pom.xml (test scope only — contract validation in ContractValidationConfig and ContractValidatingRestTemplateInterceptor).

What unblocks the migration

The migration is gated on the Spring Boot 4 upgrade (which itself implies Spring Framework 7 + verifying any direct Spring API usage). Until SB4 lands here, the existing swagger-request-validator-mockmvc:2.46.1 continues to work — we just stay frozen on the old line.

When the upgrade happens, do all of this together

1. Bump spring-boot-starter-parent to a 4.x release.
2. Verify the rest of the codebase against Spring 7 (Jakarta namespace already in use since the SB 3.x migration, so the namespace part is a no-op; the API surface changes are the real work).
3. In cycles-protocol-service-api/pom.xml: replace

   <groupId>com.atlassian.oai</groupId>
   <artifactId>swagger-request-validator-mockmvc</artifactId>
   <version>2.46.1</version>

   with

   <groupId>com.atlassian.oai</groupId>
   <artifactId>openapi-request-validator-mockmvc</artifactId>
   <version>3.0.0</version>  <!-- or current 3.x at migration time -->

4. The 3.x library uses identical class names for OpenApiInteractionValidator, OpenApiMatchers, LevelResolver, ValidationReport, SimpleRequest, SimpleResponse — but verify against the 3.x docs since some deprecated 2.x classes were removed (none of which appear used in our test code: ContractValidationConfig.java, ContractValidatingRestTemplateInterceptor.java).
5. While doing this, also pick up OpenAPI 3.1 support, networknt v2 schema validator, and the Guava removal (none of those should affect this repo, but worth checking).

Why we are not doing it now

PR #176 attempted the 3.0.0 bump on the old artifact name. That release is the Spring-Boot-4-only build, and CI fails with surefire test errors because the validator hits Spring 7 internals not on the classpath under SB 3.5.14. Closed PR #176, ignored 3.x via @dependabot ignore this major version so dependabot stops re-raising it. This issue carries the migration context forward to whenever SB4 lands.

Cross-repo

Same migration applies to cycles-server-admin (companion tracking issue filed there). cycles-server-events does not currently use swagger-request-validator-mockmvc, so no migration is needed there.

References

• Closed PR: chore(deps-dev): bump com.atlassian.oai:swagger-request-validator-mockmvc from 2.46.1 to 3.0.0 in /cycles-admin-service #176
• Atlassian repo (new): https://github.com/atlassian/openapi-request-validator
• 3.0.0 release notes: https://github.com/atlassian/openapi-request-validator/blob/master/RELEASE-NOTES.md
• Affected files in this repo:
  • cycles-admin-service/cycles-admin-service-api/pom.xml
  • cycles-admin-service/cycles-admin-service-api/src/test/java/io/runcycles/admin/api/contract/ContractValidationConfig.java
  • cycles-admin-service/cycles-admin-service-api/src/test/java/io/runcycles/admin/api/contract/ContractValidatingRestTemplateInterceptor.java