<!-- This issue template can be used as a great starting point for feature requests. The section "Release notes" can be used as a summary of the feature and is also required if you want to have your release post blog MR auto generated using the release post item generator: https://about.gitlab.com/handbook/marketing/blog/release-posts/#release-post-item-generator. The remaining sections are the backbone for every feature in GitLab. The goal of this template is brevity for quick/smaller iterations. For a more thorough list of considerations for larger features or feature sets, you can leverage the detailed [feature proposal](https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/issue_templates/Feature%20proposal%20-%20detailed.md). --> ### Release notes We have added support for Java 17 to Dependency Scanning. Thank you to the assistance of community contributors @rpandini_wh and @gliDom. If you are using the latest, or latest major(2), the container you do not need to do anything to receive this update. If you have pinned your container to a minor or specific version please update to at least 2.26.0 receive this update. ### Problem to solve Dependency Scanning currently supports Java up to version 16. Version 17 made it to general availability [recently](https://www.oracle.com/news/announcement/oracle-releases-java-17-2021-09-14/) (2021-09-14) and should be supported as well. ### Related details See [this comment](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/merge_requests/157/diffs#note_824274749) for more details. ### Proposal Add Java 17 support for Dependency Scanning, without introducing any breaking changes. ### Implementation Plan 1. [x] Update [.tool-versions](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/blob/cfa64550757f3626983c4b752d192fce32bb12f6/config/.tool-versions#L5) in `gemnasium-maven` and add `gradle 7.3.3`, keeping gradle `6.7.1` as the default (the first listed version is the default): ```diff - gradle 6.7.1 + gradle 6.7.1 7.3.3 ``` https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/merge_requests/164 1. [x] Update [.tool-versions](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/blob/cfa64550757f3626983c4b752d192fce32bb12f6/config/.tool-versions#L2) in `gemnasium-maven` and add `adoptopenjdk-17.0.2+8` to the list of Java versions: ```diff - java adoptopenjdk-11.0.7+10.1 adoptopenjdk-8.0.252+9.1 adoptopenjdk-13.0.2+8.1 adoptopenjdk-14.0.1+7.1 adoptopenjdk-15.0.2+7 adoptopenjdk-16.0.0+36 + java adoptopenjdk-11.0.7+10.1 adoptopenjdk-8.0.252+9.1 adoptopenjdk-13.0.2+8.1 adoptopenjdk-14.0.1+7.1 adoptopenjdk-15.0.2+7 adoptopenjdk-16.0.0+36 adoptopenjdk-17.0.2+8 ``` https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/merge_requests/164 1. [x] Update [analyzer-wrapper](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/blob/cfa64550757f3626983c4b752d192fce32bb12f6/analyzer-wrapper#L31) so that if a user configures `DS_JAVA_VERSION=17`, we automatically select `gradle 7.3.3` https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/merge_requests/164 1. [x] Update [`utils/gradle-plugin-builder/build.gradle`](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/blob/cfa64550757f3626983c4b752d192fce32bb12f6/utils/gradle-plugin-builder/build.gradle#L5) to use `gradle 7` syntax: ```diff - runtime group: 'com.gemnasium', name: 'gradle-plugin', version: '0.3.5' + runtimeOnly group: 'com.gemnasium', name: 'gradle-plugin', version: '0.3.5' ``` https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/merge_requests/164 1. [x] Add the following downstream QA tests to the [java-gradle](https://gitlab.com/gitlab-org/security-products/tests/java-gradle) test project: - [x] Test against a `Java 17` project without a `gradlew` file and show that it automatically switches to the pre-installed `gradle 7.3.3` https://gitlab.com/gitlab-org/security-products/tests/java-gradle/-/jobs/2160792124 ```shell Using java version 'adoptopenjdk-17.0.2+8' Using gradle version '7.3.3' ``` - [x] Test against an older Java version, such as `Java 14`, and show: - [x] if no `gradlew` file is provided, `gradle 6.7.1` will be used https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/merge_requests/167 - [x] if a `gradlew` file is provided that contains Gradle version `7.3`, the tests still pass https://gitlab.com/gitlab-org/security-products/tests/java-gradle/-/jobs/2160792098 ```shell Using java version 'adoptopenjdk-14.0.1+7.1' Welcome to Gradle 7.3! Job succeeded ``` It's important to add tests for projects that don't have a `gradlew` wrapper file with a pinned version of gradle. This shows that a `Java 17` project uses `gradle 7.3.3`, and a `Java 14` project uses `gradle 6.7.1`. If we were to use a pinned version of gradle in a `gradlew` file, then it wouldn't show us that the version of gradle changes programmatically based on the version of Java, which is what we need to demonstrate. See [this MR](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/merge_requests/157) for a starting point. 1. [x] Add the following downstream QA test to the [java-maven](https://gitlab.com/gitlab-org/security-products/tests/java-maven) test project: - [x] Test against a `Java 17` project https://gitlab.com/gitlab-org/security-products/tests/java-maven/-/jobs/2160792198 See [this MR](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/merge_requests/145) as a starting point. 1. [x] Add `Java 17` to the [Supported languages and package managers](https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#supported-languages-and-package-managers) table in the Dependency Scanning docs. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/82276 1. [x] Make the following changes to the [Obtaining dependency information by running a package manager to generate a parsable file](https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#obtaining-dependency-information-by-running-a-package-manager-to-generate-a-parsable-file) table in the Dependency Scanning docs: - [x] Add `gradle 7.3` to the `Tested Versions` column for the `Gradle` package manager. - [x] Add `gradle 7.3.3` to the `Preinstalled Versions` column for the `Gradle` package manager, and include a footnote explaining: > When `DS_JAVA_VERSION` is set to `17`, `gradle 7.3.3` will automatically be selected as the package manager. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/82276 1. [x] Make sure to give credit to @gliDom for their community contribution in [Add support for java 17](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/merge_requests/150) which has provided some necessary details to help complete this issue.