From c8eb5b9a1b0896cb9b79aef90771bf5800b5c02c Mon Sep 17 00:00:00 2001
From: Jeremy Bernard <jeremy.bernard@iex.ec>
Date: Wed, 6 May 2026 09:27:59 +0200
Subject: [PATCH] feat: upgrade to Spring Boot 3.5.8

---
 build.gradle                                  |  6 ++--
 iexec-sms-library/build.gradle                |  2 +-
 src/main/resources/logback-spring.xml         | 28 -------------------
 .../base/SecretSessionBaseServiceTests.java   |  4 +--
 4 files changed, 6 insertions(+), 34 deletions(-)
 delete mode 100644 src/main/resources/logback-spring.xml

diff --git a/build.gradle b/build.gradle
index da9616b8..59daa216 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,8 +1,8 @@
 plugins {
     id 'java'
     id 'io.freefair.lombok' version '8.14.4'
-    id 'org.springframework.boot' version '3.3.8'
-    id 'io.spring.dependency-management' version '1.1.6'
+    id 'org.springframework.boot' version '3.5.8'
+    id 'io.spring.dependency-management' version '1.1.7'
     id 'jacoco'
     id 'org.sonarqube' version '6.3.1.5724'
     id 'maven-publish'
@@ -61,7 +61,7 @@ dependencies {
     implementation 'com.h2database:h2:2.2.224'
 
     // Spring Doc
-    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.6.0'
+    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.17'
 
     // ssl
     implementation 'org.apache.httpcomponents.client5:httpclient5'
diff --git a/iexec-sms-library/build.gradle b/iexec-sms-library/build.gradle
index cb3b9216..67dd6969 100644
--- a/iexec-sms-library/build.gradle
+++ b/iexec-sms-library/build.gradle
@@ -6,7 +6,7 @@ plugins {
 }
 
 dependencies {
-    implementation platform("org.springframework.boot:spring-boot-dependencies:3.3.8")
+    implementation platform("org.springframework.boot:spring-boot-dependencies:3.5.8")
 
     implementation "com.iexec.commons:iexec-commons-poco:$iexecCommonsPocoVersion"
     implementation "com.iexec.common:iexec-common:$iexecCommonVersion"
diff --git a/src/main/resources/logback-spring.xml b/src/main/resources/logback-spring.xml
deleted file mode 100644
index 411ed485..00000000
--- a/src/main/resources/logback-spring.xml
+++ /dev/null
@@ -1,28 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  ~ Copyright 2020 IEXEC BLOCKCHAIN TECH
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~     http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<configuration>
-
-    <!-- Default -->
-    <property name="LOG_LEVEL" value="${IEXEC_LOG_LEVEL:-INFO}"/>
-    <include resource="org/springframework/boot/logging/logback/base.xml"/>
-    <logger name="org.springframework.web" level="${LOG_LEVEL}"/>
-
-    <!-- Web3J -->
-    <!-- <logger name="org.web3j.protocol" level="DEBUG"/> -->
-
-</configuration>
\ No newline at end of file
diff --git a/src/test/java/com/iexec/sms/tee/session/base/SecretSessionBaseServiceTests.java b/src/test/java/com/iexec/sms/tee/session/base/SecretSessionBaseServiceTests.java
index 02a87e20..fdbd38a2 100644
--- a/src/test/java/com/iexec/sms/tee/session/base/SecretSessionBaseServiceTests.java
+++ b/src/test/java/com/iexec/sms/tee/session/base/SecretSessionBaseServiceTests.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2022-2025 IEXEC BLOCKCHAIN TECH
+ * Copyright 2022-2026 IEXEC BLOCKCHAIN TECH
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -260,7 +260,7 @@ private DatasetOrder createDatasetOrderForBulk(final BigInteger datasetPrice,
                 .apprestrict(BytesUtils.EMPTY_ADDRESS)
                 .requesterrestrict(BytesUtils.EMPTY_ADDRESS)
                 .workerpoolrestrict(BytesUtils.EMPTY_ADDRESS)
-                .salt(Hash.sha3String(RandomStringUtils.randomAlphanumeric(20)))
+                .salt(Hash.sha3String(RandomStringUtils.secure().nextAlphanumeric(20)))
                 .build();
         return (DatasetOrder) signerService.signOrderForDomain(datasetOrder, pocoDomain);
     }