fix(build): remove Spring Boot 2 Gradle plugin for Gradle 9 compatibility

[adinauer]

📜 Description

Shadow 9.x DuplicatesStrategy fix

Shadow 9.x enforces DuplicatesStrategy before transformers (like mergeServiceFiles and AppendingTransformer) can process duplicates. This means FAIL or EXCLUDE prevents service files and Spring metadata from being merged. All shadow JAR tasks now use DuplicatesStrategy.INCLUDE to let transformers see all duplicate entries.

Spring Boot 2 Gradle plugin removal

Remove the Spring Boot 2 Gradle plugin (org.springframework.boot v2.7.18) which is incompatible with Gradle 9 due to use of removed API LenientConfiguration.getFiles().

Library modules (sentry-spring, sentry-spring-boot, sentry-spring-boot-starter):

• These only used the plugin with apply false to access SpringBootPlugin.BOM_COORDINATES
• Replaced with a direct BOM reference via version catalog (libs.springboot2.bom)

Sample apps (spring-boot, webflux, otel, netflix-dgs):

• Replaced Spring Boot plugin + io.spring.dependency-management with Shadow plugin (com.gradleup.shadow) for fat JAR creation
• Added application plugin for main class configuration
• Uses platform(libs.springboot2.bom) for dependency version management
• Shadow JAR configured with DuplicatesStrategy.INCLUDE + append() to merge Spring metadata files (spring.factories, spring.handlers, spring.schemas, spring-autoconfigure-metadata.properties)
• BootRun task in otel sample replaced with standard JavaExec

OTel agent shadow JAR fix

• sentry-opentelemetry-agent shadowJar switched from DuplicatesStrategy.FAIL to INCLUDE so mergeServiceFiles can merge inst/META-INF/services/ from the upstream OTel agent and the distro libs

System test runner

• Auto-detects shadowJar vs bootJar build task per module
• Fallback HTTP readiness check for shadow JAR apps (actuator web endpoints don't work in flat JARs)

Note: Spring Boot 3 and 4 plugins are unaffected — they are already Gradle 9 compatible.

💡 Motivation and Context

Stacked on top of #5063. The Spring Boot 2.7.x Gradle plugin uses LenientConfiguration.getFiles() which was removed in Gradle 9, causing bootJar and build tasks to fail. Shadow 9.x changed duplicate handling behavior requiring DuplicatesStrategy.INCLUDE for transformer-based merging to work.

💚 How did you test it?

• ./gradlew :sentry-spring:compileJava :sentry-spring-boot:compileJava :sentry-spring-boot-starter:compileJava — passes
• ./gradlew :sentry-spring:test — passes
• All 5 sample shadow JARs build successfully with properly merged spring.factories (170+ lines)
• Sample app starts, serves HTTP, detected as ready by system test runner
• ./gradlew :sentry-opentelemetry:sentry-opentelemetry-agent:shadowJar — passes, service files properly merged
• Verified merged service file contains entries from both upstream OTel agent and distro

📝 Checklist

• No breaking change or entry added to the changelog.
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.

🔮 Next steps

Other Gradle 9 compatibility fixes in the parent PR.

#skip-changelog

[github-actions]

Semver Impact of This PR

🟢 Patch (bug fixes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

This PR will not appear in the changelog.

---

_{🤖 This preview updates automatically when you update the PR.}

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.37.1 (1)	release

⚙️ sentry-android Build Distribution Settings

[github-actions]

Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	314.21 ms	346.67 ms	32.45 ms
Size	0 B	0 B	0 B

Baseline results on branch: deps/scripts/update-gradle.sh

Startup times

Revision	Plain	With Sentry	Diff
7a32266	305.50 ms	364.17 ms	58.67 ms

App size

Revision	Plain	With Sentry	Diff
7a32266	0 B	0 B	0 B

Previous results on branch: fix/spring-boot2-gradle9

Startup times

Revision	Plain	With Sentry	Diff
73551a0	319.50 ms	363.84 ms	44.34 ms
cba6cf7	347.26 ms	404.00 ms	56.74 ms
3fe59c8	314.31 ms	316.73 ms	2.41 ms
99a62d0	338.20 ms	392.86 ms	54.66 ms
3caac95	272.74 ms	354.80 ms	82.06 ms
6801bad	311.75 ms	359.57 ms	47.82 ms
67e6872	315.85 ms	355.78 ms	39.92 ms
46ccd28	387.92 ms	463.33 ms	75.41 ms
7b6e574	312.53 ms	366.39 ms	53.86 ms
20e3a13	354.49 ms	425.15 ms	70.66 ms

App size

Revision	Plain	With Sentry	Diff
73551a0	0 B	0 B	0 B
cba6cf7	0 B	0 B	0 B
3fe59c8	0 B	0 B	0 B
99a62d0	0 B	0 B	0 B
3caac95	0 B	0 B	0 B
6801bad	0 B	0 B	0 B
67e6872	0 B	0 B	0 B
46ccd28	0 B	0 B	0 B
7b6e574	0 B	0 B	0 B
20e3a13	0 B	0 B	0 B

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Shadow 9.x upgrade breaks mergeServiceFiles in three samples
  • Added duplicatesStrategy = DuplicatesStrategy.INCLUDE to the console, JUL, and logback sample shadowJar tasks so mergeServiceFiles() receives duplicate service entries under Shadow 9.x.
• ✅ Fixed: Redundant mergeServiceFiles() is no-op in Spring Boot samples
  • Removed no-op mergeServiceFiles() calls from the spring-boot, spring-boot-webflux, and netflix-dgs sample shadowJar tasks to match their actual metadata/service merging via MergeSpringMetadataAction.

Or push these changes by commenting:

@cursor push 29cf9ae479

Preview (29cf9ae479)

diff --git a/sentry-samples/sentry-samples-console/build.gradle.kts b/sentry-samples/sentry-samples-console/build.gradle.kts
--- a/sentry-samples/sentry-samples-console/build.gradle.kts
+++ b/sentry-samples/sentry-samples-console/build.gradle.kts
@@ -51,6 +51,7 @@
 tasks.shadowJar {
   manifest { attributes["Main-Class"] = "io.sentry.samples.console.Main" }
   archiveClassifier.set("") // Remove the classifier so it replaces the regular JAR
+  duplicatesStrategy = DuplicatesStrategy.INCLUDE
   mergeServiceFiles()
 }
 

diff --git a/sentry-samples/sentry-samples-jul/build.gradle.kts b/sentry-samples/sentry-samples-jul/build.gradle.kts
--- a/sentry-samples/sentry-samples-jul/build.gradle.kts
+++ b/sentry-samples/sentry-samples-jul/build.gradle.kts
@@ -44,6 +44,7 @@
 tasks.shadowJar {
   manifest { attributes["Main-Class"] = "io.sentry.samples.jul.Main" }
   archiveClassifier.set("") // Remove the classifier so it replaces the regular JAR
+  duplicatesStrategy = DuplicatesStrategy.INCLUDE
   mergeServiceFiles()
 }
 

diff --git a/sentry-samples/sentry-samples-logback/build.gradle.kts b/sentry-samples/sentry-samples-logback/build.gradle.kts
--- a/sentry-samples/sentry-samples-logback/build.gradle.kts
+++ b/sentry-samples/sentry-samples-logback/build.gradle.kts
@@ -44,6 +44,7 @@
 tasks.shadowJar {
   manifest { attributes["Main-Class"] = "io.sentry.samples.logback.Main" }
   archiveClassifier.set("") // Remove the classifier so it replaces the regular JAR
+  duplicatesStrategy = DuplicatesStrategy.INCLUDE
   mergeServiceFiles()
 }
 

diff --git a/sentry-samples/sentry-samples-netflix-dgs/build.gradle.kts b/sentry-samples/sentry-samples-netflix-dgs/build.gradle.kts
--- a/sentry-samples/sentry-samples-netflix-dgs/build.gradle.kts
+++ b/sentry-samples/sentry-samples-netflix-dgs/build.gradle.kts
@@ -42,7 +42,6 @@
 tasks.shadowJar {
   manifest { attributes["Main-Class"] = "io.sentry.samples.netflix.dgs.NetlixDgsApplication" }
   archiveClassifier.set("")
-  mergeServiceFiles()
 
   val springMetadataFiles =
     listOf(

diff --git a/sentry-samples/sentry-samples-spring-boot-webflux/build.gradle.kts b/sentry-samples/sentry-samples-spring-boot-webflux/build.gradle.kts
--- a/sentry-samples/sentry-samples-spring-boot-webflux/build.gradle.kts
+++ b/sentry-samples/sentry-samples-spring-boot-webflux/build.gradle.kts
@@ -52,7 +52,6 @@
 tasks.shadowJar {
   manifest { attributes["Main-Class"] = "io.sentry.samples.spring.boot.SentryDemoApplication" }
   archiveClassifier.set("")
-  mergeServiceFiles()
 
   val springMetadataFiles =
     listOf(

diff --git a/sentry-samples/sentry-samples-spring-boot/build.gradle.kts b/sentry-samples/sentry-samples-spring-boot/build.gradle.kts
--- a/sentry-samples/sentry-samples-spring-boot/build.gradle.kts
+++ b/sentry-samples/sentry-samples-spring-boot/build.gradle.kts
@@ -79,7 +79,6 @@
 tasks.shadowJar {
   manifest { attributes["Main-Class"] = "io.sentry.samples.spring.boot.SentryDemoApplication" }
   archiveClassifier.set("")
-  mergeServiceFiles()
 
   // Shadow 9.x enforces DuplicatesStrategy before transformers run, so `append`
   // only sees one copy of each file. We merge Spring metadata from the runtime

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 327123a. Configure here.}

[cursor]

Missing DuplicatesStrategy.INCLUDE breaks mergeServiceFiles in Shadow 9.x

Medium Severity

The Shadow plugin was upgraded from 8.3.6 to 9.4.1 in libs.versions.toml. Shadow 9.x enforces DuplicatesStrategy before transformers run, and the default is EXCLUDE. These three samples call mergeServiceFiles() without setting DuplicatesStrategy.INCLUDE, meaning duplicate service files are silently discarded before the transformer can merge them. The sibling samples (console-opentelemetry-noagent, console-otlp, log4j2) correctly add DuplicatesStrategy.INCLUDE alongside mergeServiceFiles(), but these three were missed.

Additional Locations (2)

• sentry-samples/sentry-samples-logback/build.gradle.kts#L46-L47
• sentry-samples/sentry-samples-jul/build.gradle.kts#L46-L47

 

^{Reviewed by Cursor Bugbot for commit 327123a. Configure here.}

[romtsn]

I built the current jars for sentry-samples/sentry-samples-console/build.gradle.kts:47, sentry-samples/sentry-samples-jul/build.gradle.kts:40, and sentry-samples/sentry-samples-logback/build.gradle.kts:40 in a
temp worktree, then added duplicatesStrategy = DuplicatesStrategy.INCLUDE to those three shadowJar blocks and rebuilt.

Results:

• jul: jar was byte-identical before/after.
• logback: jar was byte-identical before/after.
• console: jar changed, but only because INCLUDE preserved duplicate non-service resources like LICENSE, META-INF/LICENSE, META-INF/NOTICE, and about.html.

For the actual service files, the outputs were unchanged. In console, all three service files were identical before/after:

• META-INF/services/io.sentry.profiling.JavaContinuousProfilerProvider
• META-INF/services/io.sentry.profiling.JavaProfileConverterProvider
• META-INF/services/javax.cache.spi.CachingProvider

So the general Shadow 9 point is true in principle, but it doesn’t produce a functional difference in these three sample jars. I would leave this comment unresolved as non-actionable.