From f1d98cb3d000687519bca194978def7957766665 Mon Sep 17 00:00:00 2001
From: earthchen <earthchen@apache.org>
Date: Tue, 13 Oct 2026 19:19:26 +0800
Subject: [PATCH 1/2] Pin Spring Framework via spring-framework-bom so
 -Dspring.version works with Maven 3.10+

The configcenter-externalconfiguration scenario timed out (600s) on the
JDK 21 CI matrix since 2026-10-09: the provider AnnotationProvider dies
at startup with InaccessibleObjectException because Spring 4.3 cglib
cannot define classes on JDK 16+.

spring-boot-dependencies 1.5.22 manages Spring Framework 4.3.25.RELEASE
via its own ${spring.version} property. Under Maven 3.9.x the CI's
-Dspring.version=5.3.24 leaked into the remote BOM interpolation and
accidentally upgraded Spring to 5.3.24. Maven 3.10.0 (shipped in the
updated ubuntu-22.04 runner image) restricts interpolation of remotely
resolved models, so the override stopped working and 4.3.25 came back.

Import spring-framework-bom:${spring.version} before
spring-boot-dependencies and declare a local spring.version property
(default 5.3.24). Local-POM interpolation honours user properties on
every Maven version, making the -Dspring.version override deterministic.

Verified with Maven 3.10.0 (same as CI):
- before: spring-core 4.3.25.RELEASE even with -Dspring.version=5.3.24
- after:  spring-core/spring-jcl 5.3.24 with and without -D
---
 .../pom.xml                                          | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/3-extensions/configcenter/dubbo-samples-configcenter-externalconfiguration/pom.xml b/3-extensions/configcenter/dubbo-samples-configcenter-externalconfiguration/pom.xml
index 55254c9728..ca44d90a4a 100644
--- a/3-extensions/configcenter/dubbo-samples-configcenter-externalconfiguration/pom.xml
+++ b/3-extensions/configcenter/dubbo-samples-configcenter-externalconfiguration/pom.xml
@@ -37,6 +37,7 @@
 
         <dubbo.version>3.3.1</dubbo.version>
         <spring-boot.version>1.5.22.RELEASE</spring-boot.version>
+        <spring.version>5.3.24</spring.version>
         <javassist.version>3.29.2-GA</javassist.version>
         <junit.version>4.13.1</junit.version>
 
@@ -45,6 +46,17 @@
 
     <dependencyManagement>
         <dependencies>
+            <!-- Import spring-framework-bom first so that ${spring.version} takes precedence
+                 over the 4.3.x version managed by spring-boot-dependencies 1.5.x.
+                 Spring 4.3 cglib cannot run on JDK 16+ (InaccessibleObjectException). -->
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-framework-bom</artifactId>
+                <version>${spring.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>

From 765c855fe3d9562a196aa6cfcc88493781a3b5fd Mon Sep 17 00:00:00 2001
From: earthchen <earthchen@apache.org>
Date: Wed, 14 Oct 2026 11:29:51 +0800
Subject: [PATCH 2/2] Pin Spring Framework via spring-framework-bom in
 dubbo-samples-rest

dubbo-samples-rest imports spring-boot-dependencies 1.5.22, which
manages Spring Framework 4.3.25.RELEASE. Under Maven 3.10 the CI's
-Dspring.version=5.3.24 no longer reaches that remote BOM, so Spring 4.3
returns. Spring 4.3 pulls commons-logging 1.3.4 (managed by
dubbo-dependencies-bom), whose Log4jApiLogFactory calls
LoggerContextFactory.isClassLoaderDependent(), absent in log4j-api 2.7.
RestProvider then dies with NoSuchMethodError and the scenario times out.

Import spring-framework-bom first with a local spring.version property so
the override is deterministic, as done for configcenter-externalconfiguration.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 3-extensions/protocol/dubbo-samples-rest/pom.xml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/3-extensions/protocol/dubbo-samples-rest/pom.xml b/3-extensions/protocol/dubbo-samples-rest/pom.xml
index 38a36f66ae..f3c9e7eb03 100644
--- a/3-extensions/protocol/dubbo-samples-rest/pom.xml
+++ b/3-extensions/protocol/dubbo-samples-rest/pom.xml
@@ -35,6 +35,7 @@
 
         <dubbo.version>3.2.6</dubbo.version>
         <spring-boot.version>1.5.22.RELEASE</spring-boot.version>
+        <spring.version>5.3.24</spring.version>
         <javassist.version>3.29.2-GA</javassist.version>
         <validation-api.version>1.1.0.Final</validation-api.version>
         <hibernate-validator.version>4.2.0.Final</hibernate-validator.version>
@@ -46,6 +47,13 @@
 
     <dependencyManagement>
         <dependencies>
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-framework-bom</artifactId>
+                <version>${spring.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <!-- Import dependency management from Spring Boot -->
                 <groupId>org.springframework.boot</groupId>