GEODE-10549: Upgrade commons-io from 2.15.1 to 2.18.0

[JinwooHwang]

Summary

This PR upgrades Apache Commons IO from version 2.15.1 to 2.18.0 in the Geode 1.15 codebase. This upgrade addresses potential security vulnerabilities and brings performance improvements from the latest commons-io release.

Changes Made

Version Update

• File: build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
• Updated commons-io.version from "2.15.1" to "2.18.0" (line 36)

What is Commons IO?

Apache Commons IO is a library of utilities to assist with developing IO functionality. It provides:

• Utility classes for common file operations
• Stream implementations
• File filters and comparators
• Endianness support

Geode uses Commons IO extensively for:

• File system operations
• Stream handling
• Resource management
• Test utilities

Testing Performed

All Tests Passed

• Full Test Suite: ./gradlew test with Java 8
• Build Status: BUILD SUCCESSFUL in 8m 25s
• Test Results: 210 actionable tasks (141 executed, 10 from cache, 59 up-to-date)
• Modules Tested: All 30+ Geode modules

Test Coverage

All unit tests across the entire codebase passed without any failures:

• geode-core
• geode-log4j
• geode-logging
• geode-http-service
• geode-cq
• geode-connectors
• geode-gfsh
• geode-management
• geode-membership
• geode-lucene
• geode-wan
• geode-web
• geode-web-api
• geode-web-management
• geode-dunit
• geode-junit
• All extension modules (geode-modules, session management)
• All other subprojects

Dependency Analysis

Before (Commons IO 2.15.1)

deps.put("commons-io.version", "2.15.1")

After (Commons IO 2.18.0)

deps.put("commons-io.version", "2.18.0")

Version History

• 2.15.1 (Previous): Released 2024
• 2.16.0: Minor improvements and bug fixes
• 2.17.0: Additional utilities and performance enhancements
• 2.18.0 (Current): Latest stable release with security fixes and performance improvements

Impact Analysis

Breaking Changes

• None - Commons IO 2.18.0 maintains backward compatibility with 2.15.1
• All existing APIs remain stable
• No code changes required in Geode codebase

Security Improvements

• Addresses potential vulnerabilities in file handling
• Improved input validation
• Enhanced resource cleanup mechanisms

Performance Benefits

• Optimized stream operations
• More efficient file I/O operations
• Reduced memory footprint in certain operations

Compatibility

Geode Version

• Target: Apache Geode 1.15.x (support/1.15 branch)
• Base: support/1.15
• Compatible with all 1.15.x releases

Migration Reference

This upgrade follows standard dependency update practices:

• Single version constant update
• No API changes required
• Full test suite verification
• Backward compatible upgrade

Checklist

• Updated commons-io version in dependency constraints
• Verified all unit tests pass
• Verified full build succeeds
• Confirmed Java 8 compatibility
• No breaking changes introduced
• Documented version change
• Created detailed commit message

Recommendations for Reviewers

1. Focus Areas:

   • Verify DependencyConstraints.groovy change is correct
   • Confirm version 2.18.0 is the intended target
   • Review test execution results

2. Testing Strategy:

   • Run full test suite: ./gradlew test
   • Verify build: ./gradlew clean build -x test
   • Optional: Run integration tests for file I/O heavy modules

3. Future Work:

   • Monitor for any runtime issues in production
   • Consider upgrading to newer versions as they become available
   • Track Commons IO release notes for future security updates

Related Issues

• JIRA: GEODE-10549
• Target Branch: support/1.15
• Base Branch: support/1.15

Additional Notes

This is a straightforward dependency version upgrade for the 1.15 support branch. The main development branch already has a newer version of Commons IO. This upgrade focuses on security and stability improvements for the 1.15 release line while maintaining full backward compatibility.

Commons IO is a foundational library used throughout the Geode codebase, making this a low-risk but important upgrade for security and performance reasons.

For all changes, please confirm:

• Is there a JIRA ticket associated with this PR? Is it referenced in the commit message?
• Has your PR been rebased against the latest commit within the target branch (typically develop)?
• Is your initial contribution a single, squashed commit?
• Does gradlew build run cleanly?
• Have you written or updated unit tests to verify your changes?
• If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?