Require Jenkins 2.479.1 or newer

Use Jakarta EE 9 and Spring Security 6.x instead of Java EE 8 and Spring
Security 5.x.

pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.jenkins-ci.plugins</groupId>
     <artifactId>plugin</artifactId>
-    <version>4.88</version>
+    <version>5.3</version>
     <relativePath />
   </parent>
 
@@ -48,8 +48,9 @@
     <revision>1.8.2</revision>
     <changelist>-SNAPSHOT</changelist>
     <gitHubRepo>jenkinsci/authorize-project-plugin</gitHubRepo>
-    <jenkins.baseline>2.452</jenkins.baseline>
-    <jenkins.version>${jenkins.baseline}.4</jenkins.version>
+    <!-- https://www.jenkins.io/doc/developer/plugin-development/choosing-jenkins-baseline/ -->
+    <jenkins.baseline>2.479</jenkins.baseline>
+    <jenkins.version>${jenkins.baseline}.1</jenkins.version>
     <spotbugs.effort>Max</spotbugs.effort>
     <spotbugs.threshold>Low</spotbugs.threshold>
     <spotless.check.skip>false</spotless.check.skip>

src/main/java/org/jenkinsci/plugins/authorizeproject/AuthorizeProjectProperty.java

@@ -40,12 +40,12 @@
 import hudson.model.JobPropertyDescriptor;
 import hudson.model.Queue;
 import hudson.util.FormApply;
+import jakarta.servlet.ServletException;
 import java.io.IOException;
 import java.util.Collection;
 import java.util.List;
 import java.util.logging.Level;
 import java.util.logging.Logger;
-import javax.servlet.ServletException;
 import jenkins.model.Jenkins;
 import jenkins.model.TransientActionFactory;
 import net.sf.json.JSONObject;
@@ -55,7 +55,7 @@
 import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.kohsuke.stapler.DataBoundConstructor;
 import org.kohsuke.stapler.HttpResponse;
-import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerRequest2;
 import org.kohsuke.stapler.interceptor.RequirePOST;
 
 /**
@@ -139,7 +139,7 @@ public static void setStrategyCritical() {
      * {@inheritDoc}
      */
     @Override
-    public JobProperty<?> reconfigure(StaplerRequest req, JSONObject form) throws Descriptor.FormException {
+    public JobProperty<?> reconfigure(StaplerRequest2 req, JSONObject form) throws Descriptor.FormException {
         // This is called when the job configuration is submitted.
         // authorize-project is preserved in job configuration pages.
         // It is updated via AuthorizationAction instead.
@@ -284,7 +284,8 @@ public String getIconClassName() {
         @RequirePOST
         @NonNull
         @Restricted(NoExternalUse.class)
-        public synchronized HttpResponse doAuthorize(@NonNull StaplerRequest req) throws IOException, ServletException {
+        public synchronized HttpResponse doAuthorize(@NonNull StaplerRequest2 req)
+                throws IOException, ServletException {
             job.checkPermission(Job.CONFIGURE);
             JSONObject json = req.getSubmittedForm();
             JSONObject o = json.optJSONObject(getPropertyDescriptor().getJsonSafeClassName());

src/main/java/org/jenkinsci/plugins/authorizeproject/AuthorizeProjectStrategy.java

@@ -42,7 +42,7 @@
 import org.acegisecurity.AccessDeniedException;
 import org.acegisecurity.Authentication;
 import org.kohsuke.stapler.Stapler;
-import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerRequest2;
 
 /**
  * Extension point to define a new strategy to authorize builds configured in project configuration pages.
@@ -182,7 +182,7 @@ private void checkUnsecuredConfiguration() throws ObjectStreamException {
             // It may not be allowed even if the user is an administrator of the job.
             return;
         }
-        StaplerRequest request = Stapler.getCurrentRequest();
+        StaplerRequest2 request = Stapler.getCurrentRequest2();
         AccessControlled context = (request != null) ? request.findAncestorObject(AccessControlled.class) : null;
         if (context == null) {
             context = Jenkins.get();

src/main/java/org/jenkinsci/plugins/authorizeproject/AuthorizeProjectStrategyDescriptor.java

@@ -31,7 +31,7 @@
 import java.util.List;
 import jenkins.model.Jenkins;
 import net.sf.json.JSONObject;
-import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerRequest2;
 
 /**
  * Base {@link Descriptor} class for {@link AuthorizeProjectStrategy} instances.
@@ -91,7 +91,7 @@ public static List<AuthorizeProjectStrategyDescriptor> getDescriptorsForGlobalSe
      * Invoked when configuration is submitted from "Configure Global Security" as a child of {@link ProjectQueueItemAuthenticator}.
      * You should call save() by yourself.
      */
-    public void configureFromGlobalSecurity(StaplerRequest req, JSONObject js) throws FormException {}
+    public void configureFromGlobalSecurity(StaplerRequest2 req, JSONObject js) throws FormException {}
 
     /**
      * @return this strategy can be enabled by default.

src/main/java/org/jenkinsci/plugins/authorizeproject/AuthorizeProjectUtil.java

@@ -30,7 +30,7 @@
 import hudson.model.Descriptor.FormException;
 import jenkins.model.Jenkins;
 import net.sf.json.JSONObject;
-import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerRequest2;
 
 /**
  *
@@ -40,7 +40,7 @@ public class AuthorizeProjectUtil {
      * Create a new {@link Describable} object from user inputs.
      */
     public static <T extends Describable<?>> T bindJSONWithDescriptor(
-            StaplerRequest req, JSONObject formData, String fieldName, Class<T> clazz) throws FormException {
+            StaplerRequest2 req, JSONObject formData, String fieldName, Class<T> clazz) throws FormException {
         formData = formData.getJSONObject(fieldName);
         if (formData == null || formData.isNullObject()) {
             return null;

src/main/java/org/jenkinsci/plugins/authorizeproject/ConfigurationPermissionEnforcer.java

@@ -12,7 +12,7 @@
 import org.kohsuke.accmod.Restricted;
 import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.kohsuke.stapler.DataBoundConstructor;
-import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerRequest2;
 
 /**
  * A dummy {@link JobProperty} responsible for providing the {@link AuthorizeProjectStrategy} with a veto over job
@@ -47,7 +47,7 @@ public String getDisplayName() {
          * {@inheritDoc}
          */
         @Override
-        public JobProperty<?> newInstance(@NonNull StaplerRequest req, JSONObject formData) throws FormException {
+        public JobProperty<?> newInstance(@NonNull StaplerRequest2 req, JSONObject formData) throws FormException {
             Job<?, ?> job = req.findAncestorObject(Job.class);
             AccessControlled context = req.findAncestorObject(AccessControlled.class);
             checkConfigurePermission(job, context);

src/main/java/org/jenkinsci/plugins/authorizeproject/GlobalQueueItemAuthenticator.java

@@ -11,7 +11,7 @@
 import org.acegisecurity.Authentication;
 import org.jenkinsci.plugins.authorizeproject.strategy.AnonymousAuthorizationStrategy;
 import org.kohsuke.stapler.DataBoundConstructor;
-import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerRequest2;
 
 /**
  * A global default authenticator to allow changing the default for all projects.
@@ -65,13 +65,13 @@ public AuthorizeProjectStrategy getDefaultStrategy() {
 
         /**
          * Creates new {@link GlobalQueueItemAuthenticator} from inputs.
-         * This is required to call {@link hudson.model.Descriptor#newInstance(StaplerRequest, JSONObject)}
+         * This is required to call {@link hudson.model.Descriptor#newInstance(StaplerRequest2, JSONObject)}
          * of {@link AuthorizeProjectProperty}.
          *
-         * @see hudson.model.Descriptor#newInstance(org.kohsuke.stapler.StaplerRequest, net.sf.json.JSONObject)
+         * @see hudson.model.Descriptor#newInstance(org.kohsuke.stapler.StaplerRequest2, net.sf.json.JSONObject)
          */
         @Override
-        public GlobalQueueItemAuthenticator newInstance(StaplerRequest req, JSONObject formData) throws FormException {
+        public GlobalQueueItemAuthenticator newInstance(StaplerRequest2 req, JSONObject formData) throws FormException {
             if (formData == null || formData.isNullObject()) {
                 return null;
             }

src/main/java/org/jenkinsci/plugins/authorizeproject/ProjectQueueItemAuthenticator.java

@@ -43,7 +43,7 @@
 import net.sf.json.JSONObject;
 import org.acegisecurity.Authentication;
 import org.kohsuke.stapler.DataBoundConstructor;
-import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerRequest2;
 
 /**
  * Authorize builds of projects configured with {@link AuthorizeProjectProperty}.
@@ -179,10 +179,11 @@ public List<Descriptor<AuthorizeProjectStrategy>> getAvailableDescriptorList() {
          * @param formData the form data.
          * @return the authenticator.
          * @throws hudson.model.Descriptor.FormException if the submitted form is invalid.
-         * @see hudson.model.Descriptor#newInstance(org.kohsuke.stapler.StaplerRequest, net.sf.json.JSONObject)
+         * @see hudson.model.Descriptor#newInstance(org.kohsuke.stapler.StaplerRequest2, net.sf.json.JSONObject)
          */
         @Override
-        public ProjectQueueItemAuthenticator newInstance(StaplerRequest req, JSONObject formData) throws FormException {
+        public ProjectQueueItemAuthenticator newInstance(StaplerRequest2 req, JSONObject formData)
+                throws FormException {
             Set<String> enabledStrategies = new HashSet<>();
             Set<String> disabledStrategies = new HashSet<>();
 

src/main/java/org/jenkinsci/plugins/authorizeproject/strategy/SpecificUsersAuthorizationStrategy.java

@@ -54,7 +54,7 @@
 import org.kohsuke.stapler.DataBoundConstructor;
 import org.kohsuke.stapler.DataBoundSetter;
 import org.kohsuke.stapler.QueryParameter;
-import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerRequest2;
 
 /**
  * Run builds as a user specified in project configuration pages.
@@ -290,7 +290,7 @@ public String calcCheckPasswordRequestedUrl() {
          */
         @Restricted(NoExternalUse.class) // used by stapler/jelly
         @SuppressWarnings("unused")
-        public String doCheckPasswordRequested(StaplerRequest req, @QueryParameter String userid) {
+        public String doCheckPasswordRequested(StaplerRequest2 req, @QueryParameter String userid) {
             return Boolean.toString(isAuthenticationRequired(userid.trim()));
         }
 
@@ -324,7 +324,7 @@ public FormValidation doCheckUserid(@QueryParameter String userid) {
         @Restricted(NoExternalUse.class) // used by stapler/jelly
         @SuppressWarnings("unused")
         public FormValidation doCheckPassword(
-                StaplerRequest req,
+                StaplerRequest2 req,
                 @QueryParameter String userid,
                 @QueryParameter String password,
                 @QueryParameter String apitoken,

src/main/java/org/jenkinsci/plugins/authorizeproject/strategy/SystemAuthorizationStrategy.java

@@ -40,7 +40,7 @@
 import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.kohsuke.stapler.DataBoundConstructor;
 import org.kohsuke.stapler.QueryParameter;
-import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerRequest2;
 
 /**
  * Run builds as {@link ACL#SYSTEM}. Using this strategy becomes important when
@@ -176,15 +176,15 @@ public boolean isJob(Object it) {
          * {@inheritDoc}
          */
         @Override
-        public void configureFromGlobalSecurity(StaplerRequest req, JSONObject js) throws FormException {
+        public void configureFromGlobalSecurity(StaplerRequest2 req, JSONObject js) throws FormException {
             setPermitReconfiguration(js.getBoolean("permitReconfiguration"));
         }
 
         /**
          * {@inheritDoc}
          */
         @Override
-        public SystemAuthorizationStrategy newInstance(StaplerRequest req, JSONObject formData) throws FormException {
+        public SystemAuthorizationStrategy newInstance(StaplerRequest2 req, JSONObject formData) throws FormException {
             SystemAuthorizationStrategy result = (SystemAuthorizationStrategy) super.newInstance(req, formData);
             Jenkins instance = Jenkins.get();
             if (!instance.hasPermission(Jenkins.RUN_SCRIPTS)) {

src/test/java/org/jenkinsci/plugins/authorizeproject/ProjectQueueItemAuthenticatorTest.java

@@ -70,7 +70,7 @@
 import org.jvnet.hudson.test.JenkinsRule.WebClient;
 import org.jvnet.hudson.test.TestExtension;
 import org.kohsuke.stapler.DataBoundConstructor;
-import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerRequest2;
 
 public class ProjectQueueItemAuthenticatorTest {
     @Rule
@@ -284,7 +284,8 @@ public String getDisplayName() {
             }
 
             @Override
-            public void configureFromGlobalSecurity(StaplerRequest req, JSONObject js) throws Descriptor.FormException {
+            public void configureFromGlobalSecurity(StaplerRequest2 req, JSONObject js)
+                    throws Descriptor.FormException {
                 throw new FormException("Should not be called for global-security.jelly is not defined.", "");
             }
         }
@@ -320,7 +321,8 @@ public String getDisplayName() {
             }
 
             @Override
-            public void configureFromGlobalSecurity(StaplerRequest req, JSONObject js) throws Descriptor.FormException {
+            public void configureFromGlobalSecurity(StaplerRequest2 req, JSONObject js)
+                    throws Descriptor.FormException {
                 value = js.getString("value");
                 save();
             }
@@ -358,7 +360,8 @@ public String getDisplayName() {
             }
 
             @Override
-            public void configureFromGlobalSecurity(StaplerRequest req, JSONObject js) throws Descriptor.FormException {
+            public void configureFromGlobalSecurity(StaplerRequest2 req, JSONObject js)
+                    throws Descriptor.FormException {
                 value = js.getString("value");
                 save();
             }

src/test/java/org/jenkinsci/plugins/authorizeproject/strategy/SpecificUsersAuthorizationStrategyTest.java

@@ -357,7 +357,7 @@ public void testRestInterfaceSuccess() throws Exception {
                 new URL(wc.getContextPath() + String.format("%s/config.xml", destProject.getUrl())), HttpMethod.POST);
         req.setAdditionalHeader(
                 j.jenkins.getCrumbIssuer().getCrumbRequestField(),
-                j.jenkins.getCrumbIssuer().getCrumb(null));
+                j.jenkins.getCrumbIssuer().getCrumb((jakarta.servlet.ServletRequest) null));
         req.setRequestBody(configXml);
         wc.getPage(req);
 
@@ -410,7 +410,7 @@ public void testRestInterfaceFailure() throws Exception {
                 new URL(wc.getContextPath() + String.format("%s/config.xml", destProject.getUrl())), HttpMethod.POST);
         req.setAdditionalHeader(
                 j.jenkins.getCrumbIssuer().getCrumbRequestField(),
-                j.jenkins.getCrumbIssuer().getCrumb(null));
+                j.jenkins.getCrumbIssuer().getCrumb((jakarta.servlet.ServletRequest) null));
         req.setRequestBody(configXml);
 
         assertThrows(FailingHttpStatusCodeException.class, () -> wc.getPage(req));

src/test/java/org/jenkinsci/plugins/authorizeproject/strategy/SystemAuthorizationStrategyTest.java

@@ -185,7 +185,7 @@ public void testRestInterfaceSuccess() throws Exception {
                 new URL(wc.getContextPath() + String.format("%s/config.xml", destProject.getUrl())), HttpMethod.POST);
         req.setAdditionalHeader(
                 j.jenkins.getCrumbIssuer().getCrumbRequestField(),
-                j.jenkins.getCrumbIssuer().getCrumb(null));
+                j.jenkins.getCrumbIssuer().getCrumb((jakarta.servlet.ServletRequest) null));
         req.setRequestBody(configXml);
         wc.getPage(req);
 
@@ -235,7 +235,7 @@ public void testRestInterfaceFailure() throws Exception {
                 new URL(wc.getContextPath() + String.format("%s/config.xml", destProject.getUrl())), HttpMethod.POST);
         req.setAdditionalHeader(
                 j.jenkins.getCrumbIssuer().getCrumbRequestField(),
-                j.jenkins.getCrumbIssuer().getCrumb(null));
+                j.jenkins.getCrumbIssuer().getCrumb((jakarta.servlet.ServletRequest) null));
         req.setRequestBody(configXml);
 
         assertThrows(FailingHttpStatusCodeException.class, () -> wc.getPage(req));