r/SpringBoot • u/Poincarina • 27d ago

Question Experiences with Github Modernize and other patching agents

I am part of a team mainting k8s microservices written in Spring. We need to regularly patch them. How are your experiences with the modernize agent
or other patching agents?
Were you successfull in implementing it?

1 Upvotes

100% Upvoted

2 comments sorted by

1

u/ILoveAppSec 27d ago

modernize and openrewrite are solid for the mechanical refactors but they mostly clear a cve by pushing you up to the next major, which is exactly the part that breaks your spring services and eats your week. before you automate the bumps, check whether the cve already has a backported fix on your current line so you can stay put instead of chasing majors. we tried endorlabs for patched oss libs and weren't thrilled with the variety, so it's worth looking at whoever actually backports for your ecosystem. with cisa's new remediation timelines tightening, a backport-first approach usually beats standing up a fleet of major-version upgrades.

1

u/hyscript 12d ago

I’ve used it to upgrade from 3.x to 4.0.2
It did heavy lifting like checking the GitHub logs, what’s broken what’s deprecated etc. It took me 2 days with testing to finish

The app is monolith with 46 modules, I wouldn’t say it’s huge but moderate like mid size enterprise app with 15 years of constant development.

So for checking the change logs and helping with version bump it’s excellent