·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 1. Classified findings closed: 0. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 3. Review findings remaining: 11.
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Prompt Injection | Third-party content as instructions | Low | Open |
1 finding
java-upgrade or spring-boot-4-migration delegates the namespace migrationDetecting javax.* imports alone does not authorize this migration; report them instead.
In Spring Boot projects, the Boot BOM manages Jakarta versions: do not pin the versions below, and let the Boot version decide the Jakarta EE level (Boot 4 = Jakarta EE 11, Servlet 6.1). The examples below target Jakarta EE 10 (Servlet 6.0, Tomcat 10.1+) in non-Boot projects.
Run ./mvnw verify or ./gradlew build first and record the result; do not migrate on a red baseline.
Search the codebase for all javax.* imports that need migration:
Do NOT migrate these (they remain in javax.*):
javax.sql.* — part of JDKjavax.naming.* — part of JDK (JNDI)javax.crypto.* — part of JDKjavax.net.* — part of JDKjavax.security.auth.* — part of JDKjavax.swing.*, javax.xml.parsers.* — JDK packagesReplace dependency coordinates. Choose API versions that match the target runtime; the table below is for Jakarta EE 10 (Tomcat 10.1+, Servlet 6.0):
| Target runtime | Jakarta EE | Servlet | Persistence | Validation | Annotations |
|---|---|---|---|---|---|
Tomcat 10.0 | 9 | 5.0 | 3.0 | 3.0 | 2.0 |
Tomcat 10.1 | 10 | 6.0 | 3.1 | 3.0 | 2.1 |
Tomcat 11 | 11 | 6.1 | 3.2 | 3.1 | 3.0 |
| Old | New |
|---|---|
|
|
|
|
|
|
|
|
The version must match the target Servlet level (5.0 for Tomcat 10.0, 6.0 for Tomcat 10.1, 6.1 for Tomcat 11); the example below is for Servlet 6.0:
Replace only the Jakarta EE javax. imports identified in Step 1 with their jakarta. equivalents in .java files; leave JDK packages (for example javax.sql, javax.crypto) unchanged. Also check non-Java references: persistence.xml (javax.persistence.* properties), META-INF/services, beans.xml, properties/YAML, string class names and reflection.
mvn clean compile or gradlew build — fix any compilation errorsmvn test or gradlew test — ensure all tests passjavax.* imports (excluding JDK packages)org.openrewrite.java.migrate.jakarta.JavaxMigrationToJakarta: https://docs.openrewrite.org/recipes/java/migrate/jakarta/javaxmigrationtojakartaProvide a migration summary listing all files changed, imports replaced, and any manual steps required.
Get started with chainctlchainctl skill install public/github/javax-to-jakarta-migration:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/github/skills/javax-to-jakarta-migration:latest
MIT
HARDENING.md
LICENSE
SKILL.md