upgrade spock to 2.3 and groovy to 3.0.19

[reinsch82]

No description provided.

[akurtakov]

Did all these changes been ip approved by e.g. https://github.com/eclipse/dash-licenses/ ? I'm trying to move Jdt.ls to latest buildship and face a license issue eclipse-jdtls/eclipse.jdt.ls#2974 .

[donat]

Groovy and Spock are test-only dependencies and they should not appear anywhere in production.

[akurtakov]

My bad I wanted to ask for org.gradle.toolingapi. No idea why I actually asked at this PR.

[donat]

All right.

Regarding the org.gradle.toolingapi dependency: years ago the Eclipse IP team allowed us to update the tapi versions without an explicit license review.

[akurtakov]

Regarding the org.gradle.toolingapi dependency: years ago the Eclipse IP team allowed us to update the tapi versions without an explicit license review.

@waynebeaton Can this permission be somehow handled in the dash tool database or the tool itself so buildship downstreams can rely on dash licensetool?

[waynebeaton]

The easiest thing to do is to remove the the component from the information that you pass to the tool.

For the Maven plugin, you can use the excludeArtifactIds property. If you're invoking the CLI, you can use grep to filter out the entries that don't need to be reviewed.

In the meantime, I have a prototype extension that should help us find new versions of the source.

[waynebeaton]

@donat where do I find downloads (especially of source) of org.gradle:gradle-tooling-api:*.

I'm looking specifically for some kind of archive format, not a pointer to the source tree in a Git repository (I can make the latter work, but an archive file is better for a couple of reasons). Scanning these should be easy enough, so I'd like to set us up for future success (other projects have asked for this dependency).

In the meantime... I grabbed the ZIP of the source from the Eclipse Buildship project; we'll use that to push through the review of this version.

[donat]

The source jar is available here: gradle-tooling-api-8.1.1-sources.jar

[waynebeaton]

Thanks. In the future, the IPLab scanner will look on repo.gradle.org for source for this and other org.gradle packages.