Skip to content

BREAKING CHANGE(server): upgrade Java17 + TP3.7 + Groovy4 - #3117

Draft
contrueCT wants to merge 26 commits into
apache:masterfrom
hugegraph:task/tinkerpop-3.7-upgrade
Draft

contrueCT wants to merge 26 commits into
apache:masterfrom
hugegraph:task/tinkerpop-3.7-upgrade

Conversation

@contrueCT

Copy link
Copy Markdown
Contributor

Summary

This draft PR advances the HugeGraph query-engine modernization work:

  • Upgrade Apache TinkerPop to 3.7.6 and Groovy to 4.0.25.
  • Upgrade the Java runtime across the build, CI, packaging, and runtime paths.
  • Refactor the Groovy security sandbox so its boundaries remain clear and maintainable under the upgraded runtime.

The source branch contains the TinkerPop and Groovy migration baseline. Java runtime and sandbox changes will be added as the remaining parts of this upgrade work.

Related issue

* fix(server): resolve phase1 compatibility gaps

---------

Co-authored-by: imbajin <jin@apache.org>
@contrueCT contrueCT changed the title refactor(server): upgrade TinkerPop, Java, and security sandbox chore(server): upgrade TinkerPop, Java, and security sandbox Jul 25, 2026
@imbajin imbajin changed the title chore(server): upgrade TinkerPop, Java, and security sandbox BREAKING CHANGE(server): upgrade TinkerPop3.7 + Groovy4 Jul 25, 2026
@imbajin imbajin changed the title BREAKING CHANGE(server): upgrade TinkerPop3.7 + Groovy4 BREAKING CHANGE(server): upgrade Jav17 + TP3.7 + Groovy4 Jul 26, 2026
@imbajin imbajin changed the title BREAKING CHANGE(server): upgrade Jav17 + TP3.7 + Groovy4 BREAKING CHANGE(server): upgrade Java17 + TP3.7 + Groovy4 Jul 26, 2026
contrueCT and others added 2 commits August 7, 2026 22:37
- Connects TinkerPop 3.7.6's official Gherkin features to HugeGraph's provider lifecycle, with an exact 345-scenario guard and precise capability skips.
- Preserves transaction-visible vertex and edge counts, and keeps `TextP` filtering local when the backend cannot safely push it down.
- Encodes HugeGraph IDs as standard GraphBinary primitives and delegates `Path` and `Tree` GraphSON handling to TinkerPop 3.7.6.
- Hardens factory registration, provider cleanup, server/cluster test infrastructure, and upgrade-branch CI coverage.
# Conflicts:
#	hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/core/CountStrategyCoreTest.java
#	hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/tinkerpop/TestGraph.java
#	hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/unit/UnitTestSuite.java
contrueCT and others added 21 commits August 12, 2026 00:50
- Centralize the Java 17 build contract
- Adapt the runtime:
- Migrate delivery:
  - switch blocking workflows, CodeQL, dependency checks, and four product images to Java 17preflight checks without adding default Server or HStore Compose startup smoke tests.
Upgrade Apache TinkerPop from 3.7.6 to 3.8.1 across HugeGraph Server,
Struct, and Store.

- Adapt traversal optimizations to TinkerPop 3.8 APIs, including
  AggregateStep, HasContainerHolder generics, and AddVertexStepContract.
- Preserve TinkerPop 3.8 predicate semantics by keeping NotP predicates
  in local filtering, and fix negated count comparison and null handling.
- Align date-step behavior, Process/Structure test suites, and the
  TinkerPop Gherkin baseline with 3.8.1.
- Add regression coverage for negated TextP, boolean/range predicates,
  NaN comparisons, match() conditions, and CountStrategy behavior.
- Update reported TinkerPop versions and related documentation.
- Route remote HTTP and WebSocket Gremlin requests through GremlinLangScriptEngine.
- Preserve compatible text, GLV Bytecode, and Session requests on protected traversal sources.
- Reject remote Groovy, Lambda, unsafe io()/call(), and attempts to remove mandatory sandbox strategies.
- Keep ScriptFileGremlinPlugin and PRELOAD Groovy support for trusted deployment-time scripts.
@github-actions

Copy link
Copy Markdown

Due to the lack of activity, the current pr is marked as stale and will be closed after 180 days, any update will remove the stale label

@imbajin imbajin left a comment •

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Score: 7.1/10

The migration requires conflict resolution, CI verification, and operator/client upgrade documentation before release inclusion.

The POMs select TinkerPop 3.8.1. Align the PR/tracker target and document the required mounted Gremlin configuration and supported client request forms.

}

static ExecutorService newGremlinExecutorService(Settings settings) {
if (!HugeGraphWsAndHttpChannelizer.class.getName().equals(

@imbajin imbajin Oct 1, 2026 •

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P2] Ship the mounted-config and Gremlin-client migration guide

This mandatory channelizer check rejects a retained 1.7 gremlin-server.yaml using the upstream WsAndHttpChannelizer. GremlinLangRequestGuard also restricts remote text requests to gremlin-lang, so replacing only the packaged defaults leaves mounted configs and existing gremlin-groovy clients without upgrade instructions.

README/BUILDING describe Java 17 but no corresponding Gremlin migration guide or paired website PR is supplied.

Please document the required channelizer/engine/serializer names, accepted text and Bytecode request forms, and compatible Client versions; align the stated TinkerPop target with the 3.8.1 POMs. This is a static current-source contract check, not proof that the whole upgraded stack runs.

- Keep one active run per workflow and PR
- Preserve push and manual workflow executions
- Cover CI workflows on this PR target branch
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants