[PLAN] Dependency refresh: EDC v0.18.0 (preferred), Metaform JAD/CFM, and OSS baseline (Java, Gradle, Neo4j, Postgres, Node, …)

[ma3u]

Context

Three layers of drift, in priority order:

1️⃣ Eclipse EDC components (preferred — eclipse-edc org)

Built on EDC v0.16.0 (ADR-020, 2026-02-19). Upstream:

Component	We use	Latest	Released
Connector	v0.16.0	v0.18.0	2026-06-30
IdentityHub	v0.16.0	v0.18.0	2026-06-30
FederatedCatalog	federated-catalog-core 0.16.0	v0.16.0	current ✅

2️⃣ Metaform JAD/CFM sources (Metaform org)

Our ghcr.io/ma3u/health-dataspace/jad-* and cfm-* images are source-built (ADR-005) from Metaform repos: jad, cfm-edc, cfm-fulcrum. Build commit per image: UNKNOWN — must be inventoried (images float on :latest). CFM agents are compiled against the EDC BOM, so tier 1 and tier 2 must move together.

3️⃣ OSS baseline (repo-verified versions)

Component	Local (docker-compose*)	Azure (scripts/azure/env.sh)	Note
PostgreSQL	postgres:17.7-alpine	postgres:16	⚠️ version skew local vs Azure
Neo4j	neo4j:5-community	neo4j:5-community	evaluate 2025.x LTS line
Keycloak	quay.io/keycloak/keycloak:latest	:latest	unpinned
Vault	hashicorp/vault:latest	:latest	unpinned (in-memory dev mode)
NATS	nats:alpine	:alpine	unpinned
Traefik	traefik:v3.4	—	pinned ✅
Node.js	proxy engines >=20, CI node-version: 20	—	⚠️ Node 20 LTS reached maintenance EOL 2026-04-30 → move to 22 LTS
Python (crawler/enricher)	requires-python >=3.12	—	fine; revisit with 3.13
Java / Gradle	via Metaform source builds	—	versions UNKNOWN in this repo — inventory in Phase A; check EDC v0.18 JDK baseline

Plan

Phase A — Inventory & pin (no upgrades)

• Record source commit Inventoried (PR chore(deps): issue #97 Phase A — pin all image versions + ADR-029 #100): all 11 images built 2026-04-11, no OCI labels → source commits unrecoverable; digests recorded in ADR-029. Known-commit rebuild + mandatory labels moved to Phase B
• Replace every :latest/:alpine with immutable tags in docker-compose*.yml + scripts/azure/env.sh (PR chore(deps): issue #97 Phase A — pin all image versions + ADR-029 #100: keycloak 26.6.0, vault 2.0, nats 2.14.3-alpine, neo4j 5.26.28-community, curl 8.21.0, ghcr images digest-pinned; mvhd-ui/proxy stay :latest by design)
• Resolve the Postgres 16-vs-17.7 skew — documented why not (ADR-029 §4): Azure pins 16.14 on major 16 until a pg_upgrade runbook exists (ACA persistent storage, ADR-017); migration runbook is a Phase C deliverable
• ADR: ADR-029 — Dependency Version Pinning & Refresh Cadence (Accepted, linked in planning index)

Phase B — EDC v0.18.0 (tier 1) + Metaform rebuild (tier 2)

• Review Connector v0.17/v0.18 release notes — analysis in docs/planning/current/issue-97-phase-b-analysis.md; gate additionally found: v5alpha→v5beta + enforced OAuth, mandatory NATS events, mandatory siglet service
• Rebuild Superseded: consume Metaform's public per-commit images (ghcr.io/metaform/jad/*@4a7e5bd0) — promoted to the default stack in PR feat(edc)!: promote EDC 0.18 JAD launchers — Phase B gate green (issue #97) #102 after a green gate. CFM agents unchanged (compatible; managers re-pinned to working digests after GHCR tag-drift find)
• DCP v1.0 attestation on 0.18: 16 passed / 0 failed / 6 skipped (PR feat(edc)!: promote EDC 0.18 JAD launchers — Phase B gate green (issue #97) #102 gate)
• Crawler stays on federated-catalog-core 0.16.0 (still upstream latest, verified 2026-07-15)

Phase C — OSS baseline (tier 3)

• Node 20 → 22 LTS: ui + services/neo4j-proxy engines, CI setup-node, local dev note (repo already runs under Node 25 locally — the vitest storage polyfill in ui/__tests__/setup.ts covers Node ≥22 webstorage)
• Postgres/Keycloak/Vault/NATS pinned minor-version bumps, one service per PR
• Neo4j 5 → 2025.x LTS spike: vector-index + GDS compatibility (docs/gotchas.md 2026-04 entries) before committing

Phase D — Validate & roll out

• ./scripts/run-dsp-tck.sh + ./scripts/run-ehds-tests.sh green
• JAD seed phases 1–7 on the upgraded stack (strict order)
• Playwright --project=live incl. J730–J749 federated journeys
• Azure rollout via CI (ACA :latest caching + CI-SP write pattern, docs/gotchas.md), ADR-027 off-hours schedule intact

Risks

• EDC v0.16 → v0.18 spans two minors; management-API paths have moved between alpha versions before
• CFM agents break if the connector moves without a lockstep Metaform rebuild (ADR-005)
• Neo4j major-line move risks GDS/vector-index regressions — spike first, ADR before migrating

Related

ADR-005 · ADR-020 · ADR-022/024 · ADR-027 · issue #8 (closed) · planning item docs/planning/future/issue-97-edc-upgrade.md

[ma3u]

Phase A complete (PR #100, merged; ADR-029 Accepted).

Key facts from the inventory worth carrying into Phase B:

• All 11 GHCR JAD/CFM images date from 2026-04-11 (EDC 0.16 era) and carry no OCI provenance labels — the exact Metaform source commits are unrecoverable. Phase B must rebuild from pinned commits and make org.opencontainers.image.revision/.source labels mandatory.
• All six cfm-* tags point at one shared image (single multi-role binary) — one rebuild covers all six.
• ADR-005 correction: CFM is Go/Make (not Java/EDC-BOM as the issue text said); JAD is Java/Gradle. The lockstep requirement stands, but via API compatibility rather than a shared BOM.
• Live Keycloak verified at 26.6.0 / Java 21.0.10.

Operational note: the pinned tags land on ACA at the next provisioning/mirror run — the az CLI session here expired, so live re-mirror + revision verification is pending (az login then re-run mirror steps of scripts/azure/02–04, or let CI provisioning pick it up).

Next: Phase B — EDC v0.18.0 release-notes review, then lockstep JAD/CFM rebuild with versioned tags.

[ma3u]

Phase B groundwork merged (PR #101). Release-notes review ✅ — full mapping in issue-97-phase-b-analysis.md.

Plan change — no rebuild needed: Metaform's CI publishes public per-commit, multi-arch images for exactly our four launchers (ghcr.io/metaform/jad/{controlplane,dataplane,identity-hub,issuerservice}:<git-sha>). The EDC-0.18-aligned HEAD 4a7e5bd0 (jad main, edc = 0.18.0-SNAPSHOT) is already published with OCI source labels. docker-compose.jad-edc018.yml is the opt-in overlay.

Breaking changes that matter to us: DPS becomes default (both dataplanes) · identity moves to sub claim (DCP suite) · dct conformsTo (catalog-enricher mapping + fixture test needed) · Vault token-exchange (pairs with the Phase A Vault 2.0 pin) · agreement-claims DB migration (snapshot Azure controlplane DB before cutover). Our management-API usage is already v5alpha — no code change expected there.

Remaining for Phase B (needs a running JAD stack): bring up the overlay → bootstrap-jad.sh + seed 1–7 → run-dcp-tests.sh / run-dsp-tck.sh / run-ehds-tests.sh → Playwright --project=live → then promote the image refs in docker-compose.jad.yml + scripts/azure/env.sh.

Note: consider waiting for a jad commit built against released 0.18.0 (current HEAD predates the 2026-06-30 release and uses the snapshot) — check Metaform/jad main before promoting.

[ma3u]

✅ Phase B complete — EDC 0.18 promoted to the default stack (PR #102)

Validation gate, all green (local JAD stack, 2026-07-15): stack boot 19 services + siglet healthy · seed incl. DPS transfers ✓ · DCP 16/0 · DSP TCK 27/0 · EHDS 18 passed (2 failures = pre-existing Neo4j seed-data findings, EDC-independent) · Playwright live 587/0.

Runtime-only breaking changes the gate caught (none of these were in the release notes as config requirements):

1. NATS event publishing is mandatory on all four launchers (jad PR docs(planning): issue #26 inventory of existing quality/validation building blocks #108)
2. Dataplanes require the new siglet cert-exchange service (dsdk-facet-rs) + Vault transit key — wired into compose + bootstrap-jad.sh
3. Management API moved v5alpha → v5beta and now enforces OAuth — suites/seeds/UI parameterised via EDC_MGMT_API_VERSION
4. ADR-029 vindication: GHCR cfm-tmanager/pmanager :latest had been silently overwritten by the agent image since 2026-04-11; the managers only ever worked from stale local caches. Re-pinned to working digests.

Remaining: Phase C (OSS baseline bumps + Postgres migration runbook) and Phase D (Azure cutover — checklist in issue-97-phase-b-analysis.md: ACR mirror, mvhd-siglet app with postgres-vault backend, NATS env, controlplane DB snapshot, EDC_MGMT_API_VERSION=v5beta on mvhd-ui).