Bump org.apache.maven.plugins:maven-compiler-plugin from 3.8.1 to 3.16.0 - #28
Open
dependabot[bot] wants to merge 39 commits into
Open
dependabot[bot] wants to merge 39 commits into
dependabot[bot] wants to merge 39 commits into
Conversation
Replace nexus-staging-maven-plugin with central-publishing-maven-plugin and drop the OSSRH distributionManagement snapshot repo, matching the migration already done in gephi-toolkit and graphstore. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
gson < 2.8.9 has a deserialization-of-untrusted-data vulnerability; the legacy org.apache.velocity:velocity artifact is unmaintained and never received a fix for CVE-2020-13936, so switch to its successor velocity-engine-core, which is API-compatible. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- generate: auto-create the Java package folder (derived from org/artifact ids) under src/main/java and src/test/java so generated classes are never left in the default package. - Move authorEmail/authorUrl/sourceCodeUrl out of the nbm-maven-plugin's configuration (where they aren't real parameters, causing IDE validation warnings) into this plugin's own configuration block, with a fallback to the legacy location for backward compatibility. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Author info and other free-text fields (e.g. author name containing angle brackets or quotes) could break the XML generated by the migrate goal. Escape all Velocity context values before writing them into top-plugin-pom.xml.
The generate/migrate goals only threw "Can't obtain gephi version number" with no context, which confused users who ran the goals from gephi-maven-plugin's own checkout instead of a gephi-plugins one. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
javadoc's doclint doesn't recognize ' as a valid HTML4 entity, which broke the build (introduced in 04311c9). Use ' instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Configures weekly dependency update PRs so outdated dependencies (like the ones fixed manually in 2ab840d) and deprecated Actions versions get flagged automatically. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v2...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) from 3.3.1 to 3.12.0. - [Release notes](https://github.com/apache/maven-javadoc-plugin/releases) - [Commits](apache/maven-javadoc-plugin@maven-javadoc-plugin-3.3.1...maven-javadoc-plugin-3.12.0) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-javadoc-plugin dependency-version: 3.12.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.maven.plugins:maven-gpg-plugin](https://github.com/apache/maven-gpg-plugin) from 3.0.1 to 3.2.8. - [Release notes](https://github.com/apache/maven-gpg-plugin/releases) - [Commits](apache/maven-gpg-plugin@maven-gpg-plugin-3.0.1...maven-gpg-plugin-3.2.8) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-gpg-plugin dependency-version: 3.2.8 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 2 to 6. - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v2...v6) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin) from 3.2.1 to 3.4.0. - [Release notes](https://github.com/apache/maven-source-plugin/releases) - [Commits](apache/maven-source-plugin@maven-source-plugin-3.2.1...maven-source-plugin-3.4.0) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-source-plugin dependency-version: 3.4.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.codehaus.mojo:animal-sniffer-maven-plugin](https://github.com/mojohaus/animal-sniffer) from 1.18 to 1.27. - [Release notes](https://github.com/mojohaus/animal-sniffer/releases) - [Commits](mojohaus/animal-sniffer@animal-sniffer-parent-1.18...animal-sniffer-1.27) --- updated-dependencies: - dependency-name: org.codehaus.mojo:animal-sniffer-maven-plugin dependency-version: '1.27' dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [net.coobird:thumbnailator](https://github.com/coobird/thumbnailator) from 0.4.16 to 0.4.21. - [Commits](coobird/thumbnailator@0.4.16...0.4.21) --- updated-dependencies: - dependency-name: net.coobird:thumbnailator dependency-version: 0.4.21 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.netbeans.utilities:nbm-maven-plugin](https://github.com/apache/netbeans-mavenutils-nbm-maven-plugin) from 4.6 to 14.5. - [Commits](apache/netbeans-mavenutils-nbm-maven-plugin@nbm-maven-plugin-4.6...utilities-parent-14.5) --- updated-dependencies: - dependency-name: org.apache.netbeans.utilities:nbm-maven-plugin dependency-version: '14.5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…heckout-7 Bump actions/checkout from 2 to 7
…ailator-0.4.21 Bump net.coobird:thumbnailator from 0.4.16 to 0.4.21
…lugins-maven-source-plugin-3.4.0 Bump org.apache.maven.plugins:maven-source-plugin from 3.2.1 to 3.4.0
…lugins-maven-javadoc-plugin-3.12.0 Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.3.1 to 3.12.0
…lugins-maven-gpg-plugin-3.2.8 Bump org.apache.maven.plugins:maven-gpg-plugin from 3.0.1 to 3.2.8
…etup-java-6 Bump actions/setup-java from 2 to 6
…animal-sniffer-maven-plugin-1.27 Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.18 to 1.27
…s.utilities-nbm-maven-plugin-14.5 Bump org.apache.netbeans.utilities:nbm-maven-plugin from 4.6 to 14.5
Needed for mojos that require access to Maven core APIs beyond the plugin API. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
attach-javadocs was emitting 56 "no comment" warnings for internal utility classes/DTOs that aren't meant to be fully documented public API. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
maven-plugin-api and maven-core are supplied by the host Maven runtime, not bundled with the plugin. Declaring them compile-scoped triggered descriptor validation warnings for their transitive artifacts. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
maven-core/maven-compat before 3.8.1 follow http repository references defined in a dependency's POM by default, allowing a malicious repo takeover to inject artifacts (GHSA-2f88-5hg8-9x2x). Bumping the shared maven.required property (also used for maven-plugin-api and the plugin's <prerequisites>) resolves the Dependabot alert. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The gephi-plugins root pom always sets this to the same URL, so default it here to avoid IDEs flagging it as a missing required parameter when only sourceCodeUrl is configured in a child module. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This reverts commit 5164f77.
This reverts commit ff24360.
Every newly generated plugin now pulls in gephi-plugins-tests as a test-scope dependency, so generic SPI-contract tests (e.g. LayoutIT) run automatically against whatever the plugin registers, no opt-in required. Since gephi-plugins-tests ships its "*IT" contract tests as regular compiled classes in its jar (not a test-jar), unpack them into test-classes via maven-dependency-plugin, and widen Surefire's include patterns to also pick up "*IT.java"-named classes alongside the default "*Test" pattern. Also fix the snapshot repository pointing at the defunct oss.sonatype.org to use the Central Portal snapshots repo, needed since gephi-plugins-tests is currently only released as a SNAPSHOT. Verified end to end against a locally generated fixture plugin depending on layout-plugin: LayoutIT discovers and exercises all 13 built-in layouts (78 sub-tests) through Lookup, no NetBeans runtime required.
Adds checks grounded in real gephi-plugins PR issues (open PR survey + merged-PR maintainer fixup history): missing README, missing license file, missing screenshots, invalid author email, duplicate groupId/artifactId or branding name across plugins in the same reactor, non-conventional folder naming, overly long short description, and a pre-check for manifest lines exceeding the JAR manifest format's line-length limit (empirically verified against java.util.jar.Manifest on JDK 17). Hard failures are limited to cases with no risk of newly breaking any already-merged plugin (config typos, cross-plugin identity collisions, and a limit that already causes a build failure today, just with a clearer message). Everything else is a warning. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
When a plugin's 'licenseName' is set but no matching license file is found (at the configured 'licenseFile' path, or the 'LICENSE.txt' default if unconfigured), the validate goal now downloads the matching text from SPDX's license-list-data for common licenses (Apache-2.0, MIT, BSD-3-Clause, GPL/LGPL v2-v3, MPL-2.0, EPL-2.0, Unlicense, CC0), instead of failing or silently doing nothing. Only an explicit 'licenseFile' pointing at a missing, unrecognized license still fails the build; anything else is a warning. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Bumps [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) from 3.8.1 to 3.16.0. - [Release notes](https://github.com/apache/maven-compiler-plugin/releases) - [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.8.1...maven-compiler-plugin-3.16.0) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-compiler-plugin dependency-version: 3.16.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps org.apache.maven.plugins:maven-compiler-plugin from 3.8.1 to 3.16.0.
Release notes
Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.
... (truncated)
Commits
e7bba6e[maven-release-plugin] prepare release maven-compiler-plugin-3.16.0c906809Avoid using deprecated method CompilerConfiguration.setCompilerVersionad74feeReplace adopt-openj9 by semeru JDK distribution on GHbeb0edaRecompile when dependencies change (#1102)a0b689e[MCOMPILER-578] Track outputs across compiler executions (#1091)2e81228Fix incremental detection of empty sources, 3.x (#1075)2132f5bconfigure ATR project5992b77Build fails when annotation processor list is empty (but present) (#1077)acccef7Bump plexusCompilerVersion from 2.16.2 to 2.17.072bc445Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)