diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2f12772..edebead 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,3 +16,4 @@ jobs: uses: mxenabled/path-tools/.github/workflows/ci.yml@master with: force: ${{ inputs.force != '' && inputs.force }} + java-version: '17' diff --git a/.vogue.yml b/.vogue.yml deleted file mode 100644 index 9e59bf2..0000000 --- a/.vogue.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- -defaultRules: {} -packageRules: -- package: "com.github.mxenabled.vogue:com.github.mxenabled.vogue.gradle.plugin" - rules: {} - suppressUntil: "2026-03-02" diff --git a/build.gradle b/build.gradle index 14346f5..f0fd94f 100644 --- a/build.gradle +++ b/build.gradle @@ -1,43 +1,42 @@ plugins { - id "com.github.mxenabled.vogue" version "1.+" + id "com.github.mxenabled.vogue" version "3.+" id "groovy" id "java-gradle-plugin" - id "java-library" id "maven-publish" id "com.github.ben-manes.versions" version "0.53.0" } group "com.mx.coppuccino" version "6.0.2" // x-release-please-version -sourceCompatibility = JavaVersion.VERSION_17 -targetCompatibility = JavaVersion.VERSION_17 + +java { + toolchain { + languageVersion = JavaLanguageVersion.of(17) + } +} repositories { - gradlePluginPortal() + mavenCentral() mavenLocal() + gradlePluginPortal() + maven { url "https://jitpack.io" } } dependencies { implementation "ru.vyarus:gradle-quality-plugin:[6.0,7.0)" implementation "com.github.spotbugs:com.github.spotbugs.gradle.plugin:[6.4,7.0)" - //spotless-plugin-gradle 8.1.+ requires gradle 8+ + // spotless-plugin-gradle 8.1.+ requires gradle 8+ implementation "com.diffplug.spotless:spotless-plugin-gradle:7.0.2" implementation "org.kordamp.gradle:jacoco-gradle-plugin:0.54.0" implementation "io.gitlab.arturbosch.detekt:detekt-gradle-plugin:1.23.8" } -project.description = "Java style, standard, and safety enforcement" -project.group = "com.mx.coppuccino" -project.version = rootProject.version - -project.ext.name = "coppuccino" -project.ext.pluginId = "com.mx.coppuccino" -project.ext.url = "https://github.com/mxenabled/Coppuccino" +dependencyLocking { lockAllConfigurations() } gradlePlugin { plugins { coppuccinoPlugin { - id = project.pluginId + id = group implementationClass = "com.mx.coppuccino.CoppuccinoPlugin" } coppuccinoJitPackPlugin { diff --git a/gradle.lockfile b/gradle.lockfile new file mode 100644 index 0000000..2242ab2 --- /dev/null +++ b/gradle.lockfile @@ -0,0 +1,43 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +com.diffplug.durian:durian-collect:1.2.0=runtimeClasspath,testRuntimeClasspath +com.diffplug.durian:durian-core:1.2.0=runtimeClasspath,testRuntimeClasspath +com.diffplug.durian:durian-io:1.2.0=runtimeClasspath,testRuntimeClasspath +com.diffplug.durian:durian-swt.os:4.3.0=runtimeClasspath,testRuntimeClasspath +com.diffplug.spotless:spotless-lib-extra:3.0.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.diffplug.spotless:spotless-lib:3.0.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.diffplug.spotless:spotless-plugin-gradle:7.0.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.github.spotbugs.snom:spotbugs-gradle-plugin:6.4.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.github.spotbugs:com.github.spotbugs.gradle.plugin:6.4.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.googlecode.concurrent-trees:concurrent-trees:2.6.1=runtimeClasspath,testRuntimeClasspath +com.googlecode.javaewah:JavaEWAH:1.2.3=runtimeClasspath,testRuntimeClasspath +com.squareup.okhttp3:okhttp:4.12.0=runtimeClasspath,testRuntimeClasspath +com.squareup.okio:okio-jvm:3.6.0=runtimeClasspath,testRuntimeClasspath +com.squareup.okio:okio:3.6.0=runtimeClasspath,testRuntimeClasspath +commons-codec:commons-codec:1.17.0=runtimeClasspath,testRuntimeClasspath +dev.equo.ide:solstice:1.8.1=runtimeClasspath,testRuntimeClasspath +io.gitlab.arturbosch.detekt:detekt-gradle-plugin:1.23.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +javax.inject:javax.inject:1=runtimeClasspath,testRuntimeClasspath +org.apache.commons:commons-lang3:3.8.1=runtimeClasspath,testRuntimeClasspath +org.apache.maven:maven-artifact:3.8.8=runtimeClasspath,testRuntimeClasspath +org.apache.maven:maven-builder-support:3.8.8=runtimeClasspath,testRuntimeClasspath +org.apache.maven:maven-model-builder:3.8.8=runtimeClasspath,testRuntimeClasspath +org.apache.maven:maven-model:3.8.8=runtimeClasspath,testRuntimeClasspath +org.codehaus.plexus:plexus-interpolation:1.26=runtimeClasspath,testRuntimeClasspath +org.codehaus.plexus:plexus-utils:3.3.1=runtimeClasspath,testRuntimeClasspath +org.eclipse.jgit:org.eclipse.jgit:6.10.0.202406032230-r=runtimeClasspath,testRuntimeClasspath +org.eclipse.platform:org.eclipse.osgi:3.18.500=runtimeClasspath,testRuntimeClasspath +org.eclipse.sisu:org.eclipse.sisu.inject:0.3.5=runtimeClasspath,testRuntimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-common:2.0.21=runtimeClasspath,testRuntimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10=runtimeClasspath,testRuntimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10=runtimeClasspath,testRuntimeClasspath +org.jetbrains.kotlin:kotlin-stdlib:2.0.21=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.jetbrains:annotations:13.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.kordamp.gradle.base:org.kordamp.gradle.base.gradle.plugin:0.54.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.kordamp.gradle:base-gradle-plugin:0.54.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.kordamp.gradle:jacoco-gradle-plugin:0.54.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.slf4j:slf4j-api:1.7.36=runtimeClasspath,testRuntimeClasspath +org.tukaani:xz:1.9=runtimeClasspath,testRuntimeClasspath +ru.vyarus:gradle-quality-plugin:6.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +empty=annotationProcessor,testAnnotationProcessor diff --git a/settings.gradle b/settings.gradle index 1cb18b2..1c3d04a 100644 --- a/settings.gradle +++ b/settings.gradle @@ -1,6 +1,7 @@ pluginManagement { repositories { gradlePluginPortal() + mavenCentral() mavenLocal() maven { url "https://jitpack.io" } } diff --git a/src/main/groovy/com/mx/coppuccino/CoppuccinoPlugin.groovy b/src/main/groovy/com/mx/coppuccino/CoppuccinoPlugin.groovy index e32715c..98c46c6 100644 --- a/src/main/groovy/com/mx/coppuccino/CoppuccinoPlugin.groovy +++ b/src/main/groovy/com/mx/coppuccino/CoppuccinoPlugin.groovy @@ -249,6 +249,32 @@ class CoppuccinoPlugin implements Plugin { } } + // Security patches for plugin dependencies + configurations.matching { it.name == 'checkstyle' || it.name == 'spotbugs' || it.name == 'pmd' }.configureEach { config -> + project.dependencies.constraints.add(config.name, 'org.apache.commons:commons-lang3') { + version { require '3.18.0' } + because 'Fixes High Severity vulnerability SNYK-JAVA-ORGAPACHECOMMONS-10734078' + } + } + configurations.matching { it.name == 'spotbugs' }.configureEach { config -> + project.dependencies.constraints.add(config.name, 'org.apache.logging.log4j:log4j-core') { + version { require '2.25.3' } + because 'Fixes Medium Severity vulnerability SNYK-JAVA-ORGAPACHELOGGINGLOG4J-14532782' + } + } + if (kotlinEx.enabled) { + configurations.matching { it.name == 'detekt' }.configureEach { config -> + project.dependencies.constraints.add(config.name, 'org.jetbrains.kotlin:kotlin-stdlib') { + version { require '2.1.0' } + because 'Fixes Low Severity vulnerability SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744' + } + } + } + + // Provide @SuppressFBWarnings annotation for suppressing Spotbugs violations + project.dependencies.add('compileOnly', 'com.github.spotbugs:spotbugs-annotations:4.9.8') + project.dependencies.add('testCompileOnly', 'com.github.spotbugs:spotbugs-annotations:4.9.8') + project.tasks.spotlessGroovy.dependsOn(compileJava, compileTestGroovy) project.tasks.spotlessJava.dependsOn(compileJava, compileTestGroovy, spotlessGroovy) }