fix: include security patches for plugin dependencies

.github/workflows/ci.yml

@@ -16,3 +16,4 @@ jobs:
     uses: mxenabled/path-tools/.github/workflows/ci.yml@master
     with:
       force: ${{ inputs.force != '' && inputs.force }}
+      java-version: '17'

build.gradle

@@ -1,43 +1,42 @@
 plugins {
-  id "com.github.mxenabled.vogue" version "1.+"
+  id "com.github.mxenabled.vogue" version "3.+"
   id "groovy"
   id "java-gradle-plugin"
-  id "java-library"
   id "maven-publish"
   id "com.github.ben-manes.versions" version "0.53.0"
 }
 
 group "com.mx.coppuccino"
 version "6.0.2" // x-release-please-version
-sourceCompatibility = JavaVersion.VERSION_17
-targetCompatibility = JavaVersion.VERSION_17
+
+java {
+  toolchain {
+    languageVersion = JavaLanguageVersion.of(17)
+  }
+}
 
 repositories {
-  gradlePluginPortal()
+  mavenCentral()
   mavenLocal()
+  gradlePluginPortal()
+  maven { url "https://jitpack.io" }
 }
 
 dependencies {
   implementation "ru.vyarus:gradle-quality-plugin:[6.0,7.0)"
   implementation "com.github.spotbugs:com.github.spotbugs.gradle.plugin:[6.4,7.0)"
-  //spotless-plugin-gradle 8.1.+ requires gradle 8+
+  // spotless-plugin-gradle 8.1.+ requires gradle 8+
   implementation "com.diffplug.spotless:spotless-plugin-gradle:7.0.2"
   implementation "org.kordamp.gradle:jacoco-gradle-plugin:0.54.0"
   implementation "io.gitlab.arturbosch.detekt:detekt-gradle-plugin:1.23.8"
 }
 
-project.description     = "Java style, standard, and safety enforcement"
-project.group           = "com.mx.coppuccino"
-project.version         = rootProject.version
-
-project.ext.name        = "coppuccino"
-project.ext.pluginId    = "com.mx.coppuccino"
-project.ext.url         = "https://github.com/mxenabled/Coppuccino"
+dependencyLocking { lockAllConfigurations() }
 
 gradlePlugin {
   plugins {
     coppuccinoPlugin {
-      id = project.pluginId
+      id = group
       implementationClass = "com.mx.coppuccino.CoppuccinoPlugin"
     }
     coppuccinoJitPackPlugin {

gradle.lockfile

@@ -0,0 +1,43 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.diffplug.durian:durian-collect:1.2.0=runtimeClasspath,testRuntimeClasspath
+com.diffplug.durian:durian-core:1.2.0=runtimeClasspath,testRuntimeClasspath
+com.diffplug.durian:durian-io:1.2.0=runtimeClasspath,testRuntimeClasspath
+com.diffplug.durian:durian-swt.os:4.3.0=runtimeClasspath,testRuntimeClasspath
+com.diffplug.spotless:spotless-lib-extra:3.0.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.diffplug.spotless:spotless-lib:3.0.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.diffplug.spotless:spotless-plugin-gradle:7.0.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.spotbugs.snom:spotbugs-gradle-plugin:6.4.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.github.spotbugs:com.github.spotbugs.gradle.plugin:6.4.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.googlecode.concurrent-trees:concurrent-trees:2.6.1=runtimeClasspath,testRuntimeClasspath
+com.googlecode.javaewah:JavaEWAH:1.2.3=runtimeClasspath,testRuntimeClasspath
+com.squareup.okhttp3:okhttp:4.12.0=runtimeClasspath,testRuntimeClasspath
+com.squareup.okio:okio-jvm:3.6.0=runtimeClasspath,testRuntimeClasspath
+com.squareup.okio:okio:3.6.0=runtimeClasspath,testRuntimeClasspath
+commons-codec:commons-codec:1.17.0=runtimeClasspath,testRuntimeClasspath
+dev.equo.ide:solstice:1.8.1=runtimeClasspath,testRuntimeClasspath
+io.gitlab.arturbosch.detekt:detekt-gradle-plugin:1.23.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+javax.inject:javax.inject:1=runtimeClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.8.1=runtimeClasspath,testRuntimeClasspath
+org.apache.maven:maven-artifact:3.8.8=runtimeClasspath,testRuntimeClasspath
+org.apache.maven:maven-builder-support:3.8.8=runtimeClasspath,testRuntimeClasspath
+org.apache.maven:maven-model-builder:3.8.8=runtimeClasspath,testRuntimeClasspath
+org.apache.maven:maven-model:3.8.8=runtimeClasspath,testRuntimeClasspath
+org.codehaus.plexus:plexus-interpolation:1.26=runtimeClasspath,testRuntimeClasspath
+org.codehaus.plexus:plexus-utils:3.3.1=runtimeClasspath,testRuntimeClasspath
+org.eclipse.jgit:org.eclipse.jgit:6.10.0.202406032230-r=runtimeClasspath,testRuntimeClasspath
+org.eclipse.platform:org.eclipse.osgi:3.18.500=runtimeClasspath,testRuntimeClasspath
+org.eclipse.sisu:org.eclipse.sisu.inject:0.3.5=runtimeClasspath,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-stdlib-common:2.0.21=runtimeClasspath,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10=runtimeClasspath,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10=runtimeClasspath,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-stdlib:2.0.21=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jetbrains:annotations:13.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.kordamp.gradle.base:org.kordamp.gradle.base.gradle.plugin:0.54.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.kordamp.gradle:base-gradle-plugin:0.54.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.kordamp.gradle:jacoco-gradle-plugin:0.54.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.slf4j:slf4j-api:1.7.36=runtimeClasspath,testRuntimeClasspath
+org.tukaani:xz:1.9=runtimeClasspath,testRuntimeClasspath
+ru.vyarus:gradle-quality-plugin:6.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+empty=annotationProcessor,testAnnotationProcessor

settings.gradle

@@ -1,6 +1,7 @@
 pluginManagement {
   repositories {
     gradlePluginPortal()
+    mavenCentral()
     mavenLocal()
     maven { url "https://jitpack.io" }
   }

src/main/groovy/com/mx/coppuccino/CoppuccinoPlugin.groovy

@@ -249,6 +249,32 @@ class CoppuccinoPlugin implements Plugin<Project> {
             }
           }
 
+          // Security patches for plugin dependencies
+          configurations.matching { it.name == 'checkstyle' || it.name == 'spotbugs' || it.name == 'pmd' }.configureEach { config ->
+            project.dependencies.constraints.add(config.name, 'org.apache.commons:commons-lang3') {
+              version { require '3.18.0' }
+              because 'Fixes High Severity vulnerability SNYK-JAVA-ORGAPACHECOMMONS-10734078'
+            }
+          }
+          configurations.matching { it.name == 'spotbugs' }.configureEach { config ->
+            project.dependencies.constraints.add(config.name, 'org.apache.logging.log4j:log4j-core') {
+              version { require '2.25.3' }
+              because 'Fixes Medium Severity vulnerability SNYK-JAVA-ORGAPACHELOGGINGLOG4J-14532782'
+            }
+          }
+          if (kotlinEx.enabled) {
+            configurations.matching { it.name == 'detekt' }.configureEach { config ->
+              project.dependencies.constraints.add(config.name, 'org.jetbrains.kotlin:kotlin-stdlib') {
+                version { require '2.1.0' }
+                because 'Fixes Low Severity vulnerability SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744'
+              }
+            }
+          }
+
+          // Provide @SuppressFBWarnings annotation for suppressing Spotbugs violations
+          project.dependencies.add('compileOnly', 'com.github.spotbugs:spotbugs-annotations:4.9.8')
+          project.dependencies.add('testCompileOnly', 'com.github.spotbugs:spotbugs-annotations:4.9.8')
+
           project.tasks.spotlessGroovy.dependsOn(compileJava, compileTestGroovy)
           project.tasks.spotlessJava.dependsOn(compileJava, compileTestGroovy, spotlessGroovy)
         }