From f98c38bad688caf6077dccd8a00b5241f1d702ad Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Dec 2024 08:08:53 +0100 Subject: [PATCH 01/13] chore(ci): bump org.apache.maven:maven-api-meta (#902) Bumps org.apache.maven:maven-api-meta from 4.0.0-beta-5 to 4.0.0-rc-1. --- updated-dependencies: - dependency-name: org.apache.maven:maven-api-meta dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 6f3e9c9e..dbca67ce 100644 --- a/pom.xml +++ b/pom.xml @@ -142,7 +142,7 @@ org.apache.maven maven-api-meta - 4.0.0-beta-5 + 4.0.0-rc-1 provided From 7b43e0f07c03f04e3d8bbf830220a682016c88d3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Dec 2024 08:09:06 +0100 Subject: [PATCH 02/13] chore(ci): bump org.apache.maven:maven-api-xml (#903) Bumps org.apache.maven:maven-api-xml from 4.0.0-beta-5 to 4.0.0-rc-1. --- updated-dependencies: - dependency-name: org.apache.maven:maven-api-xml dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index dbca67ce..e3479b60 100644 --- a/pom.xml +++ b/pom.xml @@ -148,7 +148,7 @@ org.apache.maven maven-api-xml - 4.0.0-beta-5 + 4.0.0-rc-1 provided From 3a2a8031b9bb0db9ae2ac76f418b068ddab6a850 Mon Sep 17 00:00:00 2001 From: Tim te Beek Date: Tue, 3 Dec 2024 19:35:06 +0100 Subject: [PATCH 03/13] Update ConfigurableRewriteMojo.java to parse .lock files as plaintext --- src/main/java/org/openrewrite/maven/ConfigurableRewriteMojo.java | 1 + 1 file changed, 1 insertion(+) diff --git a/src/main/java/org/openrewrite/maven/ConfigurableRewriteMojo.java b/src/main/java/org/openrewrite/maven/ConfigurableRewriteMojo.java index c9af3381..32cda2aa 100644 --- a/src/main/java/org/openrewrite/maven/ConfigurableRewriteMojo.java +++ b/src/main/java/org/openrewrite/maven/ConfigurableRewriteMojo.java @@ -142,6 +142,7 @@ protected Set getPlainTextMasks() { "**/*.jelly", "**/*.jsp", "**/*.ksh", + "**/*.lock", "**/lombok.config", "**/*.md", "**/*.mf", From cc727021547f347278cff7de941f4f6c9939d406 Mon Sep 17 00:00:00 2001 From: Tim te Beek Date: Fri, 6 Dec 2024 16:29:59 +0100 Subject: [PATCH 04/13] Update pom.xml to target 5.46.2 next --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index e3479b60..af9e95e9 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.openrewrite.maven rewrite-maven-plugin - 5.47.0-SNAPSHOT + 5.46.2-SNAPSHOT maven-plugin rewrite-maven-plugin From ceefa39e0713f9915dfa8c408de1d8b257a7863e Mon Sep 17 00:00:00 2001 From: "team-moderne[bot]" Date: Fri, 6 Dec 2024 15:30:33 +0000 Subject: [PATCH 05/13] Bump rewrite.version properties --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index af9e95e9..d77a310c 100644 --- a/pom.xml +++ b/pom.xml @@ -62,8 +62,8 @@ - 8.42.0-SNAPSHOT - 1.24.0-SNAPSHOT + 8.41.2 + 1.23.1 scm:git:ssh://git@github.com/openrewrite/rewrite-maven-plugin.git From 15681db60f27afd13a0fc6181569d94baeffe3a2 Mon Sep 17 00:00:00 2001 From: "team-moderne[bot]" Date: Fri, 6 Dec 2024 15:31:00 +0000 Subject: [PATCH 06/13] [maven-release-plugin] prepare release v5.46.2 --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index d77a310c..557a5181 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.openrewrite.maven rewrite-maven-plugin - 5.46.2-SNAPSHOT + 5.46.2 maven-plugin rewrite-maven-plugin @@ -41,7 +41,7 @@ scm:git:https://github.com/openrewrite/rewrite-maven-plugin.git ${developerConnectionUrl} https://github.com/openrewrite/rewrite-maven-plugin/tree/main - HEAD + v5.46.2 From 8ff61d6ab7de203890b0e1e37a9b037e4ef98368 Mon Sep 17 00:00:00 2001 From: "team-moderne[bot]" Date: Fri, 6 Dec 2024 15:31:01 +0000 Subject: [PATCH 07/13] [maven-release-plugin] prepare for next development iteration --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 557a5181..66b340c9 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.openrewrite.maven rewrite-maven-plugin - 5.46.2 + 5.47.0-SNAPSHOT maven-plugin rewrite-maven-plugin @@ -41,7 +41,7 @@ scm:git:https://github.com/openrewrite/rewrite-maven-plugin.git ${developerConnectionUrl} https://github.com/openrewrite/rewrite-maven-plugin/tree/main - v5.46.2 + HEAD From 127c1d2e124c8dfc3b92616374b177fa9b84d050 Mon Sep 17 00:00:00 2001 From: "team-moderne[bot]" Date: Fri, 6 Dec 2024 15:32:43 +0000 Subject: [PATCH 08/13] Bump rewrite.version properties --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 66b340c9..e3479b60 100644 --- a/pom.xml +++ b/pom.xml @@ -62,8 +62,8 @@ - 8.41.2 - 1.23.1 + 8.42.0-SNAPSHOT + 1.24.0-SNAPSHOT scm:git:ssh://git@github.com/openrewrite/rewrite-maven-plugin.git From ab0ed4b0a21fbc689b76966bf8a9daa5468ccc45 Mon Sep 17 00:00:00 2001 From: Philippe GRANET Date: Sat, 7 Dec 2024 22:54:46 +0100 Subject: [PATCH 09/13] Ignore generated pom by maven-shade-plugin and ci-friendly-flatten-maven-plugin (#908) * Ignore generated pom by maven-shade-plugin and ci-friendly-flatten-maven-plugin * Collapse handling into a single `if` --------- Co-authored-by: Tim te Beek --- .../org/openrewrite/maven/MavenMojoProjectParser.java | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/main/java/org/openrewrite/maven/MavenMojoProjectParser.java b/src/main/java/org/openrewrite/maven/MavenMojoProjectParser.java index 068de35f..20e5eead 100644 --- a/src/main/java/org/openrewrite/maven/MavenMojoProjectParser.java +++ b/src/main/java/org/openrewrite/maven/MavenMojoProjectParser.java @@ -646,12 +646,10 @@ private void collectPoms(MavenProject project, Set paths, MavenExecutionCo private static Path pomPath(MavenProject mavenProject) { Path pomPath = mavenProject.getFile().toPath(); - // org.codehaus.mojo:flatten-maven-plugin produces a synthetic pom unsuitable for our purposes, use the regular pom instead - if (pomPath.endsWith(".flattened-pom.xml")) { - return mavenProject.getBasedir().toPath().resolve("pom.xml"); - } - // org.eclipse.tycho:tycho-packaging-plugin:update-consumer-pom produces a synthetic pom - if (pomPath.endsWith(".tycho-consumer-pom.xml")) { + if (pomPath.endsWith(".flattened-pom.xml") ||// org.codehaus.mojo:flatten-maven-plugin + pomPath.endsWith("dependency-reduced-pom.xml") || // org.apache.maven.plugins:maven-shade-plugin + pomPath.endsWith(".ci-friendly-pom.xml") || // com.outbrain.swinfra:ci-friendly-flatten-maven-plugin + pomPath.endsWith(".tycho-consumer-pom.xml")) { // org.eclipse.tycho:tycho-packaging-plugin:update-consumer-pom Path normalPom = mavenProject.getBasedir().toPath().resolve("pom.xml"); // check for the existence of the POM, since Tycho can work pom-less if (Files.isReadable(normalPom) && Files.isRegularFile(normalPom)) { From 0461e146f931f6d8878dfe2f0528989ff7a438fd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 9 Dec 2024 08:18:50 +0100 Subject: [PATCH 10/13] chore(ci): bump org.apache.maven.plugins:maven-javadoc-plugin (#910) Bumps [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) from 3.11.1 to 3.11.2. - [Release notes](https://github.com/apache/maven-javadoc-plugin/releases) - [Commits](https://github.com/apache/maven-javadoc-plugin/compare/maven-javadoc-plugin-3.11.1...maven-javadoc-plugin-3.11.2) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-javadoc-plugin dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index e3479b60..5b87898a 100644 --- a/pom.xml +++ b/pom.xml @@ -449,7 +449,7 @@ org.apache.maven.plugins maven-javadoc-plugin - 3.11.1 + 3.11.2 prepare-package From ae7fc301feff2a31be95f5a660b328a3b536f061 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 9 Dec 2024 08:19:49 +0100 Subject: [PATCH 11/13] chore(ci): bump org.owasp:dependency-check-maven from 11.1.0 to 11.1.1 (#911) Bumps [org.owasp:dependency-check-maven](https://github.com/jeremylong/DependencyCheck) from 11.1.0 to 11.1.1. - [Release notes](https://github.com/jeremylong/DependencyCheck/releases) - [Changelog](https://github.com/jeremylong/DependencyCheck/blob/main/CHANGELOG.md) - [Commits](https://github.com/jeremylong/DependencyCheck/compare/v11.1.0...v11.1.1) --- updated-dependencies: - dependency-name: org.owasp:dependency-check-maven dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 5b87898a..376ea0f6 100644 --- a/pom.xml +++ b/pom.xml @@ -538,7 +538,7 @@ org.owasp dependency-check-maven - 11.1.0 + 11.1.1 ${env.NVD_API_KEY} 9 From 3bdfd97d7898a48d4bc2148616ba38a352617f0a Mon Sep 17 00:00:00 2001 From: Kyle Scully Date: Wed, 11 Dec 2024 10:47:13 -0800 Subject: [PATCH 12/13] refactor: Remove expired suppressions (#906) Use this link to re-run the recipe: https://app.moderne.io/recipes/org.openrewrite.java.dependencies.RemoveExpiredSuppressions?organizationId=T3BlblJld3JpdGU%3D Co-authored-by: Moderne --- suppressions.xml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/suppressions.xml b/suppressions.xml index c6d18814..4d1ba437 100644 --- a/suppressions.xml +++ b/suppressions.xml @@ -43,13 +43,6 @@ CVE-2023-2976 CVE-2020-8908 - - - ^pkg:maven/org\.xerial\.snappy/snappy\-java@.*$ - CVE-2023-43642 - Date: Wed, 11 Dec 2024 19:53:21 +0100 Subject: [PATCH 13/13] Drop Jackson Kotlin module and dependency management for now (#907) --- pom.xml | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/pom.xml b/pom.xml index 376ea0f6..eac60de9 100644 --- a/pom.xml +++ b/pom.xml @@ -117,13 +117,6 @@ import pom - - org.jetbrains.kotlin - kotlin-bom - ${kotlin.version} - import - pom - io.rsocket rsocket-bom @@ -223,10 +216,6 @@ plexus-xml 4.0.4 - - com.fasterxml.jackson.module - jackson-module-kotlin - io.micrometer.prometheus prometheus-rsocket-client