From d3cbe76793533ede9f35d35c56c73a7290aa2b59 Mon Sep 17 00:00:00 2001 From: Jonathan Austin Date: Tue, 15 Sep 2026 14:40:32 +1000 Subject: [PATCH 1/8] Update bordertech-parent pom.xml plugins --- CHANGELOG.md | 10 ++++++++++ pom.xml | 17 ++++++++++------- 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0909272..134c7d6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,16 @@ # Change log ## Release in-progress +* Update bordertech-parent pom.xml plugins: + * org.apache.maven.plugins:maven-jar-plugin from default to 3.5.1 + * org.apache.maven.plugins:maven-assembly-plugin from default to 3.8.0 + * org.apache.maven.plugins:maven-release-plugin from 2.5.3 to 3.3.1 + * org.apache.maven.plugins:maven-compiler-plugin from 3.10.1 to 3.16.0 + * org.apache.maven.plugins:maven-javadoc-plugin from 3.4.1 to 3.12.0 + * org.apache.maven.plugins:maven-enforcer-plugin from 3.5.0 to 3.6.3 + * org.codehaus.mojo:extra-enforcer-rules from 1.8.0 to 1.12.1 + * org.apache.maven.plugins:maven-source-plugin from 3.2.1 to 3.4.0 + * org.apache.maven.plugins:maven-gpg-plugin from 3.0.1 to 3.2.8 ## 1.0.21 * Update to latest plugin dependencies diff --git a/pom.xml b/pom.xml index ad7f2a7..2cd2b33 100755 --- a/pom.xml +++ b/pom.xml @@ -99,6 +99,7 @@ org.apache.maven.plugins maven-jar-plugin + 3.5.1 @@ -118,7 +119,9 @@ + org.apache.maven.plugins maven-assembly-plugin + 3.8.0 @@ -132,7 +135,7 @@ org.apache.maven.plugins maven-release-plugin - 2.5.3 + 3.3.1 true false @@ -150,14 +153,14 @@ org.apache.maven.plugins maven-compiler-plugin - 3.10.1 + 3.16.0 org.apache.maven.plugins maven-javadoc-plugin - 3.4.1 + 3.12.0 @@ -186,7 +189,7 @@ org.apache.maven.plugins maven-enforcer-plugin - 3.5.0 + 3.6.3 enforcer @@ -212,7 +215,7 @@ org.codehaus.mojo extra-enforcer-rules - 1.8.0 + 1.12.1 @@ -236,7 +239,7 @@ org.apache.maven.plugins maven-source-plugin - 3.2.1 + 3.4.0 @@ -268,7 +271,7 @@ org.apache.maven.plugins maven-gpg-plugin - 3.0.1 + 3.2.8 sign-artifacts From af2d47a26f45c6a9b1b686eaf303c19845e2820e Mon Sep 17 00:00:00 2001 From: Jonathan Austin Date: Tue, 15 Sep 2026 16:10:11 +1000 Subject: [PATCH 2/8] Update qa-parent pom.xml plugins --- CHANGELOG.md | 10 ++++++++++ qa-parent/pom.xml | 26 ++++++++++++++++---------- 2 files changed, 26 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 134c7d6..c0722ff 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,16 @@ * org.codehaus.mojo:extra-enforcer-rules from 1.8.0 to 1.12.1 * org.apache.maven.plugins:maven-source-plugin from 3.2.1 to 3.4.0 * org.apache.maven.plugins:maven-gpg-plugin from 3.0.1 to 3.2.8 +* Update qa-parent pom.xml plugins: + * org.junit from 5.11.0 to 5.14.4 + * org.jacoco:jacoco-maven-plugin from 0.8.12 to 0.8.15 + * org.apache.maven.plugins:maven-surefire-plugin from 3.5.0 to 3.6.0 + * org.apache.maven.plugins:maven-checkstyle-plugin from 3.5.0 to 3.6.0 + * org.apache.maven.plugins:maven-pmd-plugin from 3.25.0 to 3.28.0 + * net.sourceforge.pmd:pmd* from 7.5.0 to 7.27.0 + * com.github.spotbugs:spotbugs-maven-plugin from 4.8.6.3 to 4.8.6.8 + * org.codehaus.mojo:versions-maven-plugin from 2.17.1 to 2.22.0 + * org.apache.maven.plugins:maven-enforcer-plugin from 3.5.0 to 3.6.3 ## 1.0.21 * Update to latest plugin dependencies diff --git a/qa-parent/pom.xml b/qa-parent/pom.xml index c0e8209..56836b7 100644 --- a/qa-parent/pom.xml +++ b/qa-parent/pom.xml @@ -86,20 +86,26 @@ false - 5.11.0 - 0.8.12 - 3.5.0 - 3.5.0 + + 5.14.4 + 0.8.15 + 3.6.0 + 3.6.0 9.3 - 3.25.0 - 7.5.0 - 4.8.6.3 - 7.6.4 + + 3.28.0 + 7.27.0 + + + 4.8.6.8 4.8.6 + + 7.6.4 1.13.0 + 10.0.4 - 2.17.1 + 2.22.0 @@ -377,7 +383,7 @@ org.apache.maven.plugins maven-enforcer-plugin - 3.5.0 + 3.6.3 enforcer-convergence-check From 204c41fe5cfed93e18750446dd818dfa694f310c Mon Sep 17 00:00:00 2001 From: Jonathan Austin Date: Wed, 16 Sep 2026 16:21:27 +1000 Subject: [PATCH 3/8] Update pmd rules for latest version --- .../main/resources/bordertech/bt-pmd-rules.xml | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/build-tools/src/main/resources/bordertech/bt-pmd-rules.xml b/build-tools/src/main/resources/bordertech/bt-pmd-rules.xml index 00eaf54..fb95a4d 100644 --- a/build-tools/src/main/resources/bordertech/bt-pmd-rules.xml +++ b/build-tools/src/main/resources/bordertech/bt-pmd-rules.xml @@ -24,6 +24,15 @@ + + 3 + + + 3 + + + 3 + 3 @@ -42,19 +51,15 @@ 3 - - 3 - - + 3 3 - - + From 3637d8c8aa14556d7ff86ba468f72686077b72b4 Mon Sep 17 00:00:00 2001 From: Jonathan Austin Date: Wed, 16 Sep 2026 16:22:48 +1000 Subject: [PATCH 4/8] Move dependency-check-maven plugin into own profile check-dep as it requires JDK11 --- qa-parent/pom.xml | 80 ++++++++++++++++++++++++----------------------- 1 file changed, 41 insertions(+), 39 deletions(-) diff --git a/qa-parent/pom.xml b/qa-parent/pom.xml index 56836b7..1420c83 100644 --- a/qa-parent/pom.xml +++ b/qa-parent/pom.xml @@ -21,7 +21,6 @@ ${bt.qa.skip} ${bt.qa.skip} ${bt.qa.skip} - ${bt.qa.skip} ${bt.qa.skip} @@ -29,8 +28,6 @@ ${bt.qa.fail} ${bt.qa.fail} ${bt.qa.fail} - - ${bt.qa.fail} ${bt.qa.fail} @@ -69,22 +66,6 @@ true - - - 12 - - 9 - - - - - false - - false - - false - false - 5.14.4 @@ -103,8 +84,6 @@ 7.6.4 1.13.0 - - 10.0.4 2.22.0 @@ -130,14 +109,53 @@ true true true - - true true true + + + + + check-dep + + + 13.0.0 + + + 9 + + + + + false + + false + + false + false + + + + + org.owasp + dependency-check-maven + ${bt.owasp.plugin.version} + + + checkDependencies + verify + + check + + + + + + + @@ -363,22 +381,6 @@ - - - org.owasp - dependency-check-maven - ${bt.owasp.plugin.version} - - - checkDependencies - verify - - check - - - - - org.apache.maven.plugins From 6da3061f27b4bedb2bd07d3ba82ff7ca65444d94 Mon Sep 17 00:00:00 2001 From: Jonathan Austin Date: Wed, 16 Sep 2026 17:28:27 +1000 Subject: [PATCH 5/8] Include central-publishing-maven-plugin in release profile to publish to maven central --- pom.xml | 87 +++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 53 insertions(+), 34 deletions(-) diff --git a/pom.xml b/pom.xml index 2cd2b33..b084e4b 100755 --- a/pom.xml +++ b/pom.xml @@ -137,13 +137,18 @@ maven-release-plugin 3.3.1 + true - false forked-path + + false + release + true + @@ -156,35 +161,6 @@ 3.16.0 - - - org.apache.maven.plugins - maven-javadoc-plugin - 3.12.0 - - - - - - - UTF-8 - UTF-8 - UTF-8 - true - true - true - - - - - attach-javadocs - - jar - - - - - org.apache.maven.plugins @@ -232,10 +208,37 @@ - + + + + org.apache.maven.plugins + maven-javadoc-plugin + 3.12.0 + + + + + + + UTF-8 + UTF-8 + UTF-8 + true + true + true + + + + + attach-javadocs + + jar + + + + + + org.apache.maven.plugins maven-source-plugin @@ -268,6 +271,7 @@ + org.apache.maven.plugins maven-gpg-plugin @@ -282,6 +286,21 @@ + + + + + org.sonatype.central + central-publishing-maven-plugin + 0.11.0 + true + + central + + false + + + From 1b76d4d127183ee13cb524f5754dec2564bebf3a Mon Sep 17 00:00:00 2001 From: Jonathan Austin Date: Wed, 16 Sep 2026 17:44:26 +1000 Subject: [PATCH 6/8] Update CHANGELOG and README --- CHANGELOG.md | 3 +++ README.md | 14 +++++++------- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c0722ff..9f504f0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,6 +21,9 @@ * com.github.spotbugs:spotbugs-maven-plugin from 4.8.6.3 to 4.8.6.8 * org.codehaus.mojo:versions-maven-plugin from 2.17.1 to 2.22.0 * org.apache.maven.plugins:maven-enforcer-plugin from 3.5.0 to 3.6.3 +* Moved dependency-check-maven plugin into own profile check-dep as it requires JDK11 +* Included central-publishing-maven-plugin in release profile to publish to maven central +* Moved javadoc plugin into the release profile so only created when doing a release ## 1.0.21 * Update to latest plugin dependencies diff --git a/README.md b/README.md index 69446eb..d508ee2 100644 --- a/README.md +++ b/README.md @@ -116,6 +116,12 @@ The qa-parent provides a profile `display-versions` that uses the [Version check Refer to [Version checker plugin](https://www.mojohaus.org/versions-maven-plugin/) for all override details. +#### check-dep profile + +The qa-parent provides a profile `check-dep` that runs the OWASP plugin. This plugin has its own profile as it requires JDK11 and needs to be run seperately from projects built on JDK8. + +After building a project on JDK8 the JDK can be switched to JDK11 and then run `mvn verify -Pquick-build -Pcheck-dep` + ### build-tools This is primarily a shared resources module used by qa-parent and potentially other BorderTech maven modules. @@ -347,13 +353,7 @@ When adding a custom exclude filter and the module still needs to ignore generat Refer to [OWASP plugin](https://jeremylong.github.io/DependencyCheck/dependency-check-maven) for all override details. -##### Skip OWASP - -``` xml - - true - -``` +The OWASP plugin is only run in profile `check-dep` as it requires JDK11. ##### Ignore OWASP Rule From 342b77119a72eee66ea80d41559fde1f0e265140 Mon Sep 17 00:00:00 2001 From: Jonathan Austin Date: Wed, 16 Sep 2026 17:45:49 +1000 Subject: [PATCH 7/8] Roll CHANGELOG and README --- CHANGELOG.md | 2 ++ README.md | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9f504f0..c399aad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,8 @@ # Change log ## Release in-progress + +## 1.0.22 * Update bordertech-parent pom.xml plugins: * org.apache.maven.plugins:maven-jar-plugin from default to 3.5.1 * org.apache.maven.plugins:maven-assembly-plugin from default to 3.8.0 diff --git a/README.md b/README.md index d508ee2..1742f57 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ Projects should generally use qa-parent as their parent POM: com.github.bordertech.common qa-parent - 1.0.21 + 1.0.22 .... From b6f31c87e169dd39176a5e45a3744c23801dbf01 Mon Sep 17 00:00:00 2001 From: Jonathan Austin Date: Wed, 16 Sep 2026 17:53:29 +1000 Subject: [PATCH 8/8] Update github actions pipeline --- .github/workflows/github-actions-build.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/github-actions-build.yml b/.github/workflows/github-actions-build.yml index 96c1f27..3a81a27 100644 --- a/.github/workflows/github-actions-build.yml +++ b/.github/workflows/github-actions-build.yml @@ -18,14 +18,14 @@ jobs: distribution: 'adopt' - name: Cache Maven Repo - uses: actions/cache@v2 + uses: actions/cache@v4 with: path: ~/.m2 key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} restore-keys: ${{ runner.os }}-m2 - name: Build Test and Verify - run: mvn -B -U clean install -Dmaven.javadoc.skip=true -Pdisplay-versions + run: mvn -B -U clean install - name: Set up JDK 17 uses: actions/setup-java@v2 @@ -39,7 +39,7 @@ jobs: echo "Sonar secure variables NOT available" else echo "Sonar secure variables ARE available" - mvn -B sonar:sonar -Dsonar.projectKey="bordertech-java-common" -Dsonar.organization="bordertech-github" -Dsonar.host.url="https://sonarcloud.io" + mvn -B org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey="bordertech-java-common" -Dsonar.organization="bordertech-github" -Dsonar.host.url="https://sonarcloud.io" -Dsonar.qualitygate.wait=true fi env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}