build: update plugins and dependencies

Release-As: 6.0.2

Author: stevecl5

.vogue.yml

@@ -1,7 +1,7 @@
 plugins {
+  id "com.github.mxenabled.coppuccino" version "6.+" apply false
+  id "com.github.mxenabled.vogue" version "3.+"
   id "idea"
-  id "com.github.mxenabled.coppuccino" version "5.+" apply false
-  id "com.github.mxenabled.vogue" version "2.+"
   id "io.freefair.lombok" version "8.+" apply false
   id "io.github.gradle-nexus.publish-plugin" version "1.1.+"
 }
@@ -29,92 +29,81 @@ allprojects {
   group "com.mx.path-core"
   description "MX Path Core"
   version rootProject.version
-  sourceCompatibility = JavaVersion.VERSION_17
-  targetCompatibility = JavaVersion.VERSION_17
+
+  java {
+    toolchain {
+      languageVersion = JavaLanguageVersion.of(17)
+    }
+  }
 
   repositories {
     mavenCentral()
     mavenLocal()
   }
-
-  configurations.configureEach {
-    resolutionStrategy.eachDependency { details ->
-      //Uncontrolled Recursion [High Severity][https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHECOMMONS-10734078] in org.apache.commons:commons-lang3@3.17.0
-      //    introduced by net.sourceforge.pmd:pmd-java@7.16.0 > org.apache.commons:commons-lang3@3.17.0 and 7 other path(s)
-      //  This issue was fixed in versions: 3.18.0
-      if (details.requested.group == "org.apache.commons" && details.requested.name == "commons-lang3") {
-        details.useVersion "3.18.0"
-      }
-      //Improper Validation of Certificate with Host Mismatch [Medium Severity][https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-14532782] in org.apache.logging.log4j:log4j-core@2.25.2
-      //    introduced by com.github.spotbugs:spotbugs@4.9.8 > org.apache.logging.log4j:log4j-core@2.25.2
-      //  This issue was fixed in versions: 2.25.3
-      else if (details.requested.group == "org.apache.logging.log4j" && details.requested.name == "log4j-core") {
-        details.useVersion "2.25.3"
-      }
-    }
-    resolutionStrategy.cacheChangingModulesFor 0, "seconds"
-  }
 }
 
 subprojects {
   if (it.name != platformProject) {
-    apply plugin: "java-library"
-    apply plugin: "groovy"
     apply plugin: "com.github.mxenabled.coppuccino"
     apply plugin: "com.github.mxenabled.vogue"
+    apply plugin: "groovy"
+    apply plugin: "java-library"
     apply plugin: "io.freefair.lombok"
 
+    java {
+      withSourcesJar()
+      withJavadocJar()
+    }
+
+    coppuccino {
+      rootDir = "${projectDir}/"
+    }
+
+    vogue {
+      dependencyUpdatesOutputDir = "${projectDir}/build/dependencyUpdates"
+    }
+
     ext {
       mockitoVersion = "[5.0,6.0)"
       spockVersion = "2.4-M6-groovy-3.0"
       junitVersion = "5.14.0"
+      openTracingVersion = "[0.33,0.34)"
+      slf4jVersion = "1.7.30"
     }
 
     dependencies {
       constraints {
-        api("com.google.code.gson:gson") {
-          version {
-            require "[2.13.0,13.0.0)"
-          }
-        }
-        api("io.opentracing:opentracing-api") {
-          version {
-            require "[0.33,0.34)"
-          }
-        }
-        api("io.opentracing:opentracing-noop") {
-          version {
-            require "[0.33,0.34)"
-          }
-        }
-        api("io.opentracing:opentracing-util") {
-          version {
-            require "[0.33,0.34)"
-          }
-        }
-        api("com.google.guava:guava") {
-          version {
-              require "[32.0,33.0)"
-          }
-        }
-        api("com.github.rholder:guava-retrying") {
-          version {
-            require "[2.0,3.0)"
-          }
-        }
+        // --- Shared Libraries ---
+        api "com.google.code.gson:gson:[2.13.0,3.0.0)"
+        api "io.opentracing:opentracing-api:${project.ext.openTracingVersion}"
+        api "io.opentracing:opentracing-noop:${project.ext.openTracingVersion}"
+        api "io.opentracing:opentracing-util:${project.ext.openTracingVersion}"
+        api "com.google.guava:guava:[32.0,33.0)"
+        api "com.github.rholder:guava-retrying:[2.0,3.0)"
+
         api "com.datadoghq:dd-trace-api:1.38.0"
-        api "org.slf4j:slf4j-api:1.7.30"
-        api "org.apache.httpcomponents:httpclient:4.5.13"
+        api "org.apache.httpcomponents:httpclient:4.5.14"
+        api "org.slf4j:slf4j-api:${project.ext.slf4jVersion}"
 
         // -----------------------------------------------------------------
         // These re-add JAXB classes needed for SOAP interaction.
         // Version changes to any of these need to be tested (not just built)
-        //   with an apps that use SOAP.
+        //   with an app that uses SOAP.
         // -----------------------------------------------------------------
         api "jakarta.xml.bind:jakarta.xml.bind-api:4.0.4!!"
         api "jakarta.xml.soap:jakarta.xml.soap-api:3.0.2!!"
         api "com.sun.xml.bind:jaxb-impl:4.0.6!!"
         api "org.glassfish.jaxb:jaxb-runtime:4.0.6!!"
+
+        // --- Shared Testing Libraries ---
+        api "io.opentracing:opentracing-mock:${project.ext.openTracingVersion}"
+        api "org.slf4j:slf4j-simple:${project.ext.slf4jVersion}"
+
+        // --- Security Overrides ---
+        // Pulled in by org.apache.httpcomponents:httpclient:4.5.14
+        api("commons-codec:commons-codec:1.14") {
+          because "Fixes Low Severity vulnerability SNYK-JAVA-COMMONSCODEC-561518"
+        }
       }
 
       testImplementation "org.mockito:mockito-inline:${project.ext.mockitoVersion}"
@@ -134,40 +123,14 @@ subprojects {
       }
     }
 
-    coppuccino {
-      rootDir = "${projectDir}/"
-    }
-
-    vogue {
-      dependencyUpdatesOutputDir = "${projectDir}/build/dependencyUpdates"
-    }
-
-    task sourcesJar(type: Jar, dependsOn: classes) {
-      classifier = "sources"
-      from sourceSets.main.allSource
-    }
-
-    task packageJavadoc(type: Jar) {
-      classifier = "javadoc"
-      from javadoc
-    }
-
-    artifacts {
-      archives sourcesJar
-      archives jar
-      archives packageJavadoc
-    }
-
     if (publishedProjects.contains(it.name)) {
       apply plugin: "maven-publish"
       apply plugin: "signing"
 
       publishing {
         publications {
           maven(MavenPublication) {
-            from components.java
-            artifact sourcesJar
-            artifact packageJavadoc
+            from(it.name == platformProject ? components.javaPlatform : components.java)
 
             pom {
               groupId = project.group
@@ -232,25 +195,11 @@ nexusPublishing {
 }
 
 task spotlessApply {
-  subprojects.each {
-    if (it.name != platformProject) {
-      it.afterEvaluate {
-        def spotlessApplyTask = it.tasks.findByName("spotlessApply")
-        dependsOn(spotlessApplyTask)
-      }
-    }
-  }
+  dependsOn subprojects.findAll { it.name != platformProject }.collect { "${it.path}:spotlessApply" }
 }
 
 task subdependencies {
-  subprojects.each {
-    if (it.name != platformProject) {
-      it.afterEvaluate {
-        def dependenciesTask = it.tasks.findByName("dependencies")
-        dependsOn(dependenciesTask)
-      }
-    }
-  }
+  dependsOn subprojects.findAll { it.name != platformProject }.collect { "${it.path}:dependencies" }
 }
 
 project.tasks.getByPath("dependencies").finalizedBy("subdependencies")

build.gradle

@@ -5,13 +5,12 @@ coppuccino {
 }
 
 dependencies {
-  api "org.apache.commons:commons-text:latest.release" // For string manipulation utilities. There is a very small overlap with Guava's strings class, but adds many more features.
+  api "org.apache.commons:commons-text:1.15.0" // For string manipulation utilities
   api "com.google.guava:guava"
   api "com.github.rholder:guava-retrying" // For Request retries
-  api "com.github.spotbugs:spotbugs-annotations:4.9.8" // For annotating classes and methods to suppress SpotBugs violations
   api "com.google.code.gson:gson"
   api "org.yaml:snakeyaml:2.4"
-  implementation "org.slf4j:slf4j-api"
+
   implementation "org.objenesis:objenesis:3.3"
-  testImplementation "org.objenesis:objenesis:3.3"
+  implementation "org.slf4j:slf4j-api"
 }

common/build.gradle

@@ -3,7 +3,7 @@
 # This file is expected to be part of source control.
 com.github.oowekyala.ooxml:nice-xml-messages:3.1=pmd
 com.github.rholder:guava-retrying:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.spotbugs:spotbugs-annotations:4.9.8=compileClasspath,runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
+com.github.spotbugs:spotbugs-annotations:4.9.8=compileClasspath,spotbugs,testCompileClasspath
 com.github.spotbugs:spotbugs:4.9.8=spotbugs
 com.github.stephenc.jcip:jcip-annotations:1.0-1=spotbugs
 com.google.code.findbugs:jsr305:3.0.2=checkstyle,compileClasspath,runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
@@ -37,7 +37,9 @@ net.sourceforge.pmd:pmd-java:7.16.0=pmd
 org.antlr:antlr4-runtime:4.13.2=checkstyle
 org.antlr:antlr4-runtime:4.9.3=pmd
 org.apache.bcel:bcel:6.11.0=spotbugs
-org.apache.commons:commons-lang3:3.18.0=checkstyle,compileClasspath,pmd,runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.18.0=checkstyle,pmd
+org.apache.commons:commons-lang3:3.19.0=spotbugs
+org.apache.commons:commons-lang3:3.20.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-text:1.14.0=spotbugs
 org.apache.commons:commons-text:1.15.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-text:1.3=checkstyle
@@ -73,7 +75,7 @@ org.jspecify:jspecify:1.0.0=checkstyle
 org.junit.jupiter:junit-jupiter-api:5.14.0=testCompileClasspath,testRuntimeClasspath
 org.junit.platform:junit-platform-commons:1.14.0=testCompileClasspath,testRuntimeClasspath
 org.junit.platform:junit-platform-engine:1.14.0=testCompileClasspath,testRuntimeClasspath
-org.junit:junit-bom:5.14.0=runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
+org.junit:junit-bom:5.14.0=spotbugs,testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-core:5.2.0=testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-inline:5.2.0=testCompileClasspath,testRuntimeClasspath
 org.objenesis:objenesis:3.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

common/gradle.lockfile

@@ -8,7 +8,7 @@ com.fasterxml.jackson.core:jackson-databind:2.21.0=runtimeClasspath,testRuntimeC
 com.fasterxml.jackson:jackson-bom:2.21.0=runtimeClasspath,testRuntimeClasspath
 com.github.oowekyala.ooxml:nice-xml-messages:3.1=pmd
 com.github.rholder:guava-retrying:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.spotbugs:spotbugs-annotations:4.9.8=compileClasspath,runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
+com.github.spotbugs:spotbugs-annotations:4.9.8=compileClasspath,spotbugs,testCompileClasspath
 com.github.spotbugs:spotbugs:4.9.8=spotbugs
 com.github.stephenc.jcip:jcip-annotations:1.0-1=spotbugs
 com.google.code.findbugs:jsr305:3.0.2=checkstyle,compileClasspath,runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
@@ -46,7 +46,9 @@ net.sourceforge.pmd:pmd-java:7.16.0=pmd
 org.antlr:antlr4-runtime:4.13.2=checkstyle
 org.antlr:antlr4-runtime:4.9.3=pmd
 org.apache.bcel:bcel:6.11.0=spotbugs
-org.apache.commons:commons-lang3:3.18.0=checkstyle,compileClasspath,pmd,runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.18.0=checkstyle,pmd
+org.apache.commons:commons-lang3:3.19.0=spotbugs
+org.apache.commons:commons-lang3:3.20.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-text:1.14.0=spotbugs
 org.apache.commons:commons-text:1.15.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-text:1.3=checkstyle
@@ -82,7 +84,7 @@ org.jspecify:jspecify:1.0.0=checkstyle
 org.junit.jupiter:junit-jupiter-api:5.14.0=testCompileClasspath,testRuntimeClasspath
 org.junit.platform:junit-platform-commons:1.14.0=testCompileClasspath,testRuntimeClasspath
 org.junit.platform:junit-platform-engine:1.14.0=testCompileClasspath,testRuntimeClasspath
-org.junit:junit-bom:5.14.0=runtimeClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
+org.junit:junit-bom:5.14.0=spotbugs,testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-core:5.2.0=testCompileClasspath,testRuntimeClasspath
 org.mockito:mockito-inline:5.2.0=testCompileClasspath,testRuntimeClasspath
 org.objenesis:objenesis:3.3=runtimeClasspath,testRuntimeClasspath

context/gradle.lockfile

@@ -2,8 +2,8 @@ dependencies {
   implementation project(":gateway")
 
   implementation "com.squareup:javapoet:1.13.0"
-  implementation "com.google.auto.service:auto-service:1.1.1"
-  implementation "org.projectlombok:lombok:1.18.24"
 
+  // Compiles the auto-service annotations and runs the processor
+  compileOnly "com.google.auto.service:auto-service:1.1.1"
   annotationProcessor "com.google.auto.service:auto-service:1.1.1"
 }