diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000000..818db9bc13 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,41 @@ +# EditorConfig is awesome: https://EditorConfig.org + +# top-most EditorConfig file +root = true + +# All files +[*] +charset = utf-8 +end_of_line = lf +insert_final_newline = true +trim_trailing_whitespace = true + +# Java files +[*.java] +indent_style = space +indent_size = 4 +max_line_length = 130 + +# XML files (pom.xml, checkstyle.xml, etc.) +[*.xml] +indent_style = space +indent_size = 2 + +# JSON files +[*.json] +indent_style = space +indent_size = 2 + +# YAML files +[*.{yml,yaml}] +indent_style = space +indent_size = 2 + +# Markdown files +[*.md] +trim_trailing_whitespace = false + +# Properties files +[*.properties] +indent_style = space +indent_size = 2 \ No newline at end of file diff --git a/.github/workflows/test-and-deploy.yml b/.github/workflows/test-and-deploy.yml index 07178db5f3..d9aace8a70 100644 --- a/.github/workflows/test-and-deploy.yml +++ b/.github/workflows/test-and-deploy.yml @@ -62,7 +62,7 @@ jobs: with: distribution: 'zulu' java-version: '17' - + - name: SonarCloud Scan if: ${{ (github.event_name == 'pull_request' || github.ref_type == 'branch') && matrix.java == 11 && !github.event.pull_request.head.repo.fork }} env: @@ -94,7 +94,7 @@ jobs: - name: Create GitHub Release uses: sendgrid/dx-automator/actions/release@main with: - footer: '**[Maven](https://mvnrepository.com/artifact/com.twilio.sdk/twilio/${version})**' + footer: '**[Maven](https://central.sonatype.com/artifact/com.twilio.sdk/twilio/${version})**' env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.gitignore b/.gitignore index e96c9a213a..7b2fb3b40a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,15 +1,121 @@ -*.iml +# Compiled class files +*.class -.idea/ -out/ +# Log files +*.log + +# BlueJ files +*.ctxt + +# Mobile Tools for Java (J2ME) +.mtj.tmp/ + +# Package Files +*.jar +*.war +*.nar +*.ear +*.zip +*.tar.gz +*.rar + +# Virtual machine crash logs +hs_err_pid* + +# Maven target/ -docs/ -src/main/java/com/twilio/Twilio.java.bak -secret.key +pom.xml.tag pom.xml.releaseBackup +pom.xml.versionsBackup +pom.xml.next release.properties +dependency-reduced-pom.xml +buildNumber.properties +.mvn/timing.properties +.mvn/wrapper/maven-wrapper.jar + +# Gradle +.gradle/ +build/ +gradle-app.setting +!gradle-wrapper.jar +!gradle-wrapper.properties + +# IntelliJ IDEA +*.iml +.idea/ +out/ +!.idea/codeStyles/ +!.idea/runConfigurations/ + +# Eclipse .classpath .project .settings/ -settings.json +.metadata +bin/ +tmp/ +*.tmp +*.bak +*.swp +*~.nib +local.properties +.loadpath +.recommenders + +# VS Code +.vscode/ +!.vscode/settings.json +!.vscode/tasks.json +!.vscode/launch.json +!.vscode/extensions.json + +# NetBeans +/nbproject/private/ +/nbbuild/ +/dist/ +/nbdist/ +/.nb-gradle/ + +# OS Files +.DS_Store +.DS_Store? +._* +.Spotlight-V100 +.Trashes +ehthumbs.db +Thumbs.db + +# Security files +secret.key +*.pem +*.key +*.crt +*.p12 +*.jks + +# Documentation +docs/ + +# Test results +*.xml.results + +# OpenAPI Generator **/.openapi-generator* + +# Dependency Check +dependency-check-report.html + +# PMD +pmd.xml + +# SpotBugs +spotbugsXml.xml +spotbugs.xml + +# JaCoCo +jacoco.exec + +# Legacy ignores +src/main/java/com/twilio/Twilio.java.bak +settings.json diff --git a/IMPROVEMENT_RECOMMENDATIONS.md b/IMPROVEMENT_RECOMMENDATIONS.md new file mode 100644 index 0000000000..4542ea37e6 --- /dev/null +++ b/IMPROVEMENT_RECOMMENDATIONS.md @@ -0,0 +1,142 @@ +# Twilio Java SDK - Additional Improvement Recommendations + +This document outlines additional improvements that could be considered for the Twilio Java SDK beyond the critical fixes already implemented. + +## Completed Improvements ✅ + +### Build & Tooling +- Fixed Checkstyle configuration (LineLength placement, outdated property names) +- Updated SpotBugs to Java 17 compatible version (4.8.3.1) +- Added PMD static analysis (3.21.2) +- Added OWASP Dependency Check for security scanning (9.0.9) +- Updated Maven plugins to latest compatible versions + +### Dependencies & Security +- Updated Jackson (2.15.0 → 2.16.1) +- Updated Commons libraries (IO, Codec) +- Updated SLF4J (1.7.30 → 1.7.36) +- Modernized test dependencies (Mockito 1.x → 5.x, ArchUnit, EqualsVerifier) +- Added SLF4J implementation for tests (eliminates warnings) +- Added dependency management for convergence +- Fixed test compatibility with updated dependencies + +### Development Experience +- Added .editorconfig for consistent formatting +- Enhanced .gitignore with comprehensive patterns +- Added SECURITY.md for responsible disclosure +- Updated README with quality badges + +## Future Improvement Opportunities + +### 1. Migration to JUnit 5 +**Current**: Using JUnit 4 +**Recommendation**: Migrate to JUnit 5 for better features +- Better parameterized tests +- Improved assertions +- Better extension model +- Conditional test execution + +### 2. Add Gradle Support +**Current**: Maven only +**Recommendation**: Add Gradle build files +- Faster builds +- Better dependency management +- Modern build tool preference + +### 3. Enhanced CI/CD Pipeline +**Current**: GitHub Actions basic setup +**Recommendations**: +- Add matrix builds for multiple Java versions +- Add performance benchmarking +- Add automatic dependency updates (Dependabot/Renovate) +- Add code coverage reporting integration + +### 4. Code Quality Enhancements +**Recommendations**: +- Configure SpotBugs exclusions for false positives +- Add custom Checkstyle rules for Twilio-specific patterns +- Add mutation testing (PIT) +- Add architecture tests with ArchUnit + +### 5. Documentation Improvements +**Recommendations**: +- Add more comprehensive API documentation +- Add architecture decision records (ADRs) +- Improve example documentation +- Add troubleshooting guide + +### 6. Performance & Monitoring +**Recommendations**: +- Add JMH benchmarks for critical paths +- Add micrometer metrics +- Add performance regression testing +- Add memory leak detection + +### 7. Security Enhancements +**Recommendations**: +- Add SAST tools (CodeQL, Semgrep) +- Add container scanning if Docker images are built +- Add license scanning +- Regular dependency vulnerability scanning in CI + +### 8. Modern Java Features +**Current**: Targets Java 8+ +**Recommendations** (for major version): +- Consider Java 11+ as minimum for new features +- Use modern Java features (var, records, text blocks) +- Use newer HTTP client APIs +- Consider Project Loom for async operations + +### 9. API Design Improvements +**Recommendations**: +- Add fluent builder patterns where missing +- Consider reactive streams support +- Add async/await style APIs +- Improve error handling with custom exceptions + +### 10. Testing Enhancements +**Recommendations**: +- Add contract testing (Pact) +- Add integration test improvements +- Add testcontainers for integration tests +- Add property-based testing + +## Implementation Priority + +### High Priority (Quick Wins) +1. JUnit 5 migration +2. Enhanced CI/CD matrix builds +3. Dependabot setup +4. Additional architecture tests + +### Medium Priority (Feature Releases) +1. Gradle support +2. Performance benchmarking +3. Enhanced documentation +4. Modern Java features adoption + +### Low Priority (Major Versions) +1. API design overhauls +2. Reactive streams support +3. Architecture modernization + +## Benefits Summary + +The improvements already implemented provide: +- **Reliability**: Fixed build tools, eliminated warnings +- **Security**: Updated dependencies, added vulnerability scanning +- **Maintainability**: Better code quality tools, consistent formatting +- **Developer Experience**: Better IDE support, clearer documentation + +Future improvements would add: +- **Performance**: Better monitoring and optimization +- **Scalability**: Modern async patterns +- **Productivity**: Better testing and build tools +- **Innovation**: Leverage modern Java ecosystem + +## Notes + +- All improvements should maintain backward compatibility where possible +- Consider semantic versioning for API changes +- Ensure changes don't impact existing integrations +- Prioritize security and reliability over new features \ No newline at end of file diff --git a/README.md b/README.md index dbd9f1c804..da72597405 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,9 @@ [![Tests](https://github.com/twilio/twilio-java/actions/workflows/test-and-deploy.yml/badge.svg)](https://github.com/twilio/twilio-java/actions/workflows/test-and-deploy.yml) [![Maven Central](https://img.shields.io/maven-central/v/com.twilio.sdk/twilio.svg)](https://mvnrepository.com/artifact/com.twilio.sdk/twilio) +[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=twilio_twilio-java&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=twilio_twilio-java) +[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=twilio_twilio-java&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=twilio_twilio-java) +[![Known Vulnerabilities](https://snyk.io/test/github/twilio/twilio-java/badge.svg)](https://snyk.io/test/github/twilio/twilio-java) [![Learn with TwilioQuest](https://img.shields.io/static/v1?label=TwilioQuest&message=Learn%20to%20contribute%21&color=F22F46&labelColor=1f243c&style=flat-square&logo=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAMAAAD04JH5AAAASFBMVEUAAAAZGRkcHBwjIyMoKCgAAABgYGBoaGiAgICMjIyzs7PJycnMzMzNzc3UoBfd3d3m5ubqrhfrMEDu7u739/f4vSb/3AD///9tbdyEAAAABXRSTlMAAAAAAMJrBrEAAAKoSURBVHgB7ZrRcuI6EESdyxXGYoNFvMD//+l2bSszRgyUYpFAsXOeiJGmj4NkuWx1Qeh+Ekl9DgEXOBwOx+Px5xyQhDykfgq4wG63MxxaR4ddIkg6Ul3g84vCIcjPBA5gmUMeXESrlukuoK33+33uID8TWeLAdOWsKpJYzwVMB7bOzYSGOciyUlXSn0/ABXTosJ1M1SbypZ4O4MbZuIDMU02PMbauhhHMHXbmebmALIiEbbbbbUrpF1gwE9kFfRNAJaP+FQEXCCTGyJ4ngDrjOFo3jEL5JdqjF/pueR4cCeCGgAtwmuRS6gDwaRiGvu+DMFwSBLTE3+jF8JyuV1okPZ+AC4hDFhCHyHQjdjPHUKFDlHSJkHQXMB3KpSwXNGJPcwwTdZiXlRN0gSp0zpWxNtM0beYE0nRH6QIbO7rawwXaBYz0j78gxjokDuv12gVeUuBD0MDi0OQCLvDaAho4juP1Q/jkAncXqIcCfd+7gAu4QLMACCLxpRsSuQh0igu0C9Svhi7weAGZg50L3IE3cai4IfkNZAC8dfdhsUD3CgKBVC9JE5ABAFzg4QL/taYPAAWrHdYcgfLaIgAXWJ7OV38n1LEF8tt2TH29E+QAoDoO5Ve/LtCQDmKM9kPbvCEBApK+IXzbcSJ0cIGF6e8gpcRhUDogWZ8JnaWjPXc/fNnBBUKRngiHgTUSivSzDRDgHZQOLvBQgf8rRt+VdBUUhwkU6VpJ+xcOwQUqZr+mR0kvBUgv6cB4+37hQAkXqE8PwGisGhJtN4xAHMzrsgvI7rccXqSvKh6jltGlrOHA3Xk1At3LC4QiPdX9/0ndHpGVvTjR4bZA1ypAKgVcwE5vx74ulwIugDt8e/X7JgfkucBMIAr26ndnB4UCLnDOqvteQsHlgX9N4A+c4cW3DXSPbwAAAABJRU5ErkJggg==)](https://twil.io/learn-open-source) [![libs.tech recommends](https://libs.tech/project/307476/badge.svg)](https://libs.tech/project/307476/twilio-java) diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..b2dc1e600d --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,25 @@ +# Security Policy + +## Supported Versions + +| Version | Supported | +| ------- | ------------------ | +| 10.x | :white_check_mark: | +| 9.x | :white_check_mark: | +| < 9.0 | :x: | + +## Reporting a Vulnerability + +To report a security vulnerability, please use the process described in our [Responsible Disclosure page](https://www.twilio.com/docs/security) rather than opening a public issue. + +All security reports will be reviewed and responded to promptly by the Twilio Security Team. + +### What happens after you submit a report? + +1. We will acknowledge receipt of your report within 1 business day +2. We will provide an initial assessment within 5 business days +3. We will work with you to verify and reproduce the issue +4. We will develop and test a fix +5. We will coordinate disclosure timing with you + +Thank you for helping keep Twilio and our community secure! \ No newline at end of file diff --git a/checkstyle.xml b/checkstyle.xml index 4a3484d0a7..e661670046 100644 --- a/checkstyle.xml +++ b/checkstyle.xml @@ -26,13 +26,14 @@ + + + + + - - - - @@ -42,7 +43,6 @@ - @@ -169,13 +169,7 @@ - - - - - - diff --git a/dependency-check-suppressions.xml b/dependency-check-suppressions.xml new file mode 100644 index 0000000000..c799b50f0d --- /dev/null +++ b/dependency-check-suppressions.xml @@ -0,0 +1,13 @@ + + + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml index 69033e805e..5ea09043a3 100644 --- a/pom.xml +++ b/pom.xml @@ -166,8 +166,8 @@ - 2.15.0 - 3.3.1 + 2.16.1 + 3.6.3 0.12.6 false false @@ -177,6 +177,15 @@ **/test/**/*.*,**/rest/**/*.* **/rest/**/*.* + + + + net.bytebuddy + byte-buddy + 1.14.12 + + + org.projectlombok @@ -187,12 +196,12 @@ commons-codec commons-codec - 1.15 + 1.16.0 commons-io commons-io - 2.14.0 + 2.15.1 io.jsonwebtoken @@ -260,7 +269,7 @@ org.slf4j slf4j-api - 1.7.30 + 1.7.36 junit @@ -268,6 +277,12 @@ 4.13.2 test + + org.mockito + mockito-core + 5.11.0 + test + org.apache.httpcomponents httpmime @@ -277,7 +292,7 @@ com.tngtech.archunit archunit - 0.23.0 + 1.2.1 test @@ -289,7 +304,7 @@ nl.jqno.equalsverifier equalsverifier - 3.6.1 + 3.15.6 test @@ -314,17 +329,23 @@ 2.9.0 test - - org.mockito - mockito-all - 1.10.19 - test - org.json json 20240303 + + ch.qos.logback + logback-classic + 1.2.12 + test + + + org.slf4j + slf4j-api + + + com.auth0 java-jwt @@ -377,10 +398,17 @@ org.apache.maven.plugins maven-checkstyle-plugin - 3.1.1 + 3.3.1 checkstyle.xml + + + com.puppycrawl.tools + checkstyle + 10.12.4 + + org.apache.maven.plugins @@ -452,7 +480,7 @@ com.github.spotbugs spotbugs-maven-plugin - 4.0.4 + 4.8.3.1 Max Low @@ -488,6 +516,34 @@ jacoco-maven-plugin 0.8.8 + + org.owasp + dependency-check-maven + 9.0.9 + + 8 + + dependency-check-suppressions.xml + + + + + org.apache.maven.plugins + maven-pmd-plugin + 3.21.2 + + + /category/java/bestpractices.xml + /category/java/codestyle.xml + /category/java/design.xml + /category/java/errorprone.xml + /category/java/performance.xml + /category/java/security.xml + + true + false + + \ No newline at end of file diff --git a/src/test/java/com/twilio/compliance/ComplianceTest.java b/src/test/java/com/twilio/compliance/ComplianceTest.java index bee9fc8b42..4f9ed9766c 100644 --- a/src/test/java/com/twilio/compliance/ComplianceTest.java +++ b/src/test/java/com/twilio/compliance/ComplianceTest.java @@ -6,7 +6,6 @@ import com.tngtech.archunit.core.domain.JavaModifier; import com.tngtech.archunit.core.importer.ClassFileImporter; import com.tngtech.archunit.core.importer.ImportOption; -import com.tngtech.archunit.core.importer.ImportOptions; import com.tngtech.archunit.lang.ArchRule; import com.tngtech.archunit.lang.syntax.elements.GivenClasses; import com.tngtech.archunit.lang.syntax.elements.GivenClassesConjunction; @@ -29,15 +28,16 @@ import java.util.stream.Collectors; public class ComplianceTest { - static final private ImportOptions importOpts = new ImportOptions().with(ImportOption.Predefined.DO_NOT_INCLUDE_TESTS); - static final private JavaClasses twilioClasses = new ClassFileImporter(importOpts).importPackages("com.twilio"); + static final private JavaClasses twilioClasses = new ClassFileImporter() + .withImportOption(ImportOption.Predefined.DO_NOT_INCLUDE_TESTS) + .importPackages("com.twilio"); static final private List resourceClasses = getResourceClasses(twilioClasses); static final private List variantClasses = new ArrayList(); // classes that do not follow the generic template private static DescribedPredicate areNotInVariantList() { return new DescribedPredicate("classes that follow the same template pattern") { @Override - public boolean apply(final JavaClass input) { + public boolean test(final JavaClass input) { return !variantClasses.contains(input.getName()); } }; diff --git a/src/test/java/com/twilio/http/NetworkHttpClientTest.java b/src/test/java/com/twilio/http/NetworkHttpClientTest.java index ee5c9050f4..d1ae758e24 100644 --- a/src/test/java/com/twilio/http/NetworkHttpClientTest.java +++ b/src/test/java/com/twilio/http/NetworkHttpClientTest.java @@ -19,7 +19,7 @@ import java.net.URL; import static org.junit.Assert.*; -import static org.mockito.Matchers.any; +import static org.mockito.ArgumentMatchers.any; import static org.mockito.Mockito.*; public class NetworkHttpClientTest { diff --git a/src/test/java/com/twilio/http/ResponseTest.java b/src/test/java/com/twilio/http/ResponseTest.java index ca9b64bc31..a3b1a3e86e 100644 --- a/src/test/java/com/twilio/http/ResponseTest.java +++ b/src/test/java/com/twilio/http/ResponseTest.java @@ -3,7 +3,7 @@ import org.junit.Test; import org.junit.runner.RunWith; import org.mockito.Mock; -import org.mockito.runners.MockitoJUnitRunner; +import org.mockito.junit.MockitoJUnitRunner; import java.io.InputStream;