OpenMetadata/openmetadata-clients/openmetadata-java-client/pom.xml

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

269 lines
11 KiB
XML
Raw Permalink Normal View History

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<parent>
<artifactId>openmetadata-clients</artifactId>
<groupId>org.open-metadata</groupId>
2025-12-17 13:06:03 +00:00
<version>1.12.0-SNAPSHOT</version>
</parent>
<modelVersion>4.0.0</modelVersion>
<artifactId>openmetadata-java-client</artifactId>
<name>OpenMetadata Java Client</name>
<properties>
<java.version>21</java.version>
<maven.compiler.source>${java.version}</maven.compiler.source>
<maven.compiler.target>${java.version}</maven.compiler.target>
<springfox-version>2.7.0</springfox-version>
<feign-version>13.5</feign-version>
<jackson-databind-nullable-version>0.2.6</jackson-databind-nullable-version>
<scribejava-apis-version>8.3.3</scribejava-apis-version>
<swagger-parser-version>2.1.23</swagger-parser-version>
<jakarta-annotation-version>1.3.5</jakarta-annotation-version>
<maven-javadoc-plugin.version>3.6.0</maven-javadoc-plugin.version>
<maven-source-plugin.version>3.3.1</maven-source-plugin.version>
<sonar.skip>true</sonar.skip>
</properties>
<dependencies>
<dependency>
<groupId>org.open-metadata</groupId>
<artifactId>openmetadata-spec</artifactId>
<version>${project.version}</version>
</dependency>
<!-- FEIGN DEPENDENCY-->
<dependency>
<groupId>io.github.openfeign</groupId>
<artifactId>feign-core</artifactId>
<version>${feign-version}</version>
</dependency>
<dependency>
<groupId>io.github.openfeign</groupId>
<artifactId>feign-jackson</artifactId>
<version>${feign-version}</version>
</dependency>
<dependency>
<groupId>io.github.openfeign</groupId>
<artifactId>feign-slf4j</artifactId>
<version>${feign-version}</version>
</dependency>
<dependency>
<groupId>io.github.openfeign</groupId>
<artifactId>feign-okhttp</artifactId>
<version>${feign-version}</version>
</dependency>
<dependency>
<groupId>io.github.openfeign.form</groupId>
<artifactId>feign-form</artifactId>
<version>3.8.0</version>
</dependency>
<!-- FEIGN DEPENDENCY END -->
<dependency>
<groupId>org.openapitools</groupId>
<artifactId>jackson-databind-nullable</artifactId>
<version>${jackson-databind-nullable-version}</version>
</dependency>
<dependency>
<groupId>jakarta.annotation</groupId>
<artifactId>jakarta.annotation-api</artifactId>
<version>${jakarta-annotation-version}</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>io.swagger.parser.v3</groupId>
<artifactId>swagger-parser</artifactId>
<version>${swagger-parser-version}</version>
</dependency>
<dependency>
<groupId>com.github.scribejava</groupId>
<artifactId>scribejava-apis</artifactId>
<version>${scribejava-apis-version}</version>
</dependency>
<dependency>
<groupId>com.google.auth</groupId>
<artifactId>google-auth-library-oauth2-http</artifactId>
<version>1.29.0</version>
</dependency>
<dependency>
<groupId>com.microsoft.azure</groupId>
<artifactId>msal4j</artifactId>
<version>1.17.2</version>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
</dependency>
<!-- TEST -->
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.13.2</version>
</dependency>
<!--avoid security issue https://security.snyk.io/vuln/SNYK-JAVA-ORGMOZILLA-1314295-->
<dependency>
<groupId>org.mozilla</groupId>
<artifactId>rhino</artifactId>
<version>1.7.15.1</version>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-api</artifactId>
2023-08-22 14:45:09 +00:00
<version>${org.junit.jupiter.version}</version>
<scope>compile</scope>
</dependency>
</dependencies>
<profiles>
<profile>
<id>release</id>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
<version>${maven-source-plugin.version}</version>
<executions>
<execution>
<id>attach-sources</id>
<goals>
<goal>jar-no-fork</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>${maven-javadoc-plugin.version}</version>
<configuration>
<doclint>none</doclint>
</configuration>
<executions>
<execution>
<id>attach-javadocs</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-gpg-plugin</artifactId>
<version>3.0.1</version>
<executions>
<execution>
<id>sign-artifacts</id>
<phase>verify</phase>
<goals>
<goal>sign</goal>
</goals>
<configuration>
<gpgArguments>
<arg>--pinentry-mode</arg>
<arg>loopback</arg>
</gpgArguments>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
</profiles>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<executions>
<execution>
<id>analyze</id>
<goals>
<goal>analyze-only</goal>
</goals>
<configuration>
<ignoredDependencies>
<ignoredDependency>org.projectlombok:lombok</ignoredDependency>
</ignoredDependencies>
</configuration>
</execution>
</executions>
</plugin>
<!--Reformat Code to comply with Google Java Style -->
<plugin>
<groupId>com.theoryinpractise</groupId>
<artifactId>googleformatter-maven-plugin</artifactId>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
<version>${maven-source-plugin.version}</version>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>buildnumber-maven-plugin</artifactId>
<version>3.0.0</version>
<configuration>
<doCheck>false</doCheck>
<doUpdate>false</doUpdate>
<outputDirectory>${project.build.directory}/classes/catalog</outputDirectory>
<outputName>VERSION</outputName>
</configuration>
<executions>
<execution>
<phase>generate-resources</phase>
<goals>
<goal>create-metadata</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.openapitools</groupId>
<artifactId>openapi-generator-maven-plugin</artifactId>
2025-06-23 13:58:50 +00:00
<version>7.13.0</version>
<executions>
<execution>
<goals>
<goal>generate</goal>
</goals>
<configuration>
<inputSpec>${project.basedir}/../../openmetadata-service/target/classes/assets/swagger.yaml</inputSpec>
<generatorName>java</generatorName>
<library>feign</library>
<apiPackage>org.openmetadata.client.api</apiPackage>
<modelPackage>org.openmetadata.client.model</modelPackage>
<output>
${project.build.directory}/generated-sources/swagger
</output>
<skipOperationExample>true</skipOperationExample>
<skipValidateSpec>true</skipValidateSpec>
fix(security): upgrade Java dependencies to resolve CRITICAL and HIGH CVEs (#27940) * fix(security): upgrade Java dependencies to resolve CRITICAL and HIGH CVEs - jetty-http: 12.1.6 → 12.1.7 (HTTP Request Smuggling, CRITICAL) - bcpkix/bcprov/bcutil-jdk18on: 1.80 → 1.84 (Crypto Signature Bypass + Timing Attack) - postgresql: 42.7.7 → 42.7.11 (SCRAM-SHA-256 DoS) - httpcore5-h2: pinned to 5.3.5 (HTTP/2 stream reset DoS) - commons-compress: pinned to 1.26.0 (Infinite Loop DoS) - jackson-core: 2.18.6 → 2.19.0 (async parser resource exhaustion) - maven-shade-plugin: 3.5.1 → 3.6.0 (supports Java 22 MR-JAR in jackson-core 2.19.0) - openapi-generator template override: jackson-version 2.17.1 → 2.19.0 in generated swagger pom * fix(security): upgrade spring-web 6.2.11 → 6.2.18 * fix(security): align jackson-dataformat-yaml, feign, gson, logback versions - jackson-dataformat-yaml: 2.17.2 → ${jackson.version} (2.19.0) - feign-core: 13.2.1 → 13.5 (in openapi-gen template) - gson: 2.10.1 → 2.11.0 (in openapi-gen template) - logback-classic: 1.3.13 → 1.5.25 (in openapi-gen template) * fix(security): use jackson 2.18.7 — highest clean 2.x with full ecosystem 2.19.0-2.21.0 all carry a HIGH (CVSS 8.7) vulnerability per Sonatype. 2.18.7 is the latest clean patch where all Jackson modules are released. * fix(security): remove hardcoded jackson 2.17.2 override in k8s-operator, inherit 2.18.7 from root * fix(security): upgrade gson 2.11.0 → 2.13.1 (Medium CVE) * fix(security): replace 436-line pom.mustache with minimal stub The openapi-generator-maven-plugin writes target/generated-sources/swagger/pom.xml at build time with hardcoded jackson 2.17.1. Snyk --all-projects picks up every pom.xml on disk and flags it as HIGH. The generated pom.xml is never packaged into any JAR or Docker image — it is a generator artefact. The actual runtime jackson version comes from the module pom inheriting jackson.version=2.18.7 from the root. Replace the 436-line verbatim upstream template (maintained just to change 2 version lines) with a 10-line coordinate-only stub. The generated pom.xml will have no <dependencies> block, so Snyk finds nothing to flag.
2026-05-07 09:19:10 +00:00
<templateDirectory>${project.basedir}/src/main/openapi-templates</templateDirectory>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<artifactId>maven-assembly-plugin</artifactId>
<executions>
<execution>
<phase>package</phase>
<goals>
<goal>single</goal>
</goals>
</execution>
</executions>
<configuration>
<descriptorRefs>
<descriptorRef>jar-with-dependencies</descriptorRef>
</descriptorRefs>
</configuration>
</plugin>
</plugins>
</build>
</project>