#12362-factory-method-for-JSONbuilders

.github/workflows/maven_unit_test.yml

@@ -147,7 +147,7 @@ jobs:
           # Get the build output from the integration test job
           - uses: actions/download-artifact@v8
             with:
-                name: java-reportdir
+              name: java-reportdir
           - run: tar -xvf java-reportdir.tar
 
           # Deposit Code Coverage
@@ -159,10 +159,65 @@ jobs:
             continue-on-error: true
             run: >
                 mvn -B
-                -DrepoToken=${COVERALLS_SECRET} -DpullRequest=${{ github.event.number }}
+                -DrepoToken="${COVERALLS_SECRET}" -DpullRequest=${{ github.event.number }}
                 jacoco:report coveralls:report
 
-          # NOTE: this may be extended with adding a report to the build output, leave a comment, send to Sonarcloud, ...
+  # Note: The SONAR_TOKEN secret is required to push analysis results to Sonarcloud.
+  # We check for them here and subsequent jobs can rely on this to decide if they shall run.
+    check-secrets:
+      needs: integration-test
+      name: Check for Secrets Availability
+      runs-on: ubuntu-latest
+      outputs:
+        available: ${{ steps.secret-check.outputs.available }}
+      steps:
+        - id: secret-check
+          # perform secret check & put boolean result as an output
+          shell: bash
+          run: |
+            if [ "${{ secrets.SONAR_TOKEN }}" != '' ]; then
+                echo "available=true" >> "$GITHUB_OUTPUT";
+            else
+                echo "available=false" >> "$GITHUB_OUTPUT";
+            fi
+
+    sonarcloud:
+      runs-on: ubuntu-latest
+      needs: check-secrets
+      name: SonarQube Analysis and Coverage
+      # Only run in upstream repo - avoid unnecessary runs in forks (they don't have access to SONAR_TOKEN)
+      if: needs.check-secrets.outputs.available == 'true'
+      steps:
+        # TODO: As part of #10618 change to setup-maven custom action
+        # Basic setup chores
+        - uses: actions/checkout@v7
+          with:
+            # Sonarcube benefits from a full Git history in it's analysis (assign issues, etc)
+            fetch-depth: 0
+        - uses: actions/setup-java@v5
+          with:
+            java-version: '21'
+            distribution: temurin
+            cache: maven
+
+        # Get the coverage output from the integration test job
+        - uses: actions/download-artifact@v8
+          with:
+            name: java-reportdir
+        # Get the binary class files as Sonar needs them for analysis
+        - uses: actions/download-artifact@v8
+          with:
+            name: java-artifacts
+        - run: |
+            tar -xvf java-builddir.tar
+            tar -xvf java-reportdir.tar
+
+        # Run Sonarcube analysis
+        - name: Analyze and commit to SonarCloud
+          env:
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
+            SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          run: mvn -B org.sonarsource.scanner.maven:sonar-maven-plugin:sonar
 
     # TODO: Add a filter step here, that avoids calling the app image release workflow if there are changes to the base image.
     #       Use https://github.com/dorny/paths-filter to solve this. Will require and additional job or adding to integration-test job.

.github/workflows/reviewdog_checkstyle.yml

@@ -16,6 +16,6 @@ jobs:
               with:
                   fail_on_error: true
                   reporter: github-pr-review
-                  checkstyle_config: checkstyle.xml
+                  checkstyle_config: src/maven/checkstyle.xml
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 

doc/release-notes/11161-do-not-assume-default-license.md

@@ -0,0 +1,8 @@
+### New Feature Flag: do-not-assume-default-license
+
+A new feature flag `do-not-assume-default-license` has been added. This flag controls the behavior when creating a dataset via API without providing a license or terms of use.
+
+- By default (flag disabled), the default license will be automatically assigned if no license and no terms are provided in the input JSON, regardless of whether custom terms are allowed.
+- When enabled, no license (and no terms) will be assigned if none are provided.
+
+**Note:** Previously, if custom terms were allowed, the system would not assign a default license in this case. To retain that behavior, you must now enable this feature flag.

doc/release-notes/12362-factory-method-for-JSONbuilders.md

@@ -0,0 +1,4 @@
+# Improved JSON Performance
+
+A Jakarta JSON-P provider is now reused for every builder or value creation.
+This improves the performance of large JSON operations, especially large exports and API responses, without changing the existing behavior or the JSON output.

doc/release-notes/12433-NPE-draft-prefiew

@@ -0,0 +1 @@
+This release fixes a null pointer exception when previewing a draft file with a retention period.

doc/release-notes/12483-gbr-req-question-fix.md

@@ -0,0 +1 @@
+A bug that caused any required custom questions in guestbooks to still be optional has been fixed in the current UI.

doc/sphinx-guides/source/api/changelog.rst

@@ -25,6 +25,8 @@ v6.12
 
   - **/api/admin/index/perms/{id}**
 
+- Dataset creation API calls may now behave differently when neither a license nor terms are provided, depending on the new :ref:`dataverse.feature.do-not-assume-default-license` feature flag.
+
 v6.11
 -----
 

doc/sphinx-guides/source/developers/testing/fixtures.md

@@ -128,7 +128,7 @@ DatasetFixture fixture = DatasetFixtureBuilder.builder()
     .populator(FixturePopulator.minimal())
     .build();
 
-JsonArrayBuilder files = Json.createArrayBuilder();
+JsonArrayBuilder files = JsonUtil.createArrayBuilder();
 
 for (FileMetadata fileMetadata : fixture.fileMetadatas()) {
     files.add(JsonPrinter.json(fileMetadata.getDataFile(), fileMetadata, true));

doc/sphinx-guides/source/installation/config.rst

@@ -3951,8 +3951,10 @@ Linked Data Notifications (LDN) Allowed Hosts
 +++++++++++++++++++++++++++++++++++++++++++++
 
 Dataverse supports receiving LDN notifications via the /api/inbox endpoint. The dataverse.ldn.allowed-hosts allows you to specify the list of host IP addresses from which LDN notifications can be received, or ``*`` to receive messages from anywhere.
+Note that since the Inbox endpoint does not require authentication, allowing un-trusted hosts via ``*`` is not recommended for production.
 
 Example: ``dataverse.ldn.allowed-hosts=*``
+Example: ``dataverse.ldn.allowed-hosts=172.16.234.56,172.16.234.57``
 
 COAR Notify Relationship Announcement Notify Superusers Only
 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
@@ -4055,6 +4057,15 @@ In a future Dataverse version, the (currently) experimental response message sty
 
 See also :ref:`dataverse.legacy.api-response-message-style`.
 
+.. _dataverse.feature.do-not-assume-default-license:
+
+dataverse.feature.do-not-assume-default-license
++++++++++++++++++++++++++++++++++++++++++++++++
+
+When creating a dataset via API, if neither a license nor any terms of use are provided, the system normally assigns the default license. If this feature flag is enabled, no license is assigned (and no terms) in this case.
+
+Defaults to ``false``.
+
 .. _dataverse.feature.avoid-expensive-solr-join:
 
 dataverse.feature.avoid-expensive-solr-join

modules/dataverse-parent/pom.xml

@@ -150,7 +150,7 @@
 
         <!-- Major system components and dependencies -->
         <payara.version>7.2026.2</payara.version>
-        <postgresql.version>42.7.11</postgresql.version>
+        <postgresql.version>42.7.12</postgresql.version>
         <solr.version>9.8.0</solr.version>
         <postgresql.server.version>16</postgresql.server.version>
         <aws.version>2.33.0</aws.version>
@@ -173,7 +173,6 @@
         <smallrye-mpconfig.version>3.7.1</smallrye-mpconfig.version>
         <junit.jupiter.version>5.10.2</junit.jupiter.version>
         <mockito.version>5.11.0</mockito.version>
-        <maven-jacoco-plugin.version>0.8.11</maven-jacoco-plugin.version>
 
         <checkstyle.version>9.3</checkstyle.version>
 
@@ -198,9 +197,18 @@
         <maven-checkstyle-plugin.version>3.2.2</maven-checkstyle-plugin.version>
         <nexus-staging-plugin.version>1.6.13</nexus-staging-plugin.version>
         <pomchecker-maven-plugin.version>1.7.0</pomchecker-maven-plugin.version>
+        <sonar.version>5.7.0.6970</sonar.version>
+        <maven-jacoco-plugin.version>0.8.14</maven-jacoco-plugin.version>
 
         <!-- Container related -->
         <fabric8-dmp.version>0.48.0</fabric8-dmp.version>
+
+        <!-- SonarQube Code Quality related -->
+        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
+        <sonar.organization>iqss</sonar.organization>
+        <sonar.projectKey>IQSS_dataverse</sonar.projectKey>
+        <sonar.moduleKey>${project.groupId}:${project.artifactId}</sonar.moduleKey>
+        <sonar.java.coveragePlugin>jacoco</sonar.java.coveragePlugin>   
     </properties>
 
     <pluginRepositories>
@@ -318,6 +326,11 @@
                     <artifactId>pomchecker-maven-plugin</artifactId>
                     <version>${pomchecker-maven-plugin.version}</version>
                 </plugin>
+                <plugin>
+                    <groupId>org.sonarsource.scanner.maven</groupId>
+                    <artifactId>sonar-maven-plugin</artifactId>
+                    <version>${sonar.version}</version>
+                </plugin>
                 <plugin>
                     <groupId>org.sonatype.plugins</groupId>
                     <artifactId>nexus-staging-maven-plugin</artifactId>

pom.xml

@@ -26,6 +26,9 @@
         <surefire.jacoco.args>-Ddummy.jacoco.property=true</surefire.jacoco.args>
         <failsafe.jacoco.args>-Ddummy.jacoco.property=true</failsafe.jacoco.args>
 
+        <jacoco.merged.outputdir>${project.reporting.outputDirectory}/jacoco-merged-test-coverage-report</jacoco.merged.outputdir>
+        <sonar.coverage.jacoco.xmlReportPaths>${jacoco.merged.outputdir}/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>
+
         <!-- By default, this module will produce a WAR file. -->
         <!-- This will be switched within the container profile! -->
         <packaging.type>war</packaging.type>
@@ -140,10 +143,10 @@
         </dependency>
 
         <!-- TECHNICAL DEBT
-             For a very long time, in a lots of places people used org.apache.commons.httpclient to access
-             HTTP resources, wrap responses in exceptions etc.
+             For a very long time, in a lot of places people used org.apache.commons.httpclient to access
+             HTTP resources, wrap responses in exceptions, etc.
 
-             This library had been used via an transitive dependency of sword2-server. During its recent updates,
+             This library had been used via a transitive dependency of sword2-server. During its recent updates,
              the dependency was dropped, went missing, eventually breaking our code. Re-adding this 2007 goodie here
              as a direct dependency.
 
@@ -357,7 +360,7 @@
         <dependency>
             <groupId>org.omnifaces</groupId>
             <artifactId>omnifaces</artifactId>
-            <version>4.7.5</version>
+            <version>4.7.12</version>
         </dependency>
 
         <!-- Jakarta Validation API & runtime -->
@@ -883,6 +886,59 @@
             </resource>
         </resources>
         <plugins>
+            <plugin>
+                <groupId>de.thetaphi</groupId>
+                <artifactId>forbiddenapis</artifactId>
+                <version>3.10</version>
+                <configuration>
+                    <!-- If the used Java version is too new, don't fail, just do nothing: -->
+                    <failOnUnsupportedJava>false</failOnUnsupportedJava>
+                    <!--
+                      If a class is missing while parsing signatures files, all methods
+                      and fields from this class are silently ignored. This is useful
+                      in multi-module Maven projects where only some modules have the
+                      dependency to which the signature file(s) apply.
+
+                      This settings prints no warning at all, so verify the signatures
+                      at least once with full dependencies.
+                    -->
+                    <ignoreSignaturesOfMissingClasses>true</ignoreSignaturesOfMissingClasses>
+                    <bundledSignatures>
+                        <!-- See https://github.com/policeman-tools/forbidden-apis/wiki/BundledSignatures -->
+                        <bundledSignature>jdk-non-portable</bundledSignature>
+                        <bundledSignature>jdk-internal</bundledSignature>
+
+                        <!-- Enabling the following checks will require refactoring within the codebase -->
+                        <!--
+                            <bundledSignature>jdk-reflection</bundledSignature>
+                            <bundledSignature>jdk-unsafe</bundledSignature>
+                            <bundledSignature>jdk-deprecated</bundledSignature>
+                            <bundledSignature>jdk-system-out</bundledSignature>
+                            <bundledSignature>commons-io-unsafe-${commons.io.version}</bundledSignature>
+                        -->
+                    </bundledSignatures>
+                    <signaturesFiles>
+                        <signaturesFile>${project.basedir}/src/maven/forbiddenapis.txt</signaturesFile>
+                    </signaturesFiles>
+                    <targetVersion>${target.java.version}</targetVersion>
+                </configuration>
+                <executions>
+                    <execution>
+                        <id>for-classes</id>
+                        <phase>process-classes</phase>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                    <execution>
+                        <id>for-test-classes</id>
+                        <phase>process-test-classes</phase>
+                        <goals>
+                            <goal>testCheck</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
@@ -1031,7 +1087,7 @@
                         </goals>
                         <configuration>
                             <dataFile>${project.build.directory}/coverage-reports/merged.exec</dataFile>
-                            <outputDirectory>${project.reporting.outputDirectory}/jacoco-merged-test-coverage-report</outputDirectory>
+                            <outputDirectory>${jacoco.merged.outputdir}</outputDirectory>
                             <skip>${skipIntegrationTests}</skip>
                         </configuration>
                     </execution>
@@ -1103,7 +1159,7 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-checkstyle-plugin</artifactId>
                 <configuration>
-                    <configLocation>checkstyle.xml</configLocation>
+                    <configLocation>${project.basedir}/src/maven/checkstyle.xml</configLocation>
                     <encoding>UTF-8</encoding>
                     <consoleOutput>true</consoleOutput>
                 </configuration>

src/main/java/edu/harvard/iq/dataverse/DataFile.java

@@ -30,6 +30,8 @@
 import java.util.Set;
 import java.util.logging.Logger;
 import java.util.stream.Collectors;
+
+import edu.harvard.iq.dataverse.util.json.JsonUtil;
 import jakarta.json.Json;
 import jakarta.json.JsonArrayBuilder;
 import jakarta.persistence.*;
@@ -446,7 +448,7 @@ public JsonArrayBuilder getTagLabelsAsJsonArrayBuilder(){
 
         List<DataFileTag> currentDataTags = this.getTags();
 
-        JsonArrayBuilder builder = Json.createArrayBuilder();
+        JsonArrayBuilder builder = JsonUtil.createArrayBuilder();
 
         if ( (currentDataTags == null)||(currentDataTags.isEmpty())){
             return builder;

src/main/java/edu/harvard/iq/dataverse/DatasetFieldServiceBean.java

@@ -20,6 +20,7 @@
 import java.util.Set;
 import java.util.logging.Logger;
 
+import edu.harvard.iq.dataverse.util.json.JsonUtil;
 import jakarta.ejb.EJB;
 import jakarta.ejb.Stateless;
 import jakarta.inject.Named;
@@ -645,7 +646,7 @@ private String tryToReplaceRetrievalUriParam(String retrievalUri, String paramNa
      */
     private JsonObject filterResponse(JsonObject cvocEntry, JsonObject readObject, String termUri) {
 
-        JsonObjectBuilder job = Json.createObjectBuilder();
+        JsonObjectBuilder job = JsonUtil.createObjectBuilder();
         JsonObject filtering = cvocEntry.getJsonObject("retrieval-filtering");
         logger.fine("RF: " + filtering.toString());
         JsonObject managedFields = cvocEntry.getJsonObject("managed-fields");
@@ -658,7 +659,7 @@ private JsonObject filterResponse(JsonObject cvocEntry, JsonObject readObject, S
                     logger.fine("F: " + filter.toString());
                     JsonArray params = filter.getJsonArray("params");
                     if (params == null) {
-                        params = Json.createArrayBuilder().build();
+                        params = JsonUtil.createArrayBuilder().build();
                     }
                     logger.fine("Params: " + params.toString());
                     List<Object> vals = new ArrayList<Object>();
@@ -790,7 +791,7 @@ Object processPathSegment(int index, String[] pathParts, JsonValue curPath, Stri
                         }
                     }
                 } else {
-                    JsonArrayBuilder parts = Json.createArrayBuilder();
+                    JsonArrayBuilder parts = JsonUtil.createArrayBuilder();
                     for (JsonValue subPath : arr) {
                         if (subPath instanceof JsonObject) {
                             JsonValue nextValue = ((JsonObject) subPath).get(keyVal[0]);

src/main/java/edu/harvard/iq/dataverse/DatasetPage.java

@@ -3015,7 +3015,7 @@ public String updateCurrentVersion() {
                     String status = updateVersion.getArchivalCopyLocationStatus();
                     if((status==null) || status.equals(DatasetVersion.ARCHIVAL_STATUS_FAILURE) || (JvmSettings.BAGIT_ARCHIVE_ON_VERSION_UPDATE.lookupOptional(Boolean.class).orElse(false) && archiveCommand.canDelete())){
                         // Delete the record of any existing copy since it is now out of date/incorrect
-                        JsonObjectBuilder job = Json.createObjectBuilder();
+                        JsonObjectBuilder job = JsonUtil.createObjectBuilder();
                         job.add(DatasetVersion.ARCHIVAL_STATUS, DatasetVersion.ARCHIVAL_STATUS_PENDING);
                         updateVersion.setArchivalCopyLocation(JsonUtil.prettyPrint(job.build()));
                         //Persist to db now
@@ -6126,7 +6126,7 @@ public String getCroissant() {
                     reviewsJsonObj = commandEngine.submit(new GetDatasetReviewsCommand(dvRequestService.getDataverseRequest(), dataset));
                     JsonObjectBuilder reviews = CroissantExportUtil.getReviews(reviewsJsonObj);
                     JsonObject croissantJson = JsonUtil.getJsonObject(croissant);
-                    String updatedContent = Json.createObjectBuilder(croissantJson)
+                    String updatedContent = JsonUtil.createObjectBuilder(croissantJson)
                         .add("reviews", reviews.build().getJsonArray("reviews")).build().toString();
                     return updatedContent;
                 } catch (CommandException e) {
@@ -6206,7 +6206,7 @@ public void archiveVersion(Long id, boolean force) {
                     if (status == null || (force && cmd.canDelete())) {
 
                         // Set initial pending status
-                        JsonObjectBuilder job = Json.createObjectBuilder();
+                        JsonObjectBuilder job = JsonUtil.createObjectBuilder();
                         job.add(DatasetVersion.ARCHIVAL_STATUS, DatasetVersion.ARCHIVAL_STATUS_PENDING);
                         dv.setArchivalCopyLocation(JsonUtil.prettyPrint(job.build()));
                         //Persist now