xsalefter · Sep 30, 2026 · May 21, 2026 · May 21, 2026 · May 21, 2026 · Jul 25, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -8,6 +8,11 @@ on:
 jobs:
   ci:
     uses: killbill/gh-actions-shared/.github/workflows/ci.yml@main
+    with:
+      test-profile-matrix: '[ "travis", "integration-mysql", "integration-postgresql" ]'
+    secrets:
+      CLOUDSMITH_CENTRAL_PASSWORD: ${{ secrets.CLOUDSMITH_CENTRAL_PASSWORD }}
+      CLOUDSMITH_KILLBILL_MAVEN_REPO_PASSWORD: ${{ secrets.CLOUDSMITH_KILLBILL_MAVEN_REPO_PASSWORD }}
 
   integration_test:
     uses: killbill/gh-actions-shared/.github/workflows/integration_test.yml@main
@@ -16,3 +21,6 @@ jobs:
       integration_tests_goal: 'test:plugins:analytics'
       ddl_file: 'src/main/resources/org/killbill/billing/plugin/analytics/ddl.sql'
       integration_tests_ref: 'refs/heads/master'
+    secrets:
+      CLOUDSMITH_CENTRAL_PASSWORD: ${{ secrets.CLOUDSMITH_CENTRAL_PASSWORD }}
+      CLOUDSMITH_KILLBILL_MAVEN_REPO_PASSWORD: ${{ secrets.CLOUDSMITH_KILLBILL_MAVEN_REPO_PASSWORD }}
diff --git a/.github/workflows/cloudsmith_release.yml b/.github/workflows/cloudsmith_release.yml
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -8,3 +8,6 @@ on:
 jobs:
   analyze:
     uses: killbill/gh-actions-shared/.github/workflows/codeql-analysis.yml@main
+    secrets:
+      CLOUDSMITH_CENTRAL_PASSWORD: ${{ secrets.CLOUDSMITH_CENTRAL_PASSWORD }}
+      CLOUDSMITH_KILLBILL_MAVEN_REPO_PASSWORD: ${{ secrets.CLOUDSMITH_KILLBILL_MAVEN_REPO_PASSWORD }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -12,80 +12,18 @@ on:
         required: false
         default: ''
 
-env:
-  MAVEN_FLAGS: "-B --no-transfer-progress"
-  MAVEN_OPTS: "-Xmx2G -XX:+ExitOnOutOfMemoryError -Dmaven.wagon.rto=60000 -Dmaven.wagon.httpconnectionManager.ttlSeconds=25 -Dmaven.wagon.http.retryHandler.count=3"
-
 jobs:
   release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        if: github.event.inputs.perform_version == ''
-        uses: actions/checkout@v2
-      - name: Checkout full repository
-        # Required when performing an existing release.
-        if: github.event.inputs.perform_version != ''
-        uses: actions/checkout@v2
-        with:
-          fetch-depth: '0'
-      - name: Setup git user
-        env:
-          BUILD_USER: ${{ secrets.BUILD_USER }}
-          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
-        run: |
-          git config --global user.email "contact@killbill.io"
-          git config --global user.name "Kill Bill core team"
-          git config --global url."https://${BUILD_USER}:${BUILD_TOKEN}@github.com/".insteadOf "git@github.com:"
-      - name: Configure Java
-        uses: actions/setup-java@v1
-        with:
-          java-version: 11
-      - name: Download Java dependencies
-        # We do as much as we can, but it may not be enough (https://issues.apache.org/jira/browse/MDEP-82)
-        run: |
-          mvn ${MAVEN_FLAGS} clean install dependency:resolve dependency:resolve-plugins -DskipTests=true -Dgpg.skip=true -Psonatype-oss-release
-      - name: Update killbill-oss-parent
-        if: github.event.inputs.parent_version != ''
-        run: |
-          echo "Updating killbill-oss-parent pom.xml to ${{ github.event.inputs.parent_version }}:"
-          mvn ${MAVEN_FLAGS} versions:update-parent -DgenerateBackupPoms=false -DparentVersion="[${{ github.event.inputs.parent_version }}]"
-          echo "killbill-oss-parent pom.xml changes:"
-          git --no-pager diff
-          echo "Downloading new dependencies:"
-          mvn ${MAVEN_FLAGS} -U clean install -DskipTests=true
-
-          git add pom.xml
-          # Will be pushed as part of the release process, only if the release is successful
-          git commit -m "pom.xml: update killbill-oss-parent to ${{ github.event.inputs.parent_version }}"
-      - name: Configure settings.xml for release
-        uses: actions/setup-java@v3
-        with:
-          java-version: 11
-          distribution: temurin
-          server-id: central
-          server-username: MAVEN_USERNAME
-          server-password: MAVEN_PASSWORD
-          gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }}
-          gpg-passphrase: GPG_PASSPHRASE
-      - name: Release artifacts
-        if: github.event.inputs.perform_version == ''
-        env:
-          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-        # It will still check the remote but hopefully not download much (0 B at 0 B/s). -o isn't safe because of MDEP-82 (see above).
-        run: |
-          mvn ${MAVEN_FLAGS} release:clean release:prepare release:perform
-      - name: Perform release
-        if: github.event.inputs.perform_version != ''
-        env:
-          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-        # It will still check the remote but hopefully not download much (0 B at 0 B/s). -o isn't safe because of MDEP-82 (see above).
-        # See https://issues.apache.org/jira/browse/SCM-729 for why the release.properties file is required.
-        run: |
-          echo "scm.url=scm\:git\:git@github.com\:${GITHUB_REPOSITORY}.git" > release.properties
-          echo "scm.tag=${{ github.event.inputs.perform_version }}" >> release.properties
-          mvn ${MAVEN_FLAGS} release:perform
+    uses: killbill/gh-actions-shared/.github/workflows/release.yml@main
+    with:
+      parent_version: ${{ github.event.inputs.parent_version }}
+      perform_version: ${{ github.event.inputs.perform_version }}
+    secrets:
+      BUILD_USER: ${{ secrets.BUILD_USER }}
+      BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
+      CLOUDSMITH_CENTRAL_PASSWORD: ${{ secrets.CLOUDSMITH_CENTRAL_PASSWORD }}
+      CLOUDSMITH_KILLBILL_MAVEN_REPO_PASSWORD: ${{ secrets.CLOUDSMITH_KILLBILL_MAVEN_REPO_PASSWORD }}
+      CLOUDSMITH_DISTRIBUTION_MAN_USERNAME: ${{ secrets.CLOUDSMITH_DISTRIBUTION_MAN_USERNAME }}
+      CLOUDSMITH_DISTRIBUTION_MAN_PASSWORD: ${{ secrets.CLOUDSMITH_DISTRIBUTION_MAN_PASSWORD }}
+      GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
+      GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml
@@ -0,0 +1,14 @@
+name: snapshot
+
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  snapshot:
+    uses: killbill/gh-actions-shared/.github/workflows/snapshot.yml@main
+    secrets:
+      CLOUDSMITH_CENTRAL_PASSWORD: ${{ secrets.CLOUDSMITH_CENTRAL_PASSWORD }}
+      CLOUDSMITH_KILLBILL_MAVEN_REPO_PASSWORD: ${{ secrets.CLOUDSMITH_KILLBILL_MAVEN_REPO_PASSWORD }}
+      CLOUDSMITH_DISTRIBUTION_MAN_USERNAME: ${{ secrets.CLOUDSMITH_DISTRIBUTION_MAN_USERNAME }}
+      CLOUDSMITH_DISTRIBUTION_MAN_PASSWORD: ${{ secrets.CLOUDSMITH_DISTRIBUTION_MAN_PASSWORD }}
diff --git a/README.md b/README.md
@@ -16,12 +16,14 @@ Kill Bill plugin to provide business analytics and reporting capabilities. You c
 |          7.1.y |            0.22.z |
 |          7.2.y |            0.22.z |
 |          8.0.y |            0.24.z |
+|          9.0.y |            0.26.z |
 
 ### Release notes
 
 * Starting with `7.2.0`, the configuration is using a YAML format, instead of key-value pairs.
 * We've upgraded numerous dependencies in `7.1.x` (required for Java 11 support).
 * Version `8.1.0` of the plugin includes a DDL change. So, upgrading to this version requires running [this](https://github.com/killbill/killbill-analytics-plugin/blob/63c968f46001c7662d46464e608304c5bcd003bc/src/main/resources/migration/V20230712110325__rename_value_to_field_value_in_all_tables.sql) migration.
+* Version `9.0.x` mark of removal Java EE `javax` namespace and one need to use jakarta namespace instead. 
 
 ## Requirements
 

diff --git a/docker/docker-compose.ci.mysql.yml b/docker/docker-compose.ci.mysql.yml
@@ -20,7 +20,7 @@ version: '3.8'
 services:
   killbill:
     network_mode: host
-    image: killbill/killbill:0.24.0
+    image: xsalefter/killbill:0.25.4
     environment:
       - KILLBILL_CATALOG_URI=SpyCarAdvanced.xml
       - KILLBILL_DAO_URL=jdbc:mysql://127.0.0.1:3306/killbill

diff --git a/docker/docker-compose.ci.postgresql.yml b/docker/docker-compose.ci.postgresql.yml
@@ -20,7 +20,7 @@ version: '3.8'
 services:
   killbill:
     network_mode: host
-    image: killbill/killbill:0.24.0
+    image: xsalefter/killbill:0.25.4
     environment:
       - KILLBILL_CATALOG_URI=SpyCarAdvanced.xml
       - KILLBILL_DAO_URL=jdbc:postgresql://127.0.0.1:5432/killbill

diff --git a/pom.xml b/pom.xml
@@ -22,11 +22,11 @@
     <parent>
         <groupId>org.kill-bill.billing</groupId>
         <artifactId>killbill-oss-parent</artifactId>
-        <version>0.146.63</version>
+        <version>0.147.30</version>
     </parent>
     <groupId>org.kill-bill.billing.plugin.java</groupId>
     <artifactId>analytics-plugin</artifactId>
-    <version>8.1.5-SNAPSHOT</version>
+    <version>9.0.0-SNAPSHOT</version>
     <packaging>bundle</packaging>
     <name>Kill Bill OSGI Analytics bundle</name>
     <description>Kill Bill Analytics plugin</description>
@@ -42,20 +42,13 @@
         <url>https://github.com/killbill/killbill-analytics-plugin/issues</url>
     </issueManagement>
     <properties>
-        <check.fail-spotbugs>false</check.fail-spotbugs>
+        <check.fail-spotbugs>true</check.fail-spotbugs>
         <check.spotbugs-exclude-filter-file>spotbugs-exclude.xml</check.spotbugs-exclude-filter-file>
         <maven.javadoc.failOnError>false</maven.javadoc.failOnError>
         <osgi.private>org.killbill.billing.plugin.analytics.*</osgi.private>
+        <!-- Match 2 things: Repo name in both github.com/killbill and Cloudsmith -->
+        <repository.cloudsmith.repo>killbill-analytics-plugin</repository.cloudsmith.repo>
     </properties>
-    <dependencyManagement>
-        <dependencies>
-            <dependency>
-                <groupId>org.reactivestreams</groupId>
-                <artifactId>reactive-streams</artifactId>
-                <version>1.0.3</version>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
     <dependencies>
         <dependency>
             <groupId>com.bpodgursky</groupId>
@@ -86,10 +79,6 @@
             <groupId>com.github.spotbugs</groupId>
             <artifactId>spotbugs-annotations</artifactId>
         </dependency>
-        <dependency>
-            <groupId>com.google.code.findbugs</groupId>
-            <artifactId>jsr305</artifactId>
-        </dependency>
         <dependency>
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
@@ -114,15 +103,19 @@
             <artifactId>embedded-postgres</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>jakarta.annotation</groupId>
+            <artifactId>jakarta.annotation-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>jakarta.inject</groupId>
+            <artifactId>jakarta.inject-api</artifactId>
+        </dependency>
         <dependency>
             <groupId>jakarta.servlet</groupId>
             <artifactId>jakarta.servlet-api</artifactId>
             <scope>provided</scope>
         </dependency>
-        <dependency>
-            <groupId>javax.inject</groupId>
-            <artifactId>javax.inject</artifactId>
-        </dependency>
         <dependency>
             <groupId>joda-time</groupId>
             <artifactId>joda-time</artifactId>
@@ -158,10 +151,6 @@
             <artifactId>log4jdbc-log4j2-jdbc4</artifactId>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>org.jooby</groupId>
-            <artifactId>jooby</artifactId>
-        </dependency>
         <dependency>
             <groupId>org.jooq</groupId>
             <artifactId>jooq</artifactId>
@@ -201,12 +190,24 @@
         <dependency>
             <groupId>org.kill-bill.billing.plugin.java</groupId>
             <artifactId>killbill-base-plugin</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.kill-bill.commons</groupId>
+                    <artifactId>killbill-jooby</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.kill-bill.billing.plugin.java</groupId>
             <artifactId>killbill-base-plugin</artifactId>
             <type>test-jar</type>
             <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.kill-bill.commons</groupId>
+                    <artifactId>killbill-jooby</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.kill-bill.commons</groupId>
@@ -245,6 +246,10 @@
             <groupId>org.kill-bill.commons</groupId>
             <artifactId>killbill-jdbi</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.kill-bill.commons</groupId>
+            <artifactId>killbill-jooby</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.kill-bill.commons</groupId>
             <artifactId>killbill-locker</artifactId>

diff --git a/spotbugs-exclude.xml b/spotbugs-exclude.xml
@@ -25,4 +25,85 @@
             <Class name="org.killbill.billing.plugin.analytics.reports.KillBillArithmeticExprParser"/>
         </Or>
     </Match>
+
+    <!-- justification: this whole plugin's DTOs/DAOs (BusinessXXX, XXXModelDao, json.*) are plain data holders whose
+         getters/setters/constructors intentionally return or store their Collection/Map/DateTime fields directly
+         (no defensive copies), matching the same convention already excluded repo-wide in killbill/spotbugs-exclude.xml. -->
+    <Match>
+        <Class name="~org\.killbill\.billing\.plugin\.analytics\..*"/>
+        <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
+    </Match>
+
+    <!-- justification: ObjectMapperProvider is a static utility exposing shared, intentionally mutable
+         Jackson ObjectMapper/ObjectWriter singletons; this is the same accessor-exposure pattern as
+         EI_EXPOSE_REP above, just flagged under the static-field variant of the bug. -->
+    <Match>
+        <Class name="org.killbill.billing.plugin.analytics.http.ObjectMapperProvider"/>
+        <Bug pattern="MS_EXPOSE_REP"/>
+    </Match>
+
+    <!-- justification: constructors below eagerly wire notification queues / JDBI-jOOQ metadata / parse
+         configuration and should fail fast during plugin startup if that eager initialization fails,
+         rather than defer the error. Same accepted pattern as killbill/spotbugs-exclude.xml. -->
+    <Match>
+        <Class name="org.killbill.billing.plugin.analytics.AnalyticsListener"/>
+        <Method name="&lt;init&gt;"/>
+        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+    </Match>
+    <Match>
+        <Class name="org.killbill.billing.plugin.analytics.api.core.AnalyticsConfiguration"/>
+        <Method name="&lt;init&gt;"/>
+        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+    </Match>
+    <Match>
+        <Class name="org.killbill.billing.plugin.analytics.dao.factory.BusinessContextFactory"/>
+        <Method name="&lt;init&gt;"/>
+        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+    </Match>
+    <Match>
+        <Class name="org.killbill.billing.plugin.analytics.reports.ReportsUserApi"/>
+        <Method name="&lt;init&gt;"/>
+        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+    </Match>
+    <Match>
+        <Class name="org.killbill.billing.plugin.analytics.reports.SqlReportDataExtractor"/>
+        <Method name="&lt;init&gt;"/>
+        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+    </Match>
+    <Match>
+        <Class name="org.killbill.billing.plugin.analytics.reports.scheduler.JobsScheduler"/>
+        <Method name="&lt;init&gt;"/>
+        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+    </Match>
+    <Match>
+        <Class name="org.killbill.billing.plugin.analytics.reports.sql.Metadata"/>
+        <Method name="&lt;init&gt;"/>
+        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+    </Match>
+
+    <!-- justification: org.jooq.Parser#parseQuery(String) never returns null (it throws ParserException on
+         failure); SpotBugs' interface-dispatch nullness inference cannot see that contract and flags a false
+         positive null dereference on the returned Query in these two call sites. -->
+    <Match>
+        <Class name="org.killbill.billing.plugin.analytics.reports.SqlReportDataExtractor"/>
+        <Method name="&lt;init&gt;"/>
+        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
+    </Match>
+    <Match>
+        <Class name="org.killbill.billing.plugin.analytics.reports.sql.Metadata"/>
+        <Method name="getTemplateVariables"/>
+        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
+    </Match>
+
+    <!-- justification: org.jooq.SelectConditionStep#and(Condition) is annotated @CheckReturnValue, but its
+         concrete implementation (org.jooq.impl.SelectImpl#and, jooq-3.14.16 sources) mutates the shared
+         underlying SelectQueryImpl in place and returns "this" rather than a new step. "statement" here is
+         that same mutable instance, so the call at SqlReportDataExtractor.java:149 already applies the
+         tenant_record_id condition to it even though the (identical) return value is not reassigned.
+         SpotBugs cannot see this same-instance mutation semantics from the annotation alone. -->
+    <Match>
+        <Class name="org.killbill.billing.plugin.analytics.reports.SqlReportDataExtractor"/>
+        <Method name="toString"/>
+        <Bug pattern="RV_RETURN_VALUE_IGNORED"/>
+    </Match>
 </FindBugsFilter>