From 088bcf340437d337ffc169567f6bdfaad3a6d2d6 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 15 Sep 2025 14:54:51 +0200 Subject: [PATCH 001/150] Add PMD 7.16 Rules --- .config/pmd/java/ruleset.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 267fa5e..5d76b2b 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -153,6 +153,8 @@ + + From 108486865e6442363bbcaff9b394ba5b36a2d63f Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 15 Sep 2025 15:03:03 +0200 Subject: [PATCH 002/150] PMD: Import and modify rules from `jPinpoint` See https://github.com/jborgers/PMD-jPinpoint-rules --- .config/pmd/java/ruleset.xml | 824 ++++++++++++++++++++++++++++++++++- 1 file changed, 818 insertions(+), 6 deletions(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 5d76b2b..28bc272 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -11,7 +11,6 @@ - @@ -199,6 +198,33 @@ + + + + Usually all cases where `StringBuilder` (or the outdated `StringBuffer`) is used are either due to confusing (legacy) logic or may be replaced by a simpler string concatenation. + + Solution: + * Do not use `StringBuffer` because it's thread-safe and usually this is not needed + * If `StringBuilder` is only used in a simple method (like `toString`) and is effectively inlined: Use a simpler string concatenation (`"a" + x + "b"`). This will be optimized by the Java compiler internally. + * In all other cases: + * Check what is happening and if it makes ANY sense! If for example a CSV file is built here consider using a proper library instead! + * Abstract the Strings into a DTO, join them together using a collection (or `StringJoiner`) or use Java's Streaming API instead + + 3 + + + + + + + + + - @@ -236,7 +262,7 @@ - @@ -257,7 +283,7 @@ - @@ -279,7 +305,7 @@ - @@ -303,7 +329,7 @@ - @@ -311,4 +337,790 @@ + + + + + + Do not use native HTML! Use Vaadin layouts and components to create required structure. + If you are 100% sure that you escaped the value properly and you have no better options you can suppress this. + + 2 + + + + + + + + + + + + + + + + java.text.NumberFormat: DecimalFormat and ChoiceFormat are thread-unsafe. + + Solution: Create a new local one when needed in a method. + + 1 + + + + + + + + + + + + + + + A regular expression is compiled implicitly on every invocation. + Problem: This can be (CPU) expensive, depending on the length of the regular expression. + + Solution: Compile the regex pattern only once and assign it to a private static final Pattern field. + java.util.Pattern objects are thread-safe, so they can be shared among threads. + + 2 + + + + 5 and +(matches(@Image, '[\.\$\|\(\)\[\]\{\}\^\?\*\+\\]+'))) +or +self::VariableAccess and @Name=ancestor::ClassBody[1]/FieldDeclaration/VariableDeclarator[StringLiteral[string-length(@Image) > 5 and +(matches(@Image, '[\.\$\|\(\)\[\]\{\}\^\?\*\+\\]+'))] or not(StringLiteral)]/VariableId/@Name] +]]> + + + + + + + + + + + + The default constructor of ByteArrayOutputStream creates a 32 bytes initial capacity and for StringWriter 16 chars. + Such a small buffer as capacity usually needs several expensive expansions. + + Solution: Explicitly declared the buffer size so that an expansion is not needed in most cases. + Typically much larger than 32, e.g. 4096. + + 2 + + + + + + + + + + + + + + + The time to find element is O(n); n = the number of enum values. + This identical processing is executed for every call. + Considered problematic when `n > 3`. + + Solution: Use a static field-to-enum-value Map. Access time is O(1), provided the hashCode is well-defined. + Implement a fromString method to provide the reverse conversion by using the map. + + 3 + + + + 3]//MethodDeclaration/Block + //MethodCall[pmd-java:matchesSig('java.util.stream.Stream#findFirst()') or pmd-java:matchesSig('java.util.stream.Stream#findAny()')] + [//MethodCall[pmd-java:matchesSig('java.util.stream.Stream#of(_)') or pmd-java:matchesSig('java.util.Arrays#stream(_)')] + [ArgumentList/MethodCall[pmd-java:matchesSig('_#values()')]]] +]]> + + + + + fromString(String name) { + return Stream.of(values()).filter(v -> v.toString().equals(name)).findAny(); // bad: iterates for every call, O(n) access time + } +} + +Usage: `Fruit f = Fruit.fromString("banana");` + +// GOOD +public enum Fruit { + APPLE("apple"), + ORANGE("orange"), + BANANA("banana"), + KIWI("kiwi"); + + private static final Map nameToValue = + Stream.of(values()).collect(toMap(Object::toString, v -> v)); + private final String name; + + Fruit(String name) { this.name = name; } + @Override public String toString() { return name; } + public static Optional fromString(String name) { + return Optional.ofNullable(nameToValue.get(name)); // good, get from Map, O(1) access time + } +} +]]> + + + + + + A regular expression is compiled on every invocation. + Problem: this can be expensive, depending on the length of the regular expression. + + Solution: Usually a pattern is a literal, not dynamic and can be compiled only once. Assign it to a private static field. + java.util.Pattern objects are thread-safe so they can be shared among threads. + + 2 + + + + + + + + + + + + + + + + Recreating a DateTimeFormatter is relatively expensive. + + Solution: Java 8+ java.time.DateTimeFormatter is thread-safe and can be shared among threads. + Create the formatter from a pattern only once, to initialize a static final field. + + 2 + + + + + + + + + + + + Creating a security provider is expensive because of loading of algorithms and other classes. + Additionally, it uses synchronized which leads to lock contention when used with multiple threads. + + Solution: This only needs to happen once in the JVM lifetime, because once loaded the provider is typically available from the Security class. + Create the security provider only once: Only in case when it's not yet available from the Security class. + + 2 + + + + + + + + + + + + + + + Reflection is relatively expensive. + + Solution: Avoid reflection. Use the non-reflective, explicit way like generation by IDE. + + 2 + + + + + + + + + + + + + + + java.util.SimpleDateFormat is thread-unsafe. + The usual solution is to create a new one when needed in a method. + Creating SimpleDateFormat is relatively expensive. + + Solution: Use java.time.DateTimeFormatter. These classes are immutable, thus thread-safe and can be made static. + + 2 + + + + + + + + + + + + + + + Creating Comparator instances repeatedly in methods like compareTo or sort calls is inefficient. + + Solution: Initialize the Comparator once as a static final field and reuse. + + 2 + + + + + + + + + { + @Override + public int compareTo(@NotNull Person o) { + return Comparator.comparing(Person::getFirstName) // Bad: Creates new Comparator instance on each invocation + .thenComparing(Person::getLastName) + .thenComparingInt(Person::getAge) + .compare(this, o); + } +} + +public class GoodPerson implements Comparable { + private static final Comparator COMPARE_FIRST_LAST_NAME_AGE = + Comparator.comparing(Person::getFirstName) + .thenComparing(Person::getLastName) + .thenComparingInt(Person::getAge); + + @Override + public int compareTo(@NotNull Person o) { + return COMPARE_FIRST_LAST_NAME_AGE.compare(this, o); // Good: Comparator initialized once as static final field + } +} +]]> + + + + + + Blocking calls, for instance remote calls, may exhaust the common pool for some time thereby blocking all other use of the common pool. + In addition, nested use of the common pool can lead to deadlock. Do not use the common pool for blocking calls. + The parallelStream() call uses the common pool. + + Solution: Use a dedicated thread pool with enough threads to get proper parallelism. + The number of threads in the common pool is equal to the number of CPUs and meant to utilize all of them. + It assumes CPU-intensive non-blocking processing of in-memory data. + + 2 + + + + + + + + + list = new ArrayList(); + final ForkJoinPool myFjPool = new ForkJoinPool(10); + final ExecutorService myExePool = Executors.newFixedThreadPool(10); + + void bad1() { + list.parallelStream().forEach(elem -> storeDataRemoteCall(elem)); // bad + } + + void good1() { + CompletableFuture[] futures = list.stream().map(elem -> CompletableFuture.supplyAsync(() -> storeDataRemoteCall(elem), myExePool)) + .toArray(CompletableFuture[]::new); + CompletableFuture.allOf(futures).get(10, TimeUnit.MILLISECONDS)); + } + + void good2() throws ExecutionException, InterruptedException { + myFjPool.submit(() -> + list.parallelStream().forEach(elem -> storeDataRemoteCall(elem)) + ).get(); + } + + String storeDataRemoteCall(String elem) { + // do remote call, blocking. We don't use the returned value. + RestTemplate tmpl; + return ""; + } +} +]]> + + + + + + Future.supplyAsync is typically used for remote calls. By default, it uses the common pool. + The number of threads in the common pool is equal to the number of CPU's, which is suitable for in-memory processing. + For I/O, however, this number is typically not suitable because most time is spent waiting for the response and not in CPU. + The common pool must not be used for blocking calls. + + Solution: A separate, properly sized, pool of threads (an Executor) should be used for the async calls. + + 2 + + + + + + + + +>[] futures = accounts.stream() + .map(account -> CompletableFuture.supplyAsync(() -> isAccountBlocked(account))) // bad + .toArray(CompletableFuture[]::new); + } + + void good() { + CompletableFuture>[] futures = accounts.stream() + .map(account -> CompletableFuture.supplyAsync(() -> isAccountBlocked(account), asyncPool)) // good + .toArray(CompletableFuture[]::new); + } +} +]]> + + + + + + `take()` stalls indefinitely in case of hanging threads and consumes a thread. + + Solution: use `poll()` with a timeout value and handle the timeout. + + 2 + + + + + + + + + void collectAllCollectionReplyFromThreads(CompletionService> completionService) { + try { + Future> futureLocal = completionService.take(); // bad + Future> futuresGood = completionService.poll(3, TimeUnit.SECONDS); // good + responseCollector.addAll(futuresGood.get(10, TimeUnit.SECONDS)); // good + } catch (InterruptedException | ExecutionException e) { + LOGGER.error("Error in Thread : {}", e); + } catch (TimeoutException e) { + LOGGER.error("Timeout in Thread : {}", e); + } +} +]]> + + + + + + Stalls indefinitely in case of stalled Callable(s) and consumes threads. + + Solution: Provide a timeout to the invokeAll/invokeAny method and handle the timeout. + + 2 + + + + + + + + +> executeTasksBad(Collection> tasks, ExecutorService executor) throws Exception { + return executor.invokeAll(tasks); // bad, no timeout + } + private List> executeTasksGood(Collection> tasks, ExecutorService executor) throws Exception { + return executor.invokeAll(tasks, OUR_TIMEOUT_IN_MILLIS, TimeUnit.MILLISECONDS); // good + } +} +]]> + + + + + + Stalls indefinitely in case of hanging threads and consumes a thread. + + Solution: Provide a timeout value and handle the timeout. + + 2 + + + + + + + + + complFuture) throws Exception { + return complFuture.get(); // bad +} + +public static String good(CompletableFuture complFuture) throws Exception { + return complFuture.get(10, TimeUnit.SECONDS); // good +} +]]> + + + + + + + Apache HttpClient with its connection pool and timeouts should be setup once and then used for many requests. + It is quite expensive to create and can only provide the benefits of pooling when reused in all requests for that connection. + + Solution: Create/build HttpClient with proper connection pooling and timeouts once, and then use it for requests. + + 3 + + + + + + + + + connectBad(Object req) { + HttpEntity requestEntity = new HttpEntity<>(req); + + HttpClient httpClient = HttpClientBuilder.create().setMaxConnPerRoute(10).build(); // bad + return remoteCall(httpClient, requestEntity); + } +} +]]> + + + + + + Problem: Gson creation is relatively expensive. A JMH benchmark shows a 24x improvement reusing one instance. + + Solution: Since Gson objects are thread-safe after creation, they can be shared between threads. + So reuse created instances from a static field. + Pay attention to use thread-safe (custom) adapters and serializers. + + 3 + + + + + + + + + + + From deddd914be12567ecf33146f9a2f7acb0c10fa0a Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 16 Sep 2025 14:36:18 +0200 Subject: [PATCH 003/150] PMD: Exclude unused rule --- .config/pmd/java/ruleset.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 28bc272..517b924 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -185,6 +185,9 @@ + + + From 53b1e5dfd3fc70d91302cfb4fef2dd48b1b65ccb Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 16 Sep 2025 14:36:48 +0200 Subject: [PATCH 004/150] PMD: Reword and also apply to runAsync --- .config/pmd/java/ruleset.xml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 517b924..cda412b 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -841,6 +841,8 @@ public class GoodPerson implements Comparable { Solution: Use a dedicated thread pool with enough threads to get proper parallelism. The number of threads in the common pool is equal to the number of CPUs and meant to utilize all of them. It assumes CPU-intensive non-blocking processing of in-memory data. + + See also: [_Be Aware of ForkJoinPool#commonPool()_](https://dzone.com/articles/be-aware-of-forkjoinpoolcommonpool) 2 @@ -897,22 +899,25 @@ public class Foo { - Future.supplyAsync is typically used for remote calls. By default, it uses the common pool. + CompletableFuture.supplyAsync/runAsync is typically used for remote calls. + By default it uses the common pool. The number of threads in the common pool is equal to the number of CPU's, which is suitable for in-memory processing. For I/O, however, this number is typically not suitable because most time is spent waiting for the response and not in CPU. The common pool must not be used for blocking calls. - Solution: A separate, properly sized, pool of threads (an Executor) should be used for the async calls. + Solution: A separate, properly sized pool of threads (an Executor) should be used for the async calls. + + See also: [_Be Aware of ForkJoinPool#commonPool()_](https://dzone.com/articles/be-aware-of-forkjoinpoolcommonpool) 2 From e6358ed1fa1e6c743e9a7b055a55862beacb8677 Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 16 Sep 2025 14:36:56 +0200 Subject: [PATCH 005/150] PMD: Fix error --- .config/pmd/java/ruleset.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index cda412b..bb8177f 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -1066,7 +1066,7 @@ public static String good(CompletableFuture complFuture) throws Exceptio //MethodDeclaration//MethodCall[ pmd-java:matchesSig('org.apache.hc.client5.http.impl.classic.HttpClientBuilder#create()') or pmd-java:matchesSig('org.apache.hc.client5.http.impl.classic.HttpClients#custom()') - or pmd-java:matchesSig('org.apache.hc.client5.http.impl.async.HttpAsyncClientBuilder#build()' + or pmd-java:matchesSig('org.apache.hc.client5.http.impl.async.HttpAsyncClientBuilder#build()') ] [ancestor::MethodDeclaration//ClassType[pmd-java:typeIs('org.springframework.http.HttpEntity') or pmd-java:typeIs('org.springframework.http.ResponseEntity')] From 042b7a495804644325788e8d174aa2d02622da85 Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 16 Sep 2025 14:37:10 +0200 Subject: [PATCH 006/150] PMD: Remove rule as it yields too many FP --- .config/pmd/java/ruleset.xml | 63 ------------------------------------ 1 file changed, 63 deletions(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index bb8177f..a5b7634 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -766,69 +766,6 @@ public class Foo { - - - Creating Comparator instances repeatedly in methods like compareTo or sort calls is inefficient. - - Solution: Initialize the Comparator once as a static final field and reuse. - - 2 - - - - - - - - - { - @Override - public int compareTo(@NotNull Person o) { - return Comparator.comparing(Person::getFirstName) // Bad: Creates new Comparator instance on each invocation - .thenComparing(Person::getLastName) - .thenComparingInt(Person::getAge) - .compare(this, o); - } -} - -public class GoodPerson implements Comparable { - private static final Comparator COMPARE_FIRST_LAST_NAME_AGE = - Comparator.comparing(Person::getFirstName) - .thenComparing(Person::getLastName) - .thenComparingInt(Person::getAge); - - @Override - public int compareTo(@NotNull Person o) { - return COMPARE_FIRST_LAST_NAME_AGE.compare(this, o); // Good: Comparator initialized once as static final field - } -} -]]> - - - Date: Wed, 17 Sep 2025 10:32:54 +0200 Subject: [PATCH 007/150] PMF: Cleanup and format --- .config/pmd/java/ruleset.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index a5b7634..748c826 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -448,7 +448,7 @@ String good_replaceInnerLineBreakBySpace() { - + + 3 @@ -565,7 +565,7 @@ public enum Fruit { Solution: Usually a pattern is a literal, not dynamic and can be compiled only once. Assign it to a private static field. java.util.Pattern objects are thread-safe so they can be shared among threads. - + 2 From 6ded547ddabc89b813a3b6cbd1680f6fa176d160 Mon Sep 17 00:00:00 2001 From: AB Date: Fri, 19 Sep 2025 08:59:52 +0200 Subject: [PATCH 008/150] Update CHANGELOG.md --- CHANGELOG.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 44fb09c..687f5e5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,10 +1,9 @@ -# 2.2.2 -* Re-Release due to Sonatype/Maven Central incorrectly claiming that the previous release is incorrectly signed #153 - -# 2.2.1 +# 2.2.3 * Re-Release due to Sonatype/Maven Central incorrectly claiming that the previous release is incorrectly signed #153 # 2.2.0 +_Not available due to validation error on Sonatype/Maven Central preventing publishing.
_ +_The problem was resolved in `2.2.3`_ * Added `computeIfAbsent` * Improved logging performance * Scheduler: Try to remove tasks immediately when cancelled to prevent unbound retention of cancelled tasks From 7bcc1bd25b867131f2190e8e86d41f90aa8ada2a Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 21 Sep 2025 04:13:51 +0000 Subject: [PATCH 009/150] Update dependency org.apache.maven.plugins:maven-javadoc-plugin to v3.12.0 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 7380883..89d4aa7 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -108,7 +108,7 @@ org.apache.maven.plugins maven-javadoc-plugin - 3.11.3 + 3.12.0 attach-javadocs From e0867d36ce22ad168d47ea3c6dd59dfae4db74b4 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 22 Sep 2025 04:19:37 +0000 Subject: [PATCH 010/150] Update dependency org.apache.maven.plugins:maven-compiler-plugin to v3.14.1 --- template-placeholder-demo/pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/template-placeholder-demo/pom.xml b/template-placeholder-demo/pom.xml index 3702222..b6ff1fd 100644 --- a/template-placeholder-demo/pom.xml +++ b/template-placeholder-demo/pom.xml @@ -44,7 +44,7 @@ org.apache.maven.plugins maven-compiler-plugin - 3.14.0 + 3.14.1 ${maven.compiler.release} diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 7380883..f67b505 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -97,7 +97,7 @@ org.apache.maven.plugins maven-compiler-plugin - 3.14.0 + 3.14.1 ${maven.compiler.release} From 184b908f235cf93fade385838d806417c1ee6564 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 22 Sep 2025 04:19:40 +0000 Subject: [PATCH 011/150] Update dependency org.codehaus.mojo:flatten-maven-plugin to v1.7.3 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 7380883..e356a34 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -147,7 +147,7 @@ org.codehaus.mojo flatten-maven-plugin - 1.7.2 + 1.7.3 ossrh From 0e8aefd14b6e396990ff21fcdd9d0bc0fe7e25b3 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 24 Sep 2025 04:13:23 +0000 Subject: [PATCH 012/150] Update dependency org.sonatype.central:central-publishing-maven-plugin to v0.9.0 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 27a24c8..4c4214c 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -193,7 +193,7 @@ org.sonatype.central central-publishing-maven-plugin - 0.8.0 + 0.9.0 true sonatype-central-portal From f08c6622dbeb98cc1db48a845335020e361b2814 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 29 Sep 2025 04:14:48 +0000 Subject: [PATCH 013/150] Update dependency com.puppycrawl.tools:checkstyle to v11.1.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index f824869..61578c0 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 11.0.1 + 11.1.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 4c4214c..3d8cc2c 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 11.0.1 + 11.1.0 From 6278740ec8418dbe1933b70fbab9c3cf7c3f59e7 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 29 Sep 2025 13:42:00 +0200 Subject: [PATCH 014/150] Fix broken-links not finding issues on GH CLI v2.79+ Fix https://github.com/xdev-software/base-template/issues/8 --- .github/workflows/broken-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index 9493fb8..436ce50 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -25,7 +25,7 @@ jobs: - name: Find already existing issue id: find-issue run: | - echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title \"Link Checker Report\"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT + echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title "Link Checker Report"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT env: GH_TOKEN: ${{ github.token }} From 39c4703001cf7da323fb6b809f1ab733284a536d Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 30 Sep 2025 09:52:34 +0200 Subject: [PATCH 015/150] Test compile with Java 25 & Update docs --- .github/workflows/check-build.yml | 2 +- CONTRIBUTING.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index 01f0840..e975764 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -28,7 +28,7 @@ jobs: timeout-minutes: 30 strategy: matrix: - java: [17, 21] + java: [17, 21, 25] distribution: [temurin] steps: - uses: actions/checkout@v5 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index be2a186..2c7b025 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -19,7 +19,7 @@ We also encourage you to read the [contribution instructions by GitHub](https:// ### Software Requirements You should have the following things installed: * Git -* Java 21 - should be as unmodified as possible (Recommended: [Eclipse Adoptium](https://adoptium.net/temurin/releases/)) +* Java 25 - should be as unmodified as possible (Recommended: [Eclipse Adoptium](https://adoptium.net/temurin/releases/)) * Maven (Note that the [Maven Wrapper](https://maven.apache.org/wrapper/) is shipped with the repo) ### Recommended setup From f71bf683b682ca9d985ee02a13b157676e21cd9f Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 2 Oct 2025 04:10:53 +0000 Subject: [PATCH 016/150] Update peter-evans/create-issue-from-file action to v6 --- .github/workflows/broken-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index 436ce50..a99ae52 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -37,7 +37,7 @@ jobs: - name: Create Issue From File if: steps.lychee.outputs.exit_code != 0 - uses: peter-evans/create-issue-from-file@e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd # v5 + uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6 with: issue-number: ${{ steps.find-issue.outputs.number }} title: Link Checker Report From 046de3916a42b79a547d1a8281de2bc875e9091c Mon Sep 17 00:00:00 2001 From: AB Date: Thu, 2 Oct 2025 10:47:35 +0200 Subject: [PATCH 017/150] Update PMD scheme location --- .config/pmd/java/ruleset.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 748c826..6bf58b3 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -2,7 +2,7 @@ + xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 https://pmd.github.io/ruleset_2_0_0.xsd"> This ruleset checks the code for discouraged programming constructs. From d3806058ec9caf0870392740f549fd59e9b5bf79 Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 7 Oct 2025 14:54:43 +0200 Subject: [PATCH 018/150] Fix typo --- .config/pmd/java/ruleset.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 6bf58b3..4570323 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -204,7 +204,7 @@ Usually all cases where `StringBuilder` (or the outdated `StringBuffer`) is used are either due to confusing (legacy) logic or may be replaced by a simpler string concatenation. From 8f9a9e93d10ff85371763eff7f3e67fe365d07f2 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 9 Oct 2025 10:47:05 +0000 Subject: [PATCH 019/150] Update dependency org.junit.jupiter:junit-jupiter-api to v6 --- expiring-limited-cache/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/expiring-limited-cache/pom.xml b/expiring-limited-cache/pom.xml index c906a02..77451f0 100644 --- a/expiring-limited-cache/pom.xml +++ b/expiring-limited-cache/pom.xml @@ -64,7 +64,7 @@ org.junit.jupiter junit-jupiter-api - 5.13.4 + 6.0.0 test From 43afe18c3740032f26c42d71679824e0fa485f5a Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 10 Oct 2025 04:14:02 +0000 Subject: [PATCH 020/150] Update dependency com.puppycrawl.tools:checkstyle to v12 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 61578c0..14c3d10 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 11.1.0 + 12.0.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 3d8cc2c..ea07c2f 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 11.1.0 + 12.0.0 From 042d657901a3455ab272d3e5342616f958e93ce5 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 11 Oct 2025 04:14:27 +0000 Subject: [PATCH 021/150] Update dependency org.apache.maven.plugins:maven-pmd-plugin to v3.28.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 14c3d10..7236c13 100644 --- a/pom.xml +++ b/pom.xml @@ -70,7 +70,7 @@ org.apache.maven.plugins maven-pmd-plugin - 3.27.0 + 3.28.0 true true diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index ea07c2f..74cf0ee 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -240,7 +240,7 @@ org.apache.maven.plugins maven-pmd-plugin - 3.27.0 + 3.28.0 true true From d4bea48af9898d69073377a80fe6289ad4a2fc39 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 12 Oct 2025 04:13:47 +0000 Subject: [PATCH 022/150] Update dependency com.puppycrawl.tools:checkstyle to v12.0.1 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 14c3d10..6c2a198 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 12.0.0 + 12.0.1 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index ea07c2f..67b916c 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 12.0.0 + 12.0.1 From e28c251a2dbf97e5e8273177d05a6f8743c9902c Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 15 Oct 2025 11:20:00 +0200 Subject: [PATCH 023/150] Detect ZIP slip --- .config/pmd/java/ruleset.xml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 4570323..c72b66a 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -316,6 +316,28 @@ + + + ZipEntry name should be sanitized. + Unsanitized names may contain '..' which can result in path traversal ("ZipSlip"). + + You can suppress this warning when you properly sanitized the name. + + 4 + + + + + + + + + Date: Mon, 20 Oct 2025 04:17:59 +0000 Subject: [PATCH 024/150] Update dependency com.puppycrawl.tools:checkstyle to v12.1.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index e03f17f..8a108a1 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 12.0.1 + 12.1.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index c1146ed..0bed85e 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 12.0.1 + 12.1.0 From db9dae96091208bebb9b75e42369696d76f0760e Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 23 Oct 2025 04:14:31 +0000 Subject: [PATCH 025/150] Update shogo82148/actions-create-release digest to 28d99e2 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6101566..103c9b1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -91,7 +91,7 @@ jobs: - name: Create Release id: create-release - uses: shogo82148/actions-create-release@7b89596097b26731bda0852f1504f813499079ee # v1 + uses: shogo82148/actions-create-release@28d99e2a5b407558d17c15d0384fc0d7fb625b4c # v1 with: tag_name: v${{ steps.version.outputs.release }} release_name: v${{ steps.version.outputs.release }} From a9b4edba598ec48c137c2eb5347cf789a2963713 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 25 Oct 2025 04:14:21 +0000 Subject: [PATCH 026/150] Update actions/upload-artifact action to v5 --- .github/workflows/check-build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index e975764..0e42c29 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -69,7 +69,7 @@ jobs: fi - name: Upload demo files - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v5 with: name: demo-files-java-${{ matrix.java }} path: ${{ env.DEMO_MAVEN_MODULE }}/target/${{ env.DEMO_MAVEN_MODULE }}.jar @@ -152,7 +152,7 @@ jobs: - name: Upload report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v5 with: name: pmd-report if-no-files-found: ignore From 0f07ec79fe16525053fc2cb7583fe567b10613e0 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 27 Oct 2025 04:20:45 +0000 Subject: [PATCH 027/150] Update dependency com.puppycrawl.tools:checkstyle to v12.1.1 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 8a108a1..cddae72 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 12.1.0 + 12.1.1 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 0bed85e..7203198 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 12.1.0 + 12.1.1 From 1ebe4703a7b3f80152545d7704cfffd16297e77e Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 29 Oct 2025 08:38:46 +0100 Subject: [PATCH 028/150] Add `UnnecessaryWarningSuppression` https://pmd.github.io/pmd/pmd_rules_java_bestpractices.html#unnecessarywarningsuppression Detects unused suppressions --- .config/pmd/java/ruleset.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index c72b66a..37b4f63 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -25,6 +25,7 @@ + From 80835757139b9630a43fe1eb0d65b857e333517b Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 29 Oct 2025 13:28:01 +0100 Subject: [PATCH 029/150] Formatting --- .config/pmd/java/ruleset.xml | 179 ++++++++++++++++++----------------- 1 file changed, 91 insertions(+), 88 deletions(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 37b4f63..341cb3a 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -10,6 +10,9 @@ + + + @@ -208,14 +211,14 @@ message="StringBuilder/StringBuffer should not be used" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Usually all cases where `StringBuilder` (or the outdated `StringBuffer`) is used are either due to confusing (legacy) logic or may be replaced by a simpler string concatenation. - - Solution: - * Do not use `StringBuffer` because it's thread-safe and usually this is not needed - * If `StringBuilder` is only used in a simple method (like `toString`) and is effectively inlined: Use a simpler string concatenation (`"a" + x + "b"`). This will be optimized by the Java compiler internally. - * In all other cases: - * Check what is happening and if it makes ANY sense! If for example a CSV file is built here consider using a proper library instead! - * Abstract the Strings into a DTO, join them together using a collection (or `StringJoiner`) or use Java's Streaming API instead +Usually all cases where `StringBuilder` (or the outdated `StringBuffer`) is used are either due to confusing (legacy) logic or may be replaced by a simpler string concatenation. + +Solution: +* Do not use `StringBuffer` because it's thread-safe and usually this is not needed +* If `StringBuilder` is only used in a simple method (like `toString`) and is effectively inlined: Use a simpler string concatenation (`"a" + x + "b"`). This will be optimized by the Java compiler internally. +* In all other cases: + * Check what is happening and if it makes ANY sense! If for example a CSV file is built here consider using a proper library instead! + * Abstract the Strings into a DTO, join them together using a collection (or `StringJoiner`) or use Java's Streaming API instead 3 @@ -234,11 +237,11 @@ message="Setters of java.lang.System should not be called unless really needed" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Calling setters of java.lang.System usually indicates bad design and likely causes unexpected behavior. - For example, it may break when multiple Threads are setting the value. - It may also overwrite user defined options or properties. +Calling setters of java.lang.System usually indicates bad design and likely causes unexpected behavior. +For example, it may break when multiple Threads are setting the value. +It may also overwrite user defined options or properties. - Try to pass the value only to the place where it's really needed and use it there accordingly. +Try to pass the value only to the place where it's really needed and use it there accordingly. 3 @@ -257,10 +260,10 @@ message="Avoid @PostConstruct" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Using a `@PostConstruct` method is usually only done when field injection is used and initialization needs to be performed after that. +Using a `@PostConstruct` method is usually only done when field injection is used and initialization needs to be performed after that. - It's better to do this directly in the constructor with constructor injection, so that all logic will be encapsulated there. - This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PostConstruct` method is no longer possible. +It's better to do this directly in the constructor with constructor injection, so that all logic will be encapsulated there. +This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PostConstruct` method is no longer possible. 3 @@ -279,9 +282,9 @@ message="Avoid @PreDestroy" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - `@PreDestroy` should be replaced by implementing `AutoCloseable` and overwriting the `close` method instead. +`@PreDestroy` should be replaced by implementing `AutoCloseable` and overwriting the `close` method instead. - This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PreDestroy` method is no much more difficult. +This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PreDestroy` method is no much more difficult. 3 @@ -300,10 +303,10 @@ message="Avoid unmanaged threads" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Trying to manually manage threads usually gets quickly out of control and may result in various problems like uncontrollable spawning of threads. - Threads can also not be cancelled properly. +Trying to manually manage threads usually gets quickly out of control and may result in various problems like uncontrollable spawning of threads. +Threads can also not be cancelled properly. - Use managed Thread services like `ExecutorService` and `CompletableFuture` instead. +Use managed Thread services like `ExecutorService` and `CompletableFuture` instead. 3 @@ -322,10 +325,10 @@ message="ZipEntry name should be sanitized" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - ZipEntry name should be sanitized. - Unsanitized names may contain '..' which can result in path traversal ("ZipSlip"). +ZipEntry name should be sanitized. +Unsanitized names may contain '..' which can result in path traversal ("ZipSlip"). - You can suppress this warning when you properly sanitized the name. +You can suppress this warning when you properly sanitized the name. 4 @@ -344,12 +347,12 @@ message="Using Java Object (De-)Serialization is unsafe and has led to too many security vulnerabilities" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Nearly every known usage of (Java) Object Deserialization has resulted in [a security vulnerability](https://cloud.google.com/blog/topics/threat-intelligence/hunting-deserialization-exploits?hl=en). - Vulnerabilities are so common that there are [dedicated projects for exploit payload generation](https://github.com/frohoff/ysoserial). +Nearly every known usage of (Java) Object Deserialization has resulted in [a security vulnerability](https://cloud.google.com/blog/topics/threat-intelligence/hunting-deserialization-exploits?hl=en). +Vulnerabilities are so common that there are [dedicated projects for exploit payload generation](https://github.com/frohoff/ysoserial). - Java Object Serialization may also fail to deserialize when the underlying classes are changed. +Java Object Serialization may also fail to deserialize when the underlying classes are changed. - Use proven data interchange formats like JSON instead. +Use proven data interchange formats like JSON instead. 2 @@ -371,8 +374,8 @@ message="Unescaped native HTML is unsafe and will result in XSS vulnerabilities" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule" > - Do not use native HTML! Use Vaadin layouts and components to create required structure. - If you are 100% sure that you escaped the value properly and you have no better options you can suppress this. +Do not use native HTML! Use Vaadin layouts and components to create required structure. +If you are 100% sure that you escaped the value properly and you have no better options you can suppress this. 2 @@ -396,9 +399,9 @@ message="Avoid using DecimalFormat or ChoiceFormat as field since it is thread-unsafe" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - java.text.NumberFormat: DecimalFormat and ChoiceFormat are thread-unsafe. +java.text.NumberFormat: DecimalFormat and ChoiceFormat are thread-unsafe. - Solution: Create a new local one when needed in a method. +Solution: Create a new local one when needed in a method. 1 @@ -428,11 +431,11 @@ public class Foo { message="Detected possible resource expensive implicit regex pattern compilation" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - A regular expression is compiled implicitly on every invocation. - Problem: This can be (CPU) expensive, depending on the length of the regular expression. +A regular expression is compiled implicitly on every invocation. +Problem: This can be (CPU) expensive, depending on the length of the regular expression. - Solution: Compile the regex pattern only once and assign it to a private static final Pattern field. - java.util.Pattern objects are thread-safe, so they can be shared among threads. +Solution: Compile the regex pattern only once and assign it to a private static final Pattern field. +java.util.Pattern objects are thread-safe, so they can be shared among threads. 2 @@ -477,11 +480,11 @@ String good_replaceInnerLineBreakBySpace() { message="Default buffer capacity is used which usually needs expensive expansions" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - The default constructor of ByteArrayOutputStream creates a 32 bytes initial capacity and for StringWriter 16 chars. - Such a small buffer as capacity usually needs several expensive expansions. +The default constructor of ByteArrayOutputStream creates a 32 bytes initial capacity and for StringWriter 16 chars. +Such a small buffer as capacity usually needs several expensive expansions. - Solution: Explicitly declared the buffer size so that an expansion is not needed in most cases. - Typically much larger than 32, e.g. 4096. +Solution: Explicitly declared the buffer size so that an expansion is not needed in most cases. +Typically much larger than 32, e.g. 4096. 2 @@ -517,12 +520,12 @@ class Good { message="Avoid re-streaming enum values to find a value by a field" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - The time to find element is O(n); n = the number of enum values. - This identical processing is executed for every call. - Considered problematic when `n > 3`. +The time to find element is O(n); n = the number of enum values. +This identical processing is executed for every call. +Considered problematic when `n > 3`. - Solution: Use a static field-to-enum-value Map. Access time is O(1), provided the hashCode is well-defined. - Implement a fromString method to provide the reverse conversion by using the map. +Solution: Use a static field-to-enum-value Map. Access time is O(1), provided the hashCode is well-defined. +Implement a fromString method to provide the reverse conversion by using the map. 3 @@ -583,11 +586,11 @@ public enum Fruit { message="Pattern.compile is used in a method. Compiling a regex pattern can be expensive, make it a static final field." class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - A regular expression is compiled on every invocation. - Problem: this can be expensive, depending on the length of the regular expression. +A regular expression is compiled on every invocation. +Problem: this can be expensive, depending on the length of the regular expression. - Solution: Usually a pattern is a literal, not dynamic and can be compiled only once. Assign it to a private static field. - java.util.Pattern objects are thread-safe so they can be shared among threads. +Solution: Usually a pattern is a literal, not dynamic and can be compiled only once. Assign it to a private static field. +java.util.Pattern objects are thread-safe so they can be shared among threads. 2 @@ -629,10 +632,10 @@ public static void good() { message="Avoid expensive recreation of DateTimeFormatter" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Recreating a DateTimeFormatter is relatively expensive. +Recreating a DateTimeFormatter is relatively expensive. - Solution: Java 8+ java.time.DateTimeFormatter is thread-safe and can be shared among threads. - Create the formatter from a pattern only once, to initialize a static final field. +Solution: Java 8+ java.time.DateTimeFormatter is thread-safe and can be shared among threads. +Create the formatter from a pattern only once, to initialize a static final field. 2 @@ -659,11 +662,11 @@ or pmd-java:matchesSig('java.time.format.DateTimeFormatterBuilder#toFormatter(_) message="Avoid expensive recreation of security providers" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Creating a security provider is expensive because of loading of algorithms and other classes. - Additionally, it uses synchronized which leads to lock contention when used with multiple threads. +Creating a security provider is expensive because of loading of algorithms and other classes. +Additionally, it uses synchronized which leads to lock contention when used with multiple threads. - Solution: This only needs to happen once in the JVM lifetime, because once loaded the provider is typically available from the Security class. - Create the security provider only once: Only in case when it's not yet available from the Security class. +Solution: This only needs to happen once in the JVM lifetime, because once loaded the provider is typically available from the Security class. +Create the security provider only once: Only in case when it's not yet available from the Security class. 2 @@ -710,9 +713,9 @@ class Foo { message="Expensive Reflection is used" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Reflection is relatively expensive. +Reflection is relatively expensive. - Solution: Avoid reflection. Use the non-reflective, explicit way like generation by IDE. +Solution: Avoid reflection. Use the non-reflective, explicit way like generation by IDE. 2 @@ -753,11 +756,11 @@ class Good { message="SimpleDateFormat is used. Since it is thread-unsafe, it needs expensive recreation." class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - java.util.SimpleDateFormat is thread-unsafe. - The usual solution is to create a new one when needed in a method. - Creating SimpleDateFormat is relatively expensive. +java.util.SimpleDateFormat is thread-unsafe. +The usual solution is to create a new one when needed in a method. +Creating SimpleDateFormat is relatively expensive. - Solution: Use java.time.DateTimeFormatter. These classes are immutable, thus thread-safe and can be made static. +Solution: Use java.time.DateTimeFormatter. These classes are immutable, thus thread-safe and can be made static. 2 @@ -794,15 +797,15 @@ public class Foo { message="Avoid the ForkJoinPool::commonPool used in parallelStream for blocking calls" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Blocking calls, for instance remote calls, may exhaust the common pool for some time thereby blocking all other use of the common pool. - In addition, nested use of the common pool can lead to deadlock. Do not use the common pool for blocking calls. - The parallelStream() call uses the common pool. +Blocking calls, for instance remote calls, may exhaust the common pool for some time thereby blocking all other use of the common pool. +In addition, nested use of the common pool can lead to deadlock. Do not use the common pool for blocking calls. +The parallelStream() call uses the common pool. - Solution: Use a dedicated thread pool with enough threads to get proper parallelism. - The number of threads in the common pool is equal to the number of CPUs and meant to utilize all of them. - It assumes CPU-intensive non-blocking processing of in-memory data. +Solution: Use a dedicated thread pool with enough threads to get proper parallelism. +The number of threads in the common pool is equal to the number of CPUs and meant to utilize all of them. +It assumes CPU-intensive non-blocking processing of in-memory data. - See also: [_Be Aware of ForkJoinPool#commonPool()_](https://dzone.com/articles/be-aware-of-forkjoinpoolcommonpool) +See also: [_Be Aware of ForkJoinPool#commonPool()_](https://dzone.com/articles/be-aware-of-forkjoinpoolcommonpool) 2 @@ -862,15 +865,15 @@ public class Foo { message="Avoid using the common thread pool, use a separate pool" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - CompletableFuture.supplyAsync/runAsync is typically used for remote calls. - By default it uses the common pool. - The number of threads in the common pool is equal to the number of CPU's, which is suitable for in-memory processing. - For I/O, however, this number is typically not suitable because most time is spent waiting for the response and not in CPU. - The common pool must not be used for blocking calls. +CompletableFuture.supplyAsync/runAsync is typically used for remote calls. +By default it uses the common pool. +The number of threads in the common pool is equal to the number of CPU's, which is suitable for in-memory processing. +For I/O, however, this number is typically not suitable because most time is spent waiting for the response and not in CPU. +The common pool must not be used for blocking calls. - Solution: A separate, properly sized pool of threads (an Executor) should be used for the async calls. +Solution: A separate, properly sized pool of threads (an Executor) should be used for the async calls. - See also: [_Be Aware of ForkJoinPool#commonPool()_](https://dzone.com/articles/be-aware-of-forkjoinpoolcommonpool) +See also: [_Be Aware of ForkJoinPool#commonPool()_](https://dzone.com/articles/be-aware-of-forkjoinpoolcommonpool) 2 @@ -908,9 +911,9 @@ public class Foo { message="Avoid CompletionService.take, use poll" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - `take()` stalls indefinitely in case of hanging threads and consumes a thread. +`take()` stalls indefinitely in case of hanging threads and consumes a thread. - Solution: use `poll()` with a timeout value and handle the timeout. +Solution: use `poll()` with a timeout value and handle the timeout. 2 @@ -944,9 +947,9 @@ public static void collectAllCollectionReplyFromThreads(CompletionService
  • - Stalls indefinitely in case of stalled Callable(s) and consumes threads. +Stalls indefinitely in case of stalled Callable(s) and consumes threads. - Solution: Provide a timeout to the invokeAll/invokeAny method and handle the timeout. +Solution: Provide a timeout to the invokeAll/invokeAny method and handle the timeout. 2 @@ -979,9 +982,9 @@ class Foo { message="Avoid future.get without timeout" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Stalls indefinitely in case of hanging threads and consumes a thread. +Stalls indefinitely in case of hanging threads and consumes a thread. - Solution: Provide a timeout value and handle the timeout. +Solution: Provide a timeout value and handle the timeout. 2 @@ -1012,10 +1015,10 @@ public static String good(CompletableFuture complFuture) throws Exceptio message="An HttpClient is created and combined with request-response" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Apache HttpClient with its connection pool and timeouts should be setup once and then used for many requests. - It is quite expensive to create and can only provide the benefits of pooling when reused in all requests for that connection. +Apache HttpClient with its connection pool and timeouts should be setup once and then used for many requests. +It is quite expensive to create and can only provide the benefits of pooling when reused in all requests for that connection. - Solution: Create/build HttpClient with proper connection pooling and timeouts once, and then use it for requests. +Solution: Create/build HttpClient with proper connection pooling and timeouts once, and then use it for requests. 3 @@ -1054,11 +1057,11 @@ class Foo { message="A Gson object is created for each method call, which is expensive." class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> - Problem: Gson creation is relatively expensive. A JMH benchmark shows a 24x improvement reusing one instance. +Problem: Gson creation is relatively expensive. A JMH benchmark shows a 24x improvement reusing one instance. - Solution: Since Gson objects are thread-safe after creation, they can be shared between threads. - So reuse created instances from a static field. - Pay attention to use thread-safe (custom) adapters and serializers. +Solution: Since Gson objects are thread-safe after creation, they can be shared between threads. +So reuse created instances from a static field. +Pay attention to use thread-safe (custom) adapters and serializers. 3 From f0350dd55446e78ff917b5641070e6db9d379d3f Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 30 Oct 2025 04:11:25 +0000 Subject: [PATCH 030/150] Update lycheeverse/lychee-action digest to a8c4c7c --- .github/workflows/broken-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index a99ae52..0e96b20 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -18,7 +18,7 @@ jobs: - name: Link Checker id: lychee - uses: lycheeverse/lychee-action@885c65f3dc543b57c898c8099f4e08c8afd178a2 # v2 + uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2 with: fail: false # Don't fail on broken links, create an issue instead From f5923efaaa98f06a394b539ee7d795d941973e86 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 1 Nov 2025 04:16:41 +0000 Subject: [PATCH 031/150] Update net.sourceforge.pmd to v7.18.0 --- pom.xml | 4 ++-- template-placeholder/pom.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index cddae72..046a742 100644 --- a/pom.xml +++ b/pom.xml @@ -83,12 +83,12 @@ net.sourceforge.pmd pmd-core - 7.17.0 + 7.18.0 net.sourceforge.pmd pmd-java - 7.17.0 + 7.18.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 7203198..13bcb16 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,12 +253,12 @@ net.sourceforge.pmd pmd-core - 7.17.0 + 7.18.0 net.sourceforge.pmd pmd-java - 7.17.0 + 7.18.0 From 4ebf84d79a7204b8641896071191c7e05ae42fe1 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 3 Nov 2025 08:46:37 +0100 Subject: [PATCH 032/150] Updated to PMD 7.18 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://github.com/pmd/pmd/releases/tag/pmd_releases%2F7.18.0 Reasoning: * Newly included/Changed * `IdenticalConditionalBranches` → self explaining * `LabeledStatement` → are confusing to use and I barely ever see them * Not included * `UnusedLabel` → Not used because `LabeledStatement` already handles these * `ConfusingTernary` → Not helpful in most situations * `AvoidCatchingGenericException` → Might be ok for maybe Throwable or Error (but we sometimes also have to catch those), however not catching Exceptions and RuntimeExceptions is an extremely bad practice --- .config/pmd/java/ruleset.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 341cb3a..3332029 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -17,6 +17,7 @@ + @@ -149,6 +150,7 @@ + From 53e5c3113b97eb080131c1809d79b6b2d3365c60 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 3 Nov 2025 15:14:58 +0100 Subject: [PATCH 033/150] Don't allow TODO comments Fixes https://github.com/xdev-software/java-setup-template/issues/1 --- .config/checkstyle/checkstyle.xml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index 43b5290..ffbc2a9 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -122,9 +122,7 @@ - - - + From 4342c35dc276aecb146aa2877b1062c4a16ba3c0 Mon Sep 17 00:00:00 2001 From: AB Date: Fri, 7 Nov 2025 14:12:35 +0100 Subject: [PATCH 034/150] Small descriptive improvements Fixes https://github.com/xdev-software/java-setup-template/issues/2 --- .config/pmd/java/ruleset.xml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 3332029..c057d1a 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -213,11 +213,11 @@ message="StringBuilder/StringBuffer should not be used" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> -Usually all cases where `StringBuilder` (or the outdated `StringBuffer`) is used are either due to confusing (legacy) logic or may be replaced by a simpler string concatenation. +Usually all cases where `StringBuilder` (or the outdated `StringBuffer`) is used are either due to confusing (legacy) logic or in situations where it may be easily replaced by a simpler string concatenation. Solution: * Do not use `StringBuffer` because it's thread-safe and usually this is not needed -* If `StringBuilder` is only used in a simple method (like `toString`) and is effectively inlined: Use a simpler string concatenation (`"a" + x + "b"`). This will be optimized by the Java compiler internally. +* If `StringBuilder` is only used in a simple method (like `toString`) and is effectively inlined: Use a simpler string concatenation (`"a" + x + "b"`). This will be [optimized by the Java compiler internally](https://docs.oracle.com/javase/specs/jls/se25/html/jls-15.html#jls-15.18.1). * In all other cases: * Check what is happening and if it makes ANY sense! If for example a CSV file is built here consider using a proper library instead! * Abstract the Strings into a DTO, join them together using a collection (or `StringJoiner`) or use Java's Streaming API instead @@ -239,8 +239,8 @@ Solution: message="Setters of java.lang.System should not be called unless really needed" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"> -Calling setters of java.lang.System usually indicates bad design and likely causes unexpected behavior. -For example, it may break when multiple Threads are setting the value. +Calling setters of `java.lang.System` usually indicates bad design and likely causes unexpected behavior. +For example, it may break when multiple Threads are working with the same value. It may also overwrite user defined options or properties. Try to pass the value only to the place where it's really needed and use it there accordingly. @@ -352,7 +352,8 @@ You can suppress this warning when you properly sanitized the name. Nearly every known usage of (Java) Object Deserialization has resulted in [a security vulnerability](https://cloud.google.com/blog/topics/threat-intelligence/hunting-deserialization-exploits?hl=en). Vulnerabilities are so common that there are [dedicated projects for exploit payload generation](https://github.com/frohoff/ysoserial). -Java Object Serialization may also fail to deserialize when the underlying classes are changed. +Java Object Serialization may also fail to deserialize properly when the underlying classes are changed. +This can result in unexpected crashes when outdated data is deserialized. Use proven data interchange formats like JSON instead. @@ -374,7 +375,8 @@ Use proven data interchange formats like JSON instead. + class="net.sourceforge.pmd.lang.rule.xpath.XPathRule" + externalInfoUrl="https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML"> Do not use native HTML! Use Vaadin layouts and components to create required structure. If you are 100% sure that you escaped the value properly and you have no better options you can suppress this. From 053d6040fb9b814e5929e61408b7934e692210bb Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 10 Nov 2025 09:47:22 +0100 Subject: [PATCH 035/150] Add initial PMD X plugin configuration See https://github.com/xdev-software/intellij-plugin-pmd --- .gitignore | 1 + .idea/pmd-x.xml | 27 +++++++++++++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 .idea/pmd-x.xml diff --git a/.gitignore b/.gitignore index ea95295..d35b413 100644 --- a/.gitignore +++ b/.gitignore @@ -34,6 +34,7 @@ hs_err_pid* !.idea/saveactions_settings.xml !.idea/checkstyle-idea.xml !.idea/externalDependencies.xml +!.idea/pmd-x.xml !.idea/PMDPlugin.xml !.idea/inspectionProfiles/ diff --git a/.idea/pmd-x.xml b/.idea/pmd-x.xml new file mode 100644 index 0000000..260e454 --- /dev/null +++ b/.idea/pmd-x.xml @@ -0,0 +1,27 @@ + + + + false + true + true + SUPPORTED_ONLY_WITH_TESTS + + + + \ No newline at end of file From 7b3d463b138e82bd1ac574de670fc3c90a01ce0e Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 12 Nov 2025 04:16:23 +0000 Subject: [PATCH 036/150] Update dependency com.puppycrawl.tools:checkstyle to v12.1.2 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 046a742..8eef499 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 12.1.1 + 12.1.2 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 13bcb16..d6a7ded 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 12.1.1 + 12.1.2 From 6ff31257538b8fc040f950df9d7525ce992f1434 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 21 Nov 2025 04:11:32 +0000 Subject: [PATCH 037/150] Update actions/checkout action to v6 --- .github/workflows/broken-links.yml | 2 +- .github/workflows/sync-labels.yml | 2 +- .github/workflows/update-from-template.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index 0e96b20..e6c3385 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -12,7 +12,7 @@ jobs: link-checker: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - run: mv .github/.lycheeignore .lycheeignore diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 3faaf1e..c43365e 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -15,7 +15,7 @@ jobs: labels: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: sparse-checkout: .github/labels.yml diff --git a/.github/workflows/update-from-template.yml b/.github/workflows/update-from-template.yml index ebd8220..7cff559 100644 --- a/.github/workflows/update-from-template.yml +++ b/.github/workflows/update-from-template.yml @@ -35,7 +35,7 @@ jobs: update_branch_merged_commit: ${{ steps.manage-branches.outputs.update_branch_merged_commit }} create_update_branch_merged_pr: ${{ steps.manage-branches.outputs.create_update_branch_merged_pr }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: # Required because otherwise there are always changes detected when executing diff/rev-list fetch-depth: 0 @@ -181,7 +181,7 @@ jobs: if: needs.update.outputs.create_update_branch_merged_pr == 1 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: # Required because otherwise there are always changes detected when executing diff/rev-list fetch-depth: 0 From 25f9289239221e0e8f35a121c86ecb41feceab95 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 21 Nov 2025 04:15:13 +0000 Subject: [PATCH 038/150] Update actions/checkout action to v6 --- .github/workflows/broken-links.yml | 2 +- .github/workflows/check-build.yml | 6 +++--- .github/workflows/release.yml | 10 +++++----- .github/workflows/sync-labels.yml | 2 +- .github/workflows/test-deploy.yml | 2 +- .github/workflows/update-from-template.yml | 4 ++-- 6 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index 7f35a97..2675c8b 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - run: mv .github/.lycheeignore .lycheeignore diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index 0e42c29..38497bb 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -31,7 +31,7 @@ jobs: java: [17, 21, 25] distribution: [temurin] steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - name: Set up JDK uses: actions/setup-java@v5 @@ -84,7 +84,7 @@ jobs: java: [17] distribution: [temurin] steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - name: Set up JDK uses: actions/setup-java@v5 @@ -120,7 +120,7 @@ jobs: java: [17] distribution: [temurin] steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - name: Set up JDK uses: actions/setup-java@v5 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 103c9b1..e0265f2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - name: Set up JDK uses: actions/setup-java@v5 @@ -63,7 +63,7 @@ jobs: outputs: upload_url: ${{ steps.create-release.outputs.upload_url }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - name: Configure Git run: | @@ -115,7 +115,7 @@ jobs: needs: [prepare-release] timeout-minutes: 60 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - name: Init Git and pull run: | @@ -163,7 +163,7 @@ jobs: needs: [prepare-release] timeout-minutes: 15 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - name: Init Git and pull run: | @@ -202,7 +202,7 @@ jobs: needs: [publish-maven] timeout-minutes: 10 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - name: Init Git and pull run: | diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index f6c50a1..6471ce7 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: sparse-checkout: .github/labels.yml diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml index b75a246..2d13d77 100644 --- a/.github/workflows/test-deploy.yml +++ b/.github/workflows/test-deploy.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - name: Set up JDK uses: actions/setup-java@v5 diff --git a/.github/workflows/update-from-template.yml b/.github/workflows/update-from-template.yml index 1088171..f447710 100644 --- a/.github/workflows/update-from-template.yml +++ b/.github/workflows/update-from-template.yml @@ -36,7 +36,7 @@ jobs: update_branch_merged_commit: ${{ steps.manage-branches.outputs.update_branch_merged_commit }} create_update_branch_merged_pr: ${{ steps.manage-branches.outputs.create_update_branch_merged_pr }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: # Required because otherwise there are always changes detected when executing diff/rev-list fetch-depth: 0 @@ -183,7 +183,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: # Required because otherwise there are always changes detected when executing diff/rev-list fetch-depth: 0 From edf902f001242e39b915775d8d7d6f28a571e9ef Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 2 Dec 2025 13:14:14 +0100 Subject: [PATCH 039/150] Add more common numbers --- .config/checkstyle/checkstyle.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index ffbc2a9..b5a4135 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -91,7 +91,7 @@ - + From c8756b9d201ead32afbe5e4e031505da7c2b9c31 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 3 Dec 2025 04:18:05 +0000 Subject: [PATCH 040/150] Update dependency com.puppycrawl.tools:checkstyle to v12.2.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 8eef499..b13f778 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 12.1.2 + 12.2.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index d6a7ded..6ca6b29 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 12.1.2 + 12.2.0 From df641394583403a6ce83949d31ae5b46586d5c60 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 3 Dec 2025 04:18:06 +0000 Subject: [PATCH 041/150] Update dependency org.apache.maven.plugins:maven-assembly-plugin to v3.8.0 --- template-placeholder-demo/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder-demo/pom.xml b/template-placeholder-demo/pom.xml index b6ff1fd..05b947b 100644 --- a/template-placeholder-demo/pom.xml +++ b/template-placeholder-demo/pom.xml @@ -55,7 +55,7 @@ org.apache.maven.plugins maven-assembly-plugin - 3.7.1 + 3.8.0 From 1f1983a64fb1e0a054802e79bc194c603702937b Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 3 Dec 2025 04:18:07 +0000 Subject: [PATCH 042/150] Update dependency org.apache.maven.plugins:maven-source-plugin to v3.4.0 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index d6a7ded..b8c21a4 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -126,7 +126,7 @@ org.apache.maven.plugins maven-source-plugin - 3.3.1 + 3.4.0 attach-sources From 3fcab4287f04880ecb7f89980d5da2c06134cff6 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 3 Dec 2025 04:18:08 +0000 Subject: [PATCH 043/150] Update net.sourceforge.pmd to v7.19.0 --- pom.xml | 4 ++-- template-placeholder/pom.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index 8eef499..14c61ce 100644 --- a/pom.xml +++ b/pom.xml @@ -83,12 +83,12 @@ net.sourceforge.pmd pmd-core - 7.18.0 + 7.19.0 net.sourceforge.pmd pmd-java - 7.18.0 + 7.19.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index d6a7ded..4f5d9ec 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,12 +253,12 @@ net.sourceforge.pmd pmd-core - 7.18.0 + 7.19.0 net.sourceforge.pmd pmd-java - 7.18.0 + 7.19.0 From b7be80a0ffaca6fdb3d3d68bebf98c8c85fd9947 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 12 Dec 2025 04:23:26 +0000 Subject: [PATCH 044/150] Update actions/cache action to v5 --- .github/workflows/check-build.yml | 10 +++++----- .github/workflows/release.yml | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index 38497bb..e558a91 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -40,7 +40,7 @@ jobs: java-version: ${{ matrix.java }} - name: Cache Maven - uses: actions/cache@v4 + uses: actions/cache@v5 with: path: ~/.m2/repository key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} @@ -93,7 +93,7 @@ jobs: java-version: ${{ matrix.java }} - name: Cache Maven - uses: actions/cache@v4 + uses: actions/cache@v5 with: path: ~/.m2/repository key: ${{ runner.os }}-mvn-checkstyle-${{ hashFiles('**/pom.xml') }} @@ -101,7 +101,7 @@ jobs: ${{ runner.os }}-mvn-checkstyle- - name: CheckStyle Cache - uses: actions/cache@v4 + uses: actions/cache@v5 with: path: '**/target/checkstyle-cachefile' key: ${{ runner.os }}-checkstyle-${{ hashFiles('**/pom.xml') }} @@ -129,7 +129,7 @@ jobs: java-version: ${{ matrix.java }} - name: Cache Maven - uses: actions/cache@v4 + uses: actions/cache@v5 with: path: ~/.m2/repository key: ${{ runner.os }}-mvn-pmd-${{ hashFiles('**/pom.xml') }} @@ -137,7 +137,7 @@ jobs: ${{ runner.os }}-mvn-pmd- - name: PMD Cache - uses: actions/cache@v4 + uses: actions/cache@v5 with: path: '**/target/pmd/pmd.cache' key: ${{ runner.os }}-pmd-${{ hashFiles('**/pom.xml') }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e0265f2..63c583f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: # Try to reuse existing cache from check-build - name: Try restore Maven Cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@v5 with: path: ~/.m2/repository key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} @@ -179,7 +179,7 @@ jobs: # Try to reuse existing cache from check-build - name: Try restore Maven Cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@v5 with: path: ~/.m2/repository key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} From 94faaa817fcf0586ef2f77ad66fdc582e3cbc5b3 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 13 Dec 2025 04:18:54 +0000 Subject: [PATCH 045/150] Update actions/upload-artifact action to v6 --- .github/workflows/check-build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index 38497bb..5b1ddcd 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -69,7 +69,7 @@ jobs: fi - name: Upload demo files - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@v6 with: name: demo-files-java-${{ matrix.java }} path: ${{ env.DEMO_MAVEN_MODULE }}/target/${{ env.DEMO_MAVEN_MODULE }}.jar @@ -152,7 +152,7 @@ jobs: - name: Upload report if: always() - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@v6 with: name: pmd-report if-no-files-found: ignore From 9d0fc14dce5143c432b7674dfdc94b577df1d61c Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 14 Dec 2025 04:26:08 +0000 Subject: [PATCH 046/150] Update dependency com.puppycrawl.tools:checkstyle to v12.3.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 4ddf0d8..0a33102 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 12.2.0 + 12.3.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 57263e3..3297464 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 12.2.0 + 12.3.0 From 5ec11e42f23cba26475630d3685926c828ce73ce Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 17 Dec 2025 04:22:05 +0000 Subject: [PATCH 047/150] Update dependency maven to v3.9.12 --- .mvn/wrapper/maven-wrapper.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties index c0bcafe..8dea6c2 100644 --- a/.mvn/wrapper/maven-wrapper.properties +++ b/.mvn/wrapper/maven-wrapper.properties @@ -1,3 +1,3 @@ wrapperVersion=3.3.4 distributionType=only-script -distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.11/apache-maven-3.9.11-bin.zip +distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.12/apache-maven-3.9.12-bin.zip From d1732099fc96a89266d96bf10d1b97f6ca68e9e2 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 25 Dec 2025 04:25:20 +0000 Subject: [PATCH 048/150] Update shogo82148/actions-create-release digest to 559c27c --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 63c583f..3f55399 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -91,7 +91,7 @@ jobs: - name: Create Release id: create-release - uses: shogo82148/actions-create-release@28d99e2a5b407558d17c15d0384fc0d7fb625b4c # v1 + uses: shogo82148/actions-create-release@559c27ce7eb834825e2b55927c64f6d1bd1db716 # v1 with: tag_name: v${{ steps.version.outputs.release }} release_name: v${{ steps.version.outputs.release }} From b8924cfb611d0c61c80ff53bcec7c6f029386c30 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 31 Dec 2025 04:28:38 +0000 Subject: [PATCH 049/150] Update net.sourceforge.pmd to v7.20.0 --- pom.xml | 4 ++-- template-placeholder/pom.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index 0a33102..4f008f6 100644 --- a/pom.xml +++ b/pom.xml @@ -83,12 +83,12 @@ net.sourceforge.pmd pmd-core - 7.19.0 + 7.20.0 net.sourceforge.pmd pmd-java - 7.19.0 + 7.20.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 3297464..5c16b70 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,12 +253,12 @@ net.sourceforge.pmd pmd-core - 7.19.0 + 7.20.0 net.sourceforge.pmd pmd-java - 7.19.0 + 7.20.0 From 8c4cce7a01a368b3f252b338a5c01bd8a949cdd3 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 5 Jan 2026 04:37:37 +0000 Subject: [PATCH 050/150] Update dependency com.puppycrawl.tools:checkstyle to v13 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 0a33102..963892d 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 12.3.0 + 13.0.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 3297464..ffe73cc 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 12.3.0 + 13.0.0 From 1d1ce1e358bced2d31510629135e7d9dd53bc903 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 8 Jan 2026 04:27:09 +0000 Subject: [PATCH 051/150] Update dependency org.sonatype.central:central-publishing-maven-plugin to v0.10.0 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 3297464..6bf68ad 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -193,7 +193,7 @@ org.sonatype.central central-publishing-maven-plugin - 0.9.0 + 0.10.0 true sonatype-central-portal From 8159312aa40e8b4e74625cbf7b7d94dbba10072d Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 12 Jan 2026 09:40:34 +0100 Subject: [PATCH 052/150] Checkstyle now requires Java 21 --- .github/workflows/check-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index 9fdeb5a..b1a6d66 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -81,7 +81,7 @@ jobs: timeout-minutes: 15 strategy: matrix: - java: [17] + java: [21] distribution: [temurin] steps: - uses: actions/checkout@v6 From 628f4713440162468b2d0f7fdcef5986b4394119 Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 14 Jan 2026 15:52:03 +0100 Subject: [PATCH 053/150] Do not allow params and vars to end with collection type names Fixes https://github.com/xdev-software/java-setup-template/issues/6 --- .config/checkstyle/checkstyle.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index b5a4135..f0dcc86 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -74,6 +74,11 @@ + + + + + From fff49da9f48d4086c326b1ceed5422f4223ebdb1 Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 14 Jan 2026 16:36:27 +0100 Subject: [PATCH 054/150] PMD: Use a Set instead of a List in entity relations Fixes https://github.com/xdev-software/java-setup-template/issues/5 --- .config/pmd/java/ruleset.xml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index c057d1a..e96576b 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -394,6 +394,30 @@ If you are 100% sure that you escaped the value properly and you have no better + + + +`List` allows duplicates while a `Set` does not. +A `Set` also prevents duplicates when the ORM reads multiple identical rows from the database (e.g. when using JOIN). + + 2 + + + + + + + + + From ae8b5b88317ca2cd6df74e92c3fe0ecf92cc017d Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 14 Jan 2026 16:51:29 +0100 Subject: [PATCH 055/150] Update checkstyle-idea.xml --- .idea/checkstyle-idea.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.idea/checkstyle-idea.xml b/.idea/checkstyle-idea.xml index ec555b5..a751c41 100644 --- a/.idea/checkstyle-idea.xml +++ b/.idea/checkstyle-idea.xml @@ -1,7 +1,7 @@ - 11.0.0 + 13.0.0 JavaOnlyWithTests true true From 43e1272ebeab136234afadf89bc73789f7d1a94e Mon Sep 17 00:00:00 2001 From: AB Date: Thu, 15 Jan 2026 09:11:40 +0100 Subject: [PATCH 056/150] Fix Todo comment detection --- .config/checkstyle/checkstyle.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index f0dcc86..da11683 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -127,7 +127,10 @@ - + + + + From 8f54163363b15bb2266df7ef78fe5fb324120b17 Mon Sep 17 00:00:00 2001 From: AB Date: Fri, 16 Jan 2026 08:43:40 +0100 Subject: [PATCH 057/150] Look for TODOs case INsensitive --- .config/checkstyle/checkstyle.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index da11683..463a629 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -129,7 +129,7 @@ - + From c14bd502e680a42328dcb63df9a95473801a9e84 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 19 Jan 2026 04:31:38 +0000 Subject: [PATCH 058/150] Update dependency org.junit.jupiter:junit-jupiter-api to v6.0.2 --- expiring-limited-cache/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/expiring-limited-cache/pom.xml b/expiring-limited-cache/pom.xml index e91d1ba..ad6dec6 100644 --- a/expiring-limited-cache/pom.xml +++ b/expiring-limited-cache/pom.xml @@ -64,7 +64,7 @@ org.junit.jupiter junit-jupiter-api - 6.0.0 + 6.0.2 test From 0f3f209b5e215cb05c5d2aa1e6dd7eee9213a42a Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 1 Feb 2026 04:56:12 +0000 Subject: [PATCH 059/150] Update dependency com.puppycrawl.tools:checkstyle to v13.1.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 84ce434..d062774 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.0.0 + 13.1.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 3738a65..d8992d5 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.0.0 + 13.1.0 From b782259974ebd85ab887251d59fb85d354db3ec3 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 2 Feb 2026 04:53:19 +0000 Subject: [PATCH 060/150] Update dependency org.apache.maven.plugins:maven-compiler-plugin to v3.15.0 --- template-placeholder-demo/pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/template-placeholder-demo/pom.xml b/template-placeholder-demo/pom.xml index 05b947b..06fc318 100644 --- a/template-placeholder-demo/pom.xml +++ b/template-placeholder-demo/pom.xml @@ -44,7 +44,7 @@ org.apache.maven.plugins maven-compiler-plugin - 3.14.1 + 3.15.0 ${maven.compiler.release} diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 3738a65..0bc0784 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -97,7 +97,7 @@ org.apache.maven.plugins maven-compiler-plugin - 3.14.1 + 3.15.0 ${maven.compiler.release} From cdbd713ed0a07b6b3de402fc98adb2d591ece70a Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Tue, 3 Feb 2026 04:43:13 +0000 Subject: [PATCH 061/150] Update net.sourceforge.pmd to v7.21.0 --- pom.xml | 4 ++-- template-placeholder/pom.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index d062774..803cb4d 100644 --- a/pom.xml +++ b/pom.xml @@ -83,12 +83,12 @@ net.sourceforge.pmd pmd-core - 7.20.0 + 7.21.0 net.sourceforge.pmd pmd-java - 7.20.0 + 7.21.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 597d823..cdb13a0 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,12 +253,12 @@ net.sourceforge.pmd pmd-core - 7.20.0 + 7.21.0 net.sourceforge.pmd pmd-java - 7.20.0 + 7.21.0 From 78e6f922261869bc7a6f939d185e46e35ed3f0aa Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 4 Feb 2026 12:01:54 +0100 Subject: [PATCH 062/150] Updat to PMD 7.21.0 --- .config/pmd/java/ruleset.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index e96576b..e2325a9 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -146,7 +146,6 @@ - @@ -164,6 +163,7 @@ + From 076ea0fc43b6354042220d357fa595eeebf32f0b Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 6 Feb 2026 04:44:15 +0000 Subject: [PATCH 063/150] Update dependency com.puppycrawl.tools:checkstyle to v13.2.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index d062774..45d9bd4 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.1.0 + 13.2.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 597d823..0ea5a26 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.1.0 + 13.2.0 From 6d43ffaef8859b858872997bd9a118520ccd6d1d Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 16 Feb 2026 04:49:46 +0000 Subject: [PATCH 064/150] Update dependency org.junit.jupiter:junit-jupiter-api to v6.0.3 --- expiring-limited-cache/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/expiring-limited-cache/pom.xml b/expiring-limited-cache/pom.xml index ad6dec6..43abc2d 100644 --- a/expiring-limited-cache/pom.xml +++ b/expiring-limited-cache/pom.xml @@ -64,7 +64,7 @@ org.junit.jupiter junit-jupiter-api - 6.0.2 + 6.0.3 test From 76cf22386537f750c979b63658ab3459f6b8586c Mon Sep 17 00:00:00 2001 From: AB Date: Fri, 20 Feb 2026 08:43:59 +0100 Subject: [PATCH 065/150] Disallow classes ending with Helper or Util Fixes https://github.com/xdev-software/java-setup-template/issues/7 --- .config/checkstyle/checkstyle.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index 463a629..262c9f9 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -79,6 +79,11 @@ + + + + + From e88ee2e74b7f33898e8da1eb84eb491ec6fbabc2 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 22 Feb 2026 04:42:18 +0000 Subject: [PATCH 066/150] Update dependency org.apache.maven.plugins:maven-surefire-plugin to v3.5.5 --- expiring-limited-cache/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/expiring-limited-cache/pom.xml b/expiring-limited-cache/pom.xml index ad6dec6..9a08d54 100644 --- a/expiring-limited-cache/pom.xml +++ b/expiring-limited-cache/pom.xml @@ -183,7 +183,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.5.4 + 3.5.5 From 838f350c5da393d455f0b1de29397762af9111ac Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 23 Feb 2026 09:54:21 +0100 Subject: [PATCH 067/150] Avoid using Optional#get Fixes https://github.com/xdev-software/java-setup-template/issues/8 --- .config/pmd/java/ruleset.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index e2325a9..9dc7a0f 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -208,6 +208,36 @@ + + +`Optional#get` can be interpreted as a getter by developers, however this is not the case as it throws an exception when empty. + +It should be replaced by +* doing a mapping directly using `.map` or `.ifPresent` +* using the preferred `.orElseThrow`, `.orElse` or `.or` methods + +Java Developer Brian Goetz also writes regarding this topic: + +> Java 8 was a huge improvement to the platform, but one of the few mistakes we made was the naming of `Optional.get()`, because the name just invites people to call it without calling `isPresent()`, undermining the whole point of using `Optional` in the first place. +> +> During the Java 9 time frame, we proposed to deprecate `Optional.get()`, but the public response to that was ... let's say cold. As a smaller step, we introduced `orElseThrow()` in 10 (see [JDK-8140281](https://bugs.openjdk.java.net/browse/JDK-8140281)) as a more transparently named synonym for the current pernicious behavior of `get()`. IDEs warn on unconditional use of `get()`, but not on `orElseThrow()`, which is a step forward in teaching people to code better. The question is, in a sense, a "glass half empty" view of the current situation; `get()` is still problematic. + + 3 + + + + + + + + + Date: Thu, 26 Feb 2026 04:42:27 +0000 Subject: [PATCH 068/150] Update lycheeverse/lychee-action digest to 8646ba3 --- .github/workflows/broken-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index e6c3385..d768259 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -18,7 +18,7 @@ jobs: - name: Link Checker id: lychee - uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2 with: fail: false # Don't fail on broken links, create an issue instead From 8b6624e632e759013ba7aa24ba6ec36f4951f500 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 26 Feb 2026 04:45:51 +0000 Subject: [PATCH 069/150] Update lycheeverse/lychee-action digest to 8646ba3 --- .github/workflows/broken-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index 2675c8b..5b50d06 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -19,7 +19,7 @@ jobs: - name: Link Checker id: lychee - uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2 with: fail: false # Don't fail on broken links, create an issue instead From a53730bb4a5a0765d9972d93dd5884253f67b619 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 27 Feb 2026 04:43:58 +0000 Subject: [PATCH 070/150] Update actions/upload-artifact action to v7 --- .github/workflows/check-build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index b1a6d66..b5d7995 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -69,7 +69,7 @@ jobs: fi - name: Upload demo files - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: demo-files-java-${{ matrix.java }} path: ${{ env.DEMO_MAVEN_MODULE }}/target/${{ env.DEMO_MAVEN_MODULE }}.jar @@ -152,7 +152,7 @@ jobs: - name: Upload report if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: pmd-report if-no-files-found: ignore From 0dcf9cfe57c8d8c8ace1253845b67afb8bd47bda Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 1 Mar 2026 04:48:23 +0000 Subject: [PATCH 071/150] Update dependency com.puppycrawl.tools:checkstyle to v13.3.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index a219280..e214afa 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.2.0 + 13.3.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 9e08842..2547c6f 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.2.0 + 13.3.0 From 77e37f981ecf107f1ebb690beb75262b3314b38e Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 2 Mar 2026 04:46:12 +0000 Subject: [PATCH 072/150] Update dependency net.sourceforge.pmd:pmd-core to v7.22.0 [SECURITY] --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index a219280..4cac133 100644 --- a/pom.xml +++ b/pom.xml @@ -83,7 +83,7 @@ net.sourceforge.pmd pmd-core - 7.21.0 + 7.22.0 net.sourceforge.pmd diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 9e08842..4a20d6d 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,7 +253,7 @@ net.sourceforge.pmd pmd-core - 7.21.0 + 7.22.0 net.sourceforge.pmd From 961291c3795ca9f249ce028fe98fe1524da6b0fb Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 2 Mar 2026 04:46:14 +0000 Subject: [PATCH 073/150] Update dependency net.sourceforge.pmd:pmd-java to v7.22.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index a219280..97f7b18 100644 --- a/pom.xml +++ b/pom.xml @@ -88,7 +88,7 @@ net.sourceforge.pmd pmd-java - 7.21.0 + 7.22.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 9e08842..3831400 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -258,7 +258,7 @@ net.sourceforge.pmd pmd-java - 7.21.0 + 7.22.0 From 6f9b5b39e904c2167782591b14a645b1fd49b730 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 2 Mar 2026 12:00:46 +0100 Subject: [PATCH 074/150] Create report-gha-workflow-security-problems.yml Fixes https://github.com/xdev-software/base-template/issues/13 --- .../report-gha-workflow-security-problems.yml | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 .github/workflows/report-gha-workflow-security-problems.yml diff --git a/.github/workflows/report-gha-workflow-security-problems.yml b/.github/workflows/report-gha-workflow-security-problems.yml new file mode 100644 index 0000000..b17aa53 --- /dev/null +++ b/.github/workflows/report-gha-workflow-security-problems.yml @@ -0,0 +1,61 @@ +name: Report workflow security problems + +on: + workflow_dispatch: + push: + branches: [ develop ] + paths: + - '.github/workflows/**' + +permissions: + issues: write + +jobs: + prt: + runs-on: ubuntu-latest + timeout-minutes: 15 + # Only run this in our repos (Prevent notification spam by forks) + if: ${{ github.repository_owner == 'xdev-software' }} + steps: + - uses: actions/checkout@v6 + + - name: Check + id: check + run: | + grep -l 'pull_request_target:' --exclude report-gha-workflow-security-problems.yml *.yml > reported.txt && exit 1 || exit 0 + working-directory: .github/workflows + + - name: Find already existing issue + id: find-issue + if: ${{ !cancelled() }} + run: | + echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title "Incorrectly configure GHA workflow (prt)"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT + env: + GH_TOKEN: ${{ github.token }} + + - name: Close issue if everything is fine + if: ${{ success() && steps.find-issue.outputs.number != '' }} + run: gh issue close -r 'not planned' ${{ steps.find-issue.outputs.number }} + env: + GH_TOKEN: ${{ github.token }} + + - name: Create report + if: ${{ failure() && steps.check.conclusion == 'failure' }} + run: | + echo 'Detected usage of `pull_request_target`. This event is dangerous and MUST NOT BE USED AT ALL COST!' > reported.md + echo '' >> reported.md + echo '/cc @xdev-software/gha-workflow-security' >> reported.md + echo '' >> reported.md + echo '```' >> reported.md + cat .github/workflows/reported.txt >> reported.md + echo '```' >> reported.md + cat reported.md + + - name: Create Issue From File + if: ${{ failure() && steps.check.conclusion == 'failure' }} + uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6 + with: + issue-number: ${{ steps.find-issue.outputs.number }} + title: 'Incorrectly configure GHA workflow (prt)' + content-filepath: ./reported.md + labels: bug, automated From 42dc90b3195e1e69fa68bd4229ed033f43475ccb Mon Sep 17 00:00:00 2001 From: AB Date: Fri, 6 Mar 2026 11:26:43 +0100 Subject: [PATCH 075/150] Ignore cancelled builds --- .github/workflows/check-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index b5d7995..daae7b2 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -151,7 +151,7 @@ jobs: run: ./mvnw -B pmd:aggregate-cpd pmd:cpd-check -P pmd -DskipTests -T2C - name: Upload report - if: always() + if: ${{ !cancelled() }} uses: actions/upload-artifact@v7 with: name: pmd-report From 84e1242d26dadb2a8522dbaaa1563c0e613bf086 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 9 Mar 2026 10:01:24 +0100 Subject: [PATCH 076/150] Enforce use of PMD plugin After feedback from colleague --- .idea/externalDependencies.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/.idea/externalDependencies.xml b/.idea/externalDependencies.xml index 78be5b8..0b477b8 100644 --- a/.idea/externalDependencies.xml +++ b/.idea/externalDependencies.xml @@ -3,5 +3,6 @@ + \ No newline at end of file From c8c9580accc185c3a234fda3012d41c089d0d913 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Tue, 10 Mar 2026 04:42:30 +0000 Subject: [PATCH 077/150] Update dependency maven to v3.9.13 --- .mvn/wrapper/maven-wrapper.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties index 8dea6c2..71ea75a 100644 --- a/.mvn/wrapper/maven-wrapper.properties +++ b/.mvn/wrapper/maven-wrapper.properties @@ -1,3 +1,3 @@ wrapperVersion=3.3.4 distributionType=only-script -distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.12/apache-maven-3.9.12-bin.zip +distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.13/apache-maven-3.9.13-bin.zip From 4951b0b479fcf878b6ff00a3b1be5f3b465b25c0 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 13 Mar 2026 04:44:06 +0000 Subject: [PATCH 078/150] Update dependency maven to v3.9.14 --- .mvn/wrapper/maven-wrapper.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties index 71ea75a..c595b00 100644 --- a/.mvn/wrapper/maven-wrapper.properties +++ b/.mvn/wrapper/maven-wrapper.properties @@ -1,3 +1,3 @@ wrapperVersion=3.3.4 distributionType=only-script -distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.13/apache-maven-3.9.13-bin.zip +distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.14/apache-maven-3.9.14-bin.zip From cbd7ac875acfbd2d36c29ffcbcbebcf315560235 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 15 Mar 2026 04:56:46 +0000 Subject: [PATCH 079/150] Update shogo82148/actions-create-release digest to 6a39603 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3f55399..2b7941b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -91,7 +91,7 @@ jobs: - name: Create Release id: create-release - uses: shogo82148/actions-create-release@559c27ce7eb834825e2b55927c64f6d1bd1db716 # v1 + uses: shogo82148/actions-create-release@6a396031bc74c57403da1018fec74d24c6aa03cd # v1 with: tag_name: v${{ steps.version.outputs.release }} release_name: v${{ steps.version.outputs.release }} From b6c60e60be46f6fa52a6fe415e0e0b16e8e2b886 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 28 Mar 2026 04:47:46 +0000 Subject: [PATCH 080/150] Update net.sourceforge.pmd to v7.23.0 --- pom.xml | 4 ++-- template-placeholder/pom.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index 4d53635..c19848e 100644 --- a/pom.xml +++ b/pom.xml @@ -83,12 +83,12 @@ net.sourceforge.pmd pmd-core - 7.22.0 + 7.23.0 net.sourceforge.pmd pmd-java - 7.22.0 + 7.23.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index abef60d..5931b6c 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,12 +253,12 @@ net.sourceforge.pmd pmd-core - 7.22.0 + 7.23.0 net.sourceforge.pmd pmd-java - 7.22.0 + 7.23.0 From 7192c1a29f1848257b77974333a1108d2869db49 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 30 Mar 2026 05:09:13 +0000 Subject: [PATCH 081/150] Update dependency com.puppycrawl.tools:checkstyle to v13.4.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 4d53635..1f91c95 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.3.0 + 13.4.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index abef60d..97dc504 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.3.0 + 13.4.0 From e77bae85a513462863e824b3d8b071edb426bd52 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 30 Mar 2026 09:04:15 +0200 Subject: [PATCH 082/150] Updates for CheckStyle 13.4 --- .config/checkstyle/checkstyle.xml | 1 + .idea/checkstyle-idea.xml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index 262c9f9..ce1e09d 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -85,6 +85,7 @@ + diff --git a/.idea/checkstyle-idea.xml b/.idea/checkstyle-idea.xml index a751c41..27f72ce 100644 --- a/.idea/checkstyle-idea.xml +++ b/.idea/checkstyle-idea.xml @@ -1,7 +1,7 @@ - 13.0.0 + 13.4.0 JavaOnlyWithTests true true From 225c79b88ca0fb52a376de459f5ed4c7890a498f Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 30 Mar 2026 14:59:05 +0200 Subject: [PATCH 083/150] Prepare for new templating system --- .config/topo/upstream.yml | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .config/topo/upstream.yml diff --git a/.config/topo/upstream.yml b/.config/topo/upstream.yml new file mode 100644 index 0000000..d78d893 --- /dev/null +++ b/.config/topo/upstream.yml @@ -0,0 +1,2 @@ +- url: https://github.com/xdev-software/base-template.git + branch: master From fcf8b930e9544886a329758cd7fe21ad474bd337 Mon Sep 17 00:00:00 2001 From: "Alex \"Blex\" B" <45384811+AB-xdev@users.noreply.github.com> Date: Mon, 30 Mar 2026 15:01:53 +0200 Subject: [PATCH 084/150] Update upstream.yml --- .config/topo/upstream.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/topo/upstream.yml b/.config/topo/upstream.yml index d78d893..7821ddf 100644 --- a/.config/topo/upstream.yml +++ b/.config/topo/upstream.yml @@ -1,2 +1,2 @@ -- url: https://github.com/xdev-software/base-template.git +- url: https://github.com/xdev-software/java-template.git branch: master From 3e30eebf5761e3e4ba41e2576938445c49500200 Mon Sep 17 00:00:00 2001 From: "Alex \"Blex\" B" <45384811+AB-xdev@users.noreply.github.com> Date: Mon, 30 Mar 2026 15:05:59 +0200 Subject: [PATCH 085/150] Create upstream.yml --- .config/topo/upstream.yml | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .config/topo/upstream.yml diff --git a/.config/topo/upstream.yml b/.config/topo/upstream.yml new file mode 100644 index 0000000..8627eae --- /dev/null +++ b/.config/topo/upstream.yml @@ -0,0 +1,2 @@ +- url: https://github.com/xdev-software/java-setup-template.git + branch: master From 687c673ae447c3881b1c6fc8541111ccf847c842 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 30 Mar 2026 15:11:51 +0200 Subject: [PATCH 086/150] Update upstream.yml --- .config/topo/upstream.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/topo/upstream.yml b/.config/topo/upstream.yml index d78d893..7821ddf 100644 --- a/.config/topo/upstream.yml +++ b/.config/topo/upstream.yml @@ -1,2 +1,2 @@ -- url: https://github.com/xdev-software/base-template.git +- url: https://github.com/xdev-software/java-template.git branch: master From fa9ccfa8a0714ff512fb760675b7f14bf0534f21 Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 31 Mar 2026 09:54:49 +0200 Subject: [PATCH 087/150] Update upstream.yml --- .config/topo/upstream.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/topo/upstream.yml b/.config/topo/upstream.yml index 7821ddf..0cc67cd 100644 --- a/.config/topo/upstream.yml +++ b/.config/topo/upstream.yml @@ -1,2 +1,2 @@ -- url: https://github.com/xdev-software/java-template.git +- url: https://github.com/xdev-software/standard-maven-template.git branch: master From c0e52bd19d9671cf5b53ddfffd8ba4fae4b86b67 Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 31 Mar 2026 14:08:01 +0200 Subject: [PATCH 088/150] Delete update-from-template.yml Will be managed centrally now --- .github/workflows/update-from-template.yml | 318 --------------------- 1 file changed, 318 deletions(-) delete mode 100644 .github/workflows/update-from-template.yml diff --git a/.github/workflows/update-from-template.yml b/.github/workflows/update-from-template.yml deleted file mode 100644 index 7cff559..0000000 --- a/.github/workflows/update-from-template.yml +++ /dev/null @@ -1,318 +0,0 @@ -name: Update from Template - -# This workflow keeps the repo up to date with changes from the template repo (REMOTE_URL) -# It duplicates the REMOTE_BRANCH (into UPDATE_BRANCH) and tries to merge it into -# this repos default branch (which is checked out here) -# Note that this requires a PAT (Personal Access Token) - at best from a servicing account -# PAT permissions: read:discussion, read:org, repo, workflow -# Also note that you should have at least once merged the template repo into the current repo manually -# otherwise a "refusing to merge unrelated histories" error might occur. - -on: - schedule: - - cron: '55 2 * * 1' - workflow_dispatch: - inputs: - no_automatic_merge: - type: boolean - description: 'No automatic merge' - default: false - -env: - UPDATE_BRANCH: update-from-template - UPDATE_BRANCH_MERGED: update-from-template-merged - REMOTE_URL: https://github.com/xdev-software/base-template.git - REMOTE_BRANCH: master - -permissions: - contents: write - pull-requests: write - -jobs: - update: - runs-on: ubuntu-latest - outputs: - update_branch_merged_commit: ${{ steps.manage-branches.outputs.update_branch_merged_commit }} - create_update_branch_merged_pr: ${{ steps.manage-branches.outputs.create_update_branch_merged_pr }} - steps: - - uses: actions/checkout@v6 - with: - # Required because otherwise there are always changes detected when executing diff/rev-list - fetch-depth: 0 - # If no PAT is used the following error occurs on a push: - # refusing to allow a GitHub App to create or update workflow `.github/workflows/xxx.yml` without `workflows` permission - token: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - - - name: Init Git - run: | - git config --global user.email "111048771+xdev-gh-bot@users.noreply.github.com" - git config --global user.name "XDEV Bot" - - - name: Manage branches - id: manage-branches - run: | - echo "Adding remote template-repo" - git remote add template ${{ env.REMOTE_URL }} - - echo "Fetching remote template repo" - git fetch template - - echo "Deleting local branches that will contain the updates - if present" - git branch -D ${{ env.UPDATE_BRANCH }} || true - git branch -D ${{ env.UPDATE_BRANCH_MERGED }} || true - - echo "Checking if the remote template repo has new commits" - git rev-list ..template/${{ env.REMOTE_BRANCH }} - - if [ $(git rev-list --count ..template/${{ env.REMOTE_BRANCH }}) -eq 0 ]; then - echo "There are no commits new commits on the template repo" - - echo "Deleting origin branch(es) that contain the updates - if present" - git push -f origin --delete ${{ env.UPDATE_BRANCH }} || true - git push -f origin --delete ${{ env.UPDATE_BRANCH_MERGED }} || true - - echo "create_update_branch_pr=0" >> $GITHUB_OUTPUT - echo "create_update_branch_merged_pr=0" >> $GITHUB_OUTPUT - exit 0 - fi - - echo "Found new commits on the template repo" - - echo "Creating update branch" - git branch ${{ env.UPDATE_BRANCH }} template/${{ env.REMOTE_BRANCH }} - git branch --unset-upstream ${{ env.UPDATE_BRANCH }} - - echo "Pushing update branch" - git push -f -u origin ${{ env.UPDATE_BRANCH }} - - echo "Getting base branch" - base_branch=$(git branch --show-current) - echo "Base branch is $base_branch" - echo "base_branch=$base_branch" >> $GITHUB_OUTPUT - - echo "Trying to create auto-merged branch ${{ env.UPDATE_BRANCH_MERGED }}" - git branch ${{ env.UPDATE_BRANCH_MERGED }} ${{ env.UPDATE_BRANCH }} - git checkout ${{ env.UPDATE_BRANCH_MERGED }} - - echo "Merging branch $base_branch into ${{ env.UPDATE_BRANCH_MERGED }}" - git merge $base_branch && merge_exit_code=$? || merge_exit_code=$? - if [ $merge_exit_code -ne 0 ]; then - echo "Auto merge failed! Manual merge required" - echo "::notice ::Auto merge failed - Manual merge required" - - echo "Cleaning up failed merge" - git merge --abort - git checkout $base_branch - git branch -D ${{ env.UPDATE_BRANCH_MERGED }} || true - - echo "Deleting auto-merge branch - if present" - git push -f origin --delete ${{ env.UPDATE_BRANCH_MERGED }} || true - - echo "create_update_branch_pr=1" >> $GITHUB_OUTPUT - echo "create_update_branch_merged_pr=0" >> $GITHUB_OUTPUT - exit 0 - fi - - echo "Post processing: Trying to automatically fill in template variables" - find . -type f \ - -not -path "./.git/**" \ - -not -path "./.github/workflows/update-from-template.yml" -print0 \ - | xargs -0 sed -i "s/template-placeholder/${GITHUB_REPOSITORY#*/}/g" - - git status - git add --all - - if [[ "$(git status --porcelain)" != "" ]]; then - echo "Filled in template; Committing" - - git commit -m "Fill in template" - fi - - echo "Pushing auto-merged branch" - git push -f -u origin ${{ env.UPDATE_BRANCH_MERGED }} - - echo "update_branch_merged_commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - echo "Restoring base branch $base_branch" - git checkout $base_branch - - echo "create_update_branch_pr=0" >> $GITHUB_OUTPUT - echo "create_update_branch_merged_pr=1" >> $GITHUB_OUTPUT - echo "try_close_update_branch_pr=1" >> $GITHUB_OUTPUT - - - name: Create/Update PR update_branch - if: steps.manage-branches.outputs.create_update_branch_pr == 1 - env: - GH_TOKEN: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - run: | - gh_pr_up() { - gh pr create -H "${{ env.UPDATE_BRANCH }}" "$@" || (git checkout "${{ env.UPDATE_BRANCH }}" && gh pr edit "$@") - } - gh_pr_up -B "${{ steps.manage-branches.outputs.base_branch }}" \ - --title "Update from template" \ - --body "An automated PR to sync changes from the template into this repo" - - # Ensure that only a single PR is open (otherwise confusion and spam) - - name: Close PR update_branch - if: steps.manage-branches.outputs.try_close_update_branch_pr == 1 - env: - GH_TOKEN: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - run: | - gh pr close "${{ env.UPDATE_BRANCH }}" || true - - - name: Create/Update PR update_branch_merged - if: steps.manage-branches.outputs.create_update_branch_merged_pr == 1 - env: - GH_TOKEN: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - run: | - gh_pr_up() { - gh pr create -H "${{ env.UPDATE_BRANCH_MERGED }}" "$@" || (git checkout "${{ env.UPDATE_BRANCH_MERGED }}" && gh pr edit "$@") - } - gh_pr_up -B "${{ steps.manage-branches.outputs.base_branch }}" \ - --title "Update from template (auto-merged)" \ - --body "An automated PR to sync changes from the template into this repo" - - # Wait a moment so that checks of PR have higher prio than following job - sleep 3 - - # Split into two jobs to help with executor starvation - auto-merge: - needs: [update] - if: needs.update.outputs.create_update_branch_merged_pr == 1 - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - with: - # Required because otherwise there are always changes detected when executing diff/rev-list - fetch-depth: 0 - # If no PAT is used the following error occurs on a push: - # refusing to allow a GitHub App to create or update workflow `.github/workflows/xxx.yml` without `workflows` permission - token: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - - - name: Init Git - run: | - git config --global user.email "111048771+xdev-gh-bot@users.noreply.github.com" - git config --global user.name "XDEV Bot" - - - name: Checking if auto-merge for PR update_branch_merged can be done - id: auto-merge-check - env: - GH_TOKEN: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - run: | - not_failed_conclusion="skipped|neutral|success" - not_relevant_app_slug="dependabot|github-pages|sonarqubecloud" - - echo "Waiting for checks to start..." - sleep 40s - - for i in {1..20}; do - echo "Checking if PR can be auto-merged. Try: $i" - - echo "Checking if update-branch-merged exists" - git fetch - if [[ $(git ls-remote --heads origin refs/heads/${{ env.UPDATE_BRANCH_MERGED }}) ]]; then - echo "Branch still exists; Continuing..." - else - echo "Branch origin/${{ env.UPDATE_BRANCH_MERGED }} is missing" - exit 0 - fi - - echo "Fetching checks" - cs_response=$(curl -sL \ - --fail-with-body \ - --connect-timeout 60 \ - --max-time 120 \ - -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer $GH_TOKEN" \ - -H "X-GitHub-Api-Version: 2022-11-28" \ - https://api.github.com/repos/${{ github.repository }}/commits/${{ needs.update.outputs.update_branch_merged_commit }}/check-suites) - - cs_data=$(echo $cs_response | jq '.check_suites[] | { conclusion: .conclusion, slug: .app.slug, check_runs_url: .check_runs_url }') - echo $cs_data - - if [[ -z "$cs_data" ]]; then - echo "No check suite data - Assuming that there are no checks to run" - - echo "perform=1" >> $GITHUB_OUTPUT - exit 0 - fi - - cs_failed=$(echo $cs_data | jq --arg x "$not_failed_conclusion" 'select ((.conclusion == null or (.conclusion | test($x))) | not)') - if [[ -z "$cs_failed" ]]; then - echo "No check failed so far; Checking if relevant checks are still running" - - cs_relevant_still_running=$(echo $cs_data | jq --arg x "$not_relevant_app_slug" 'select (.conclusion == null and (.slug | test($x) | not))') - if [[ -z $cs_relevant_still_running ]]; then - echo "All relevant checks finished - PR can be merged" - - echo "perform=1" >> $GITHUB_OUTPUT - exit 0 - else - echo "Relevant checks are still running" - echo $cs_relevant_still_running - fi - else - echo "Detected failed check" - echo $cs_failed - - echo "perform=0" >> $GITHUB_OUTPUT - exit 0 - fi - - echo "Waiting before next run..." - sleep 30s - done - - echo "Timed out - Assuming executor starvation - Forcing merge" - echo "perform=1" >> $GITHUB_OUTPUT - - - name: Auto-merge update_branch_merged - if: steps.auto-merge-check.outputs.perform == 1 - run: | - echo "Getting base branch" - base_branch=$(git branch --show-current) - echo "Base branch is $base_branch" - - echo "Fetching..." - git fetch - if [[ $(git rev-parse origin/${{ env.UPDATE_BRANCH_MERGED }}) ]]; then - echo "Branch still exists; Continuing..." - else - echo "Branch origin/${{ env.UPDATE_BRANCH_MERGED }} is missing" - exit 0 - fi - - expected_commit="${{ needs.update.outputs.update_branch_merged_commit }}" - actual_commit=$(git rev-parse origin/${{ env.UPDATE_BRANCH_MERGED }}) - if [[ "$expected_commit" != "$actual_commit" ]]; then - echo "Branch ${{ env.UPDATE_BRANCH_MERGED }} contains unexpected commit $actual_commit" - echo "Expected: $expected_commit" - - exit 0 - fi - - echo "Ensuring that current branch $base_branch is up-to-date" - git pull - - echo "Merging origin/${{ env.UPDATE_BRANCH_MERGED }} into $base_branch" - git merge origin/${{ env.UPDATE_BRANCH_MERGED }} && merge_exit_code=$? || merge_exit_code=$? - if [ $merge_exit_code -ne 0 ]; then - echo "Unexpected merge failure $merge_exit_code - Requires manual resolution" - - exit 0 - fi - - if [[ "${{ inputs.no_automatic_merge }}" == "true" ]]; then - echo "Exiting due no_automatic_merge" - - exit 0 - fi - - echo "Pushing" - git push - - echo "Cleaning up" - git branch -D ${{ env.UPDATE_BRANCH }} || true - git branch -D ${{ env.UPDATE_BRANCH_MERGED }} || true - git push -f origin --delete ${{ env.UPDATE_BRANCH }} || true - git push -f origin --delete ${{ env.UPDATE_BRANCH_MERGED }} || true From 410118a62ef1fad66e1af2179423041b79619972 Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 14 Apr 2026 17:54:38 +0200 Subject: [PATCH 089/150] Link Check: Only check md files --- .github/workflows/broken-links.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index d768259..130c748 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -20,6 +20,7 @@ jobs: id: lychee uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2 with: + args: "--verbose --no-progress './**/*.md'" fail: false # Don't fail on broken links, create an issue instead - name: Find already existing issue From 89d8065370beeec5991ee18674dabe5fba31c78c Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 14 Apr 2026 17:54:48 +0200 Subject: [PATCH 090/150] Link Check: Run when it's quiet --- .github/workflows/broken-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index 130c748..ce623e9 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -3,7 +3,7 @@ name: Broken links on: workflow_dispatch: schedule: - - cron: "23 23 * * 0" + - cron: "23 5 * * 0" permissions: issues: write From 7642f478fb87d0236e30c682c719b5c8aba826b4 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 18 Apr 2026 04:58:02 +0000 Subject: [PATCH 091/150] Update dependency maven to v3.9.15 --- .mvn/wrapper/maven-wrapper.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties index c595b00..5291372 100644 --- a/.mvn/wrapper/maven-wrapper.properties +++ b/.mvn/wrapper/maven-wrapper.properties @@ -1,3 +1,3 @@ wrapperVersion=3.3.4 distributionType=only-script -distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.14/apache-maven-3.9.14-bin.zip +distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.15/apache-maven-3.9.15-bin.zip From 72c1a6147b89882c84aac7067618b6834580779c Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 25 Apr 2026 05:01:11 +0000 Subject: [PATCH 092/150] Update net.sourceforge.pmd to v7.24.0 --- pom.xml | 4 ++-- template-placeholder/pom.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index 4fc6633..1c8fee5 100644 --- a/pom.xml +++ b/pom.xml @@ -83,12 +83,12 @@ net.sourceforge.pmd pmd-core - 7.23.0 + 7.24.0 net.sourceforge.pmd pmd-java - 7.23.0 + 7.24.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index d325a4a..3b33457 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,12 +253,12 @@ net.sourceforge.pmd pmd-core - 7.23.0 + 7.24.0 net.sourceforge.pmd pmd-java - 7.23.0 + 7.24.0 From 637f223b1fbbd2c7de764081ed9f394b381172a9 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Tue, 28 Apr 2026 05:20:22 +0000 Subject: [PATCH 093/150] Update dependency com.puppycrawl.tools:checkstyle to v13.4.1 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 4fc6633..4c28997 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.4.0 + 13.4.1 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index d325a4a..a107243 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.4.0 + 13.4.1 From ecfea4dd4ff4a9f27048e2afde2cdc332f8cd925 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 2 May 2026 05:15:29 +0000 Subject: [PATCH 094/150] Update dependency com.puppycrawl.tools:checkstyle to v13.4.2 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 7b060e9..d0719ce 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.4.1 + 13.4.2 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 7b67b90..54cbb73 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.4.1 + 13.4.2 From 83cf6d22ca9b07e9147b5282d12e609ede5de46e Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 6 May 2026 13:08:23 +0200 Subject: [PATCH 095/150] PMD: Fix AvoidListAsEntityRelation detection --- .config/pmd/java/ruleset.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 9dc7a0f..e42e77a 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -440,7 +440,7 @@ A `Set` also prevents duplicates when the ORM reads multiple identical rows from From 954833a39332536e930bc51c437c0629cab1dcbb Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 18 May 2026 05:36:59 +0000 Subject: [PATCH 096/150] Update dependency maven to v3.9.16 --- .mvn/wrapper/maven-wrapper.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties index 5291372..216df05 100644 --- a/.mvn/wrapper/maven-wrapper.properties +++ b/.mvn/wrapper/maven-wrapper.properties @@ -1,3 +1,3 @@ wrapperVersion=3.3.4 distributionType=only-script -distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.15/apache-maven-3.9.15-bin.zip +distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip From 9c67b4e8a22a21eaef9088d970d16f36b5ef2afc Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 30 May 2026 05:30:13 +0000 Subject: [PATCH 097/150] Update net.sourceforge.pmd to v7.25.0 --- pom.xml | 4 ++-- template-placeholder/pom.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index d0719ce..85ee217 100644 --- a/pom.xml +++ b/pom.xml @@ -83,12 +83,12 @@ net.sourceforge.pmd pmd-core - 7.24.0 + 7.25.0 net.sourceforge.pmd pmd-java - 7.24.0 + 7.25.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 54cbb73..533fe88 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,12 +253,12 @@ net.sourceforge.pmd pmd-core - 7.24.0 + 7.25.0 net.sourceforge.pmd pmd-java - 7.24.0 + 7.25.0 From 673dd461806bfead5a6a94e1818173df9ff339d2 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 31 May 2026 05:44:41 +0000 Subject: [PATCH 098/150] Update peaceiris/actions-gh-pages digest to 84c30a8 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2b7941b..ec86a3b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -191,7 +191,7 @@ jobs: working-directory: ${{ env.PRIMARY_MAVEN_MODULE }} - name: Deploy to Github pages - uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4 + uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4 with: github_token: ${{ secrets.GITHUB_TOKEN }} publish_dir: ./${{ env.PRIMARY_MAVEN_MODULE }}/target/site From f248edabd23898d15bf80ab5c4406e4d1aa75692 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 31 May 2026 05:44:43 +0000 Subject: [PATCH 099/150] Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index d0719ce..b24364f 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.4.2 + 13.5.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 54cbb73..438699a 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.4.2 + 13.5.0 From 42677ea89c9ed49b9d9fd971deee1510eac66965 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 1 Jun 2026 09:42:23 +0200 Subject: [PATCH 100/150] Add new checkstyle rule --- .config/checkstyle/checkstyle.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index ce1e09d..94a22c6 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -146,6 +146,7 @@ + From 52d7ca89d81f9945765b78ade40c989217adb28f Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 1 Jun 2026 09:48:49 +0200 Subject: [PATCH 101/150] Add new PMD 7.25 rules https://docs.pmd-code.org/pmd-doc-7.25.0/pmd_release_notes.html --- .config/pmd/java/ruleset.xml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index e42e77a..bc0e08b 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -13,6 +13,7 @@ + @@ -45,8 +46,10 @@ + + @@ -154,6 +157,7 @@ + From 04dec590d3039fe5076140abc8088e2e6ad480fb Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 2 Jun 2026 10:36:21 +0200 Subject: [PATCH 102/150] Detect another occurrence of PMD VaadinNativeHTMLIsUnsafe --- .config/pmd/java/ruleset.xml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index bc0e08b..b6d43e5 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -421,7 +421,8 @@ If you are 100% sure that you escaped the value properly and you have no better From b24deab774999ff42ad871ddbcc0d0857acd067b Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 15 Jun 2026 06:04:16 +0000 Subject: [PATCH 103/150] Update dependency com.puppycrawl.tools:checkstyle to v13.6.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index e7a6ccc..bb0d7cd 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.5.0 + 13.6.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 2d39a33..d19f477 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.5.0 + 13.6.0 From 47e6bea711e2eba5eb3bed280d7227941b9b0b96 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 17 Jun 2026 05:55:06 +0000 Subject: [PATCH 104/150] Update dependency org.sonatype.central:central-publishing-maven-plugin to v0.11.0 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 2d39a33..83dac3c 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -193,7 +193,7 @@ org.sonatype.central central-publishing-maven-plugin - 0.10.0 + 0.11.0 true sonatype-central-portal From bc0d82617f51e9f2cc007ba5799b8932c991c001 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 19 Jun 2026 05:54:58 +0000 Subject: [PATCH 105/150] Update actions/checkout action to v7 --- .github/workflows/broken-links.yml | 2 +- .github/workflows/report-gha-workflow-security-problems.yml | 2 +- .github/workflows/sync-labels.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index ce623e9..a6c3ed5 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -12,7 +12,7 @@ jobs: link-checker: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - run: mv .github/.lycheeignore .lycheeignore diff --git a/.github/workflows/report-gha-workflow-security-problems.yml b/.github/workflows/report-gha-workflow-security-problems.yml index b17aa53..7847028 100644 --- a/.github/workflows/report-gha-workflow-security-problems.yml +++ b/.github/workflows/report-gha-workflow-security-problems.yml @@ -17,7 +17,7 @@ jobs: # Only run this in our repos (Prevent notification spam by forks) if: ${{ github.repository_owner == 'xdev-software' }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Check id: check diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index c43365e..00e4016 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -15,7 +15,7 @@ jobs: labels: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: sparse-checkout: .github/labels.yml From 8a8b4cc84c6b0203e8d1dbac024be5ef035e1911 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 19 Jun 2026 05:56:32 +0000 Subject: [PATCH 106/150] Update actions/checkout action to v7 --- .github/workflows/broken-links.yml | 2 +- .github/workflows/report-gha-workflow-security-problems.yml | 2 +- .github/workflows/sync-labels.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index 7b1481c..fbe05e7 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - run: mv .github/.lycheeignore .lycheeignore diff --git a/.github/workflows/report-gha-workflow-security-problems.yml b/.github/workflows/report-gha-workflow-security-problems.yml index b17aa53..7847028 100644 --- a/.github/workflows/report-gha-workflow-security-problems.yml +++ b/.github/workflows/report-gha-workflow-security-problems.yml @@ -17,7 +17,7 @@ jobs: # Only run this in our repos (Prevent notification spam by forks) if: ${{ github.repository_owner == 'xdev-software' }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Check id: check diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 6471ce7..dc68d05 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: sparse-checkout: .github/labels.yml From 8304f63b02be48d9e76dda52d81d1dce189aace1 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 19 Jun 2026 05:58:14 +0000 Subject: [PATCH 107/150] Update actions/checkout action to v7 --- .github/workflows/broken-links.yml | 2 +- .github/workflows/check-build.yml | 6 +++--- .github/workflows/release.yml | 10 +++++----- .../report-gha-workflow-security-problems.yml | 2 +- .github/workflows/sync-labels.yml | 2 +- .github/workflows/test-deploy.yml | 2 +- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index 7b1481c..fbe05e7 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - run: mv .github/.lycheeignore .lycheeignore diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index daae7b2..6e76c0a 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -31,7 +31,7 @@ jobs: java: [17, 21, 25] distribution: [temurin] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up JDK uses: actions/setup-java@v5 @@ -84,7 +84,7 @@ jobs: java: [21] distribution: [temurin] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up JDK uses: actions/setup-java@v5 @@ -120,7 +120,7 @@ jobs: java: [17] distribution: [temurin] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up JDK uses: actions/setup-java@v5 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ec86a3b..db3d625 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up JDK uses: actions/setup-java@v5 @@ -63,7 +63,7 @@ jobs: outputs: upload_url: ${{ steps.create-release.outputs.upload_url }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Configure Git run: | @@ -115,7 +115,7 @@ jobs: needs: [prepare-release] timeout-minutes: 60 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Init Git and pull run: | @@ -163,7 +163,7 @@ jobs: needs: [prepare-release] timeout-minutes: 15 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Init Git and pull run: | @@ -202,7 +202,7 @@ jobs: needs: [publish-maven] timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Init Git and pull run: | diff --git a/.github/workflows/report-gha-workflow-security-problems.yml b/.github/workflows/report-gha-workflow-security-problems.yml index b17aa53..7847028 100644 --- a/.github/workflows/report-gha-workflow-security-problems.yml +++ b/.github/workflows/report-gha-workflow-security-problems.yml @@ -17,7 +17,7 @@ jobs: # Only run this in our repos (Prevent notification spam by forks) if: ${{ github.repository_owner == 'xdev-software' }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Check id: check diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 6471ce7..dc68d05 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: sparse-checkout: .github/labels.yml diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml index 2d13d77..96e5d2a 100644 --- a/.github/workflows/test-deploy.yml +++ b/.github/workflows/test-deploy.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up JDK uses: actions/setup-java@v5 From e534b508a04b1b3536edb0012d0a4ef9e9f71691 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 24 Jun 2026 05:33:56 +0000 Subject: [PATCH 108/150] Update actions/cache action to v6 --- .github/workflows/check-build.yml | 10 +++++----- .github/workflows/release.yml | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index daae7b2..6dd711d 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -40,7 +40,7 @@ jobs: java-version: ${{ matrix.java }} - name: Cache Maven - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.m2/repository key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} @@ -93,7 +93,7 @@ jobs: java-version: ${{ matrix.java }} - name: Cache Maven - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.m2/repository key: ${{ runner.os }}-mvn-checkstyle-${{ hashFiles('**/pom.xml') }} @@ -101,7 +101,7 @@ jobs: ${{ runner.os }}-mvn-checkstyle- - name: CheckStyle Cache - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: '**/target/checkstyle-cachefile' key: ${{ runner.os }}-checkstyle-${{ hashFiles('**/pom.xml') }} @@ -129,7 +129,7 @@ jobs: java-version: ${{ matrix.java }} - name: Cache Maven - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.m2/repository key: ${{ runner.os }}-mvn-pmd-${{ hashFiles('**/pom.xml') }} @@ -137,7 +137,7 @@ jobs: ${{ runner.os }}-mvn-pmd- - name: PMD Cache - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: '**/target/pmd/pmd.cache' key: ${{ runner.os }}-pmd-${{ hashFiles('**/pom.xml') }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ec86a3b..7397f6d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: # Try to reuse existing cache from check-build - name: Try restore Maven Cache - uses: actions/cache/restore@v5 + uses: actions/cache/restore@v6 with: path: ~/.m2/repository key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} @@ -179,7 +179,7 @@ jobs: # Try to reuse existing cache from check-build - name: Try restore Maven Cache - uses: actions/cache/restore@v5 + uses: actions/cache/restore@v6 with: path: ~/.m2/repository key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} From b81315ce203f473e76171f5f145dc645f73a708e Mon Sep 17 00:00:00 2001 From: AB Date: Thu, 25 Jun 2026 09:14:20 +0200 Subject: [PATCH 109/150] Bump IDEA checkstyle version --- .idea/checkstyle-idea.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.idea/checkstyle-idea.xml b/.idea/checkstyle-idea.xml index 27f72ce..3dbbcc7 100644 --- a/.idea/checkstyle-idea.xml +++ b/.idea/checkstyle-idea.xml @@ -1,7 +1,7 @@ - 13.4.0 + 13.5.0 JavaOnlyWithTests true true From bbc7ec47a5287a96fb3fc544dbaf879c3e35751f Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 29 Jun 2026 05:52:24 +0000 Subject: [PATCH 110/150] Update dependency com.puppycrawl.tools:checkstyle to v13.7.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index bb0d7cd..193ce99 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.6.0 + 13.7.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 4b2b736..c45d74f 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.6.0 + 13.7.0 From bf72b0de3e9b032dbbe6375813b23e585f01ebfe Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Tue, 30 Jun 2026 05:37:37 +0000 Subject: [PATCH 111/150] Update net.sourceforge.pmd to v7.26.0 --- pom.xml | 4 ++-- template-placeholder/pom.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index bb0d7cd..8a18319 100644 --- a/pom.xml +++ b/pom.xml @@ -83,12 +83,12 @@ net.sourceforge.pmd pmd-core - 7.25.0 + 7.26.0 net.sourceforge.pmd pmd-java - 7.25.0 + 7.26.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 4b2b736..b083f7d 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,12 +253,12 @@ net.sourceforge.pmd pmd-core - 7.25.0 + 7.26.0 net.sourceforge.pmd pmd-java - 7.25.0 + 7.26.0 From 793d3112bd42c9d5a5857fe45d06c9ecc0c7f3bc Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 1 Jul 2026 07:50:24 +0200 Subject: [PATCH 112/150] Enable new PMD 7.26 rule --- .config/pmd/java/ruleset.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index b6d43e5..8dde42b 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -141,6 +141,7 @@ + From 0fb2aeb6cd624b28815850fa5961d05defefc747 Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 1 Jul 2026 08:02:30 +0200 Subject: [PATCH 113/150] CheckStyle-IDEA: Always use lastest (bundled) version This prevents annoying popups whenever the plugin updates --- .idea/checkstyle-idea.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.idea/checkstyle-idea.xml b/.idea/checkstyle-idea.xml index 3dbbcc7..b8b753e 100644 --- a/.idea/checkstyle-idea.xml +++ b/.idea/checkstyle-idea.xml @@ -1,7 +1,7 @@ - 13.5.0 + latest JavaOnlyWithTests true true From b31eb4fef83348cce283031ae4fe9262eff9a02d Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 10 Jul 2026 07:38:32 +0000 Subject: [PATCH 114/150] Update lycheeverse/lychee-action digest to e747777 --- .github/workflows/broken-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index ce623e9..afdffd6 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -18,7 +18,7 @@ jobs: - name: Link Checker id: lychee - uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2 + uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2 with: args: "--verbose --no-progress './**/*.md'" fail: false # Don't fail on broken links, create an issue instead From d5d7f92b24db48c4ae8cdf68048876a480159b4a Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 12 Jul 2026 06:26:11 +0000 Subject: [PATCH 115/150] Update dependency com.puppycrawl.tools:checkstyle to v13.8.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 6eb41f9..9642b3f 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.7.0 + 13.8.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 9a861f9..c1cb551 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.7.0 + 13.8.0 From ebdb60b0a3f799e83803fc1850f685f470bd09a7 Mon Sep 17 00:00:00 2001 From: "Alex \"Blex\" B" <45384811+AB-xdev@users.noreply.github.com> Date: Tue, 14 Jul 2026 17:01:06 +0200 Subject: [PATCH 116/150] Update CONTRIBUTING.md Update recommended setup --- CONTRIBUTING.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2c7b025..c77eab3 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -23,14 +23,15 @@ You should have the following things installed: * Maven (Note that the [Maven Wrapper](https://maven.apache.org/wrapper/) is shipped with the repo) ### Recommended setup -* Install ``IntelliJ`` (Community Edition is sufficient) - * Install the following plugins: - * [Save Actions](https://plugins.jetbrains.com/plugin/22113) - Provides save actions, like running the formatter or adding ``final`` to fields - * [SonarLint](https://plugins.jetbrains.com/plugin/7973-sonarlint) - CodeStyle/CodeAnalysis - * You may consider disabling telemetry in the settings under ``Tools > Sonarlint -> About`` - * [Checkstyle-IDEA](https://plugins.jetbrains.com/plugin/1065-checkstyle-idea) - CodeStyle/CodeAnalysis +* Install `IntelliJ` + * Recommended setup actions + * Disable not needed plugins + * Disable [telemetry](https://www.jetbrains.com/help/idea/settings-usage-statistics.html) + * Consider [disabling the integrated webserver for security reasons](https://intellij-support.jetbrains.com/hc/en-us/community/posts/8125278285586-Internal-Local-ports-63342-6942?page=1#community_comment_8141506876562) using `-Didea.builtin.server.disabled=true` + * Configure the available memory * Import the project - * Ensure that everything is encoded in ``UTF-8`` + * You will get prompted to install the required plugins + * Ensure that everything is encoded in `UTF-8` * Ensure that the JDK/Java-Version is correct From 4dc1db8168698f69b147261da2ee21a478a190f4 Mon Sep 17 00:00:00 2001 From: "Alex \"Blex\" B" <45384811+AB-xdev@users.noreply.github.com> Date: Tue, 14 Jul 2026 17:18:14 +0200 Subject: [PATCH 117/150] Update CONTRIBUTING.md This options crashes the build --- CONTRIBUTING.md | 1 - 1 file changed, 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c77eab3..6e9dde5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -27,7 +27,6 @@ You should have the following things installed: * Recommended setup actions * Disable not needed plugins * Disable [telemetry](https://www.jetbrains.com/help/idea/settings-usage-statistics.html) - * Consider [disabling the integrated webserver for security reasons](https://intellij-support.jetbrains.com/hc/en-us/community/posts/8125278285586-Internal-Local-ports-63342-6942?page=1#community_comment_8141506876562) using `-Didea.builtin.server.disabled=true` * Configure the available memory * Import the project * You will get prompted to install the required plugins From 4fb1a7e3e80822a380661ffa753c5a10ca3296bb Mon Sep 17 00:00:00 2001 From: "Alex \"Blex\" B" <45384811+AB-xdev@users.noreply.github.com> Date: Wed, 22 Jul 2026 11:11:54 +0200 Subject: [PATCH 118/150] Delete .idea/PMDPlugin.xml Fixes #26 --- .idea/PMDPlugin.xml | 16 ---------------- 1 file changed, 16 deletions(-) delete mode 100644 .idea/PMDPlugin.xml diff --git a/.idea/PMDPlugin.xml b/.idea/PMDPlugin.xml deleted file mode 100644 index 0936e51..0000000 --- a/.idea/PMDPlugin.xml +++ /dev/null @@ -1,16 +0,0 @@ - - - - - - - \ No newline at end of file From fc631b210ab3cf80744fd32c465490efc0c5aafd Mon Sep 17 00:00:00 2001 From: "Alex \"Blex\" B" <45384811+AB-xdev@users.noreply.github.com> Date: Wed, 22 Jul 2026 11:12:19 +0200 Subject: [PATCH 119/150] Delete .idea/PMDPlugin.xml --- .idea/PMDPlugin.xml | 16 ---------------- 1 file changed, 16 deletions(-) delete mode 100644 .idea/PMDPlugin.xml diff --git a/.idea/PMDPlugin.xml b/.idea/PMDPlugin.xml deleted file mode 100644 index 0936e51..0000000 --- a/.idea/PMDPlugin.xml +++ /dev/null @@ -1,16 +0,0 @@ - - - - - - - \ No newline at end of file From 8e9182de91b1834ca393d23496428e375732197c Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 22 Jul 2026 11:41:35 +0200 Subject: [PATCH 120/150] Prevent creating variants of Util classes like "DBUtils" or "DBUtility" --- .config/checkstyle/checkstyle.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index 94a22c6..99b29e8 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -81,7 +81,7 @@ - + From 74e4ed9efcab40bba843215bb4ec6bec827740e9 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 23 Jul 2026 06:22:57 +0000 Subject: [PATCH 121/150] Update dependency com.mycila:license-maven-plugin to v5.1.1 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index c1cb551..9a455a9 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -68,7 +68,7 @@ com.mycila license-maven-plugin - 5.0.0 + 5.1.1 ${project.organization.url} From df60de3e16c8274afc947db6fd7351ba46c94b8a Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 25 Jul 2026 06:06:42 +0000 Subject: [PATCH 122/150] Update dependency org.codehaus.mojo:flatten-maven-plugin to v1.8.0 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index c1cb551..5ec5217 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -147,7 +147,7 @@ org.codehaus.mojo flatten-maven-plugin - 1.7.3 + 1.8.0 ossrh From ae1b42705d02def918a26b15083710400a47a1f1 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 27 Jul 2026 08:43:12 +0200 Subject: [PATCH 123/150] Disable UnusedTryResourceShouldBeUnnamed This is only relevant for projects that are using Java 25+ which most of libraries are not yet built against --- .config/checkstyle/checkstyle.xml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index 99b29e8..dcc19b4 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -146,7 +146,8 @@ - + + From eaa7a17d119aca0d783dd03fc9b13487a0e5c800 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 27 Jul 2026 06:55:39 +0000 Subject: [PATCH 124/150] Update dependency com.puppycrawl.tools:checkstyle to v13.9.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 9642b3f..333c1c2 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.8.0 + 13.9.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 2ffc513..202e05b 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.8.0 + 13.9.0 From d7bb00981e20e363c9a2300024cb882fab994349 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 3 Aug 2026 08:43:21 +0200 Subject: [PATCH 125/150] Update redirect links --- CONTRIBUTING.md | 4 ++-- README.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6e9dde5..ee364fd 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -12,7 +12,7 @@ We would absolutely love to get the community involved, and we welcome any form * **Send pull requests**
    If you want to contribute code, check out the development instructions below. * However when contributing larger new features, please first discuss the change you wish to make via issue with the owners of this repository before making it.
    Otherwise your work might be rejected and your effort was pointless. -We also encourage you to read the [contribution instructions by GitHub](https://docs.github.com/en/get-started/quickstart/contributing-to-projects). +We also encourage you to read the [contribution instructions by GitHub](https://docs.github.com/en/get-started/exploring-projects-on-github/contributing-to-a-project). ## Developing @@ -20,7 +20,7 @@ We also encourage you to read the [contribution instructions by GitHub](https:// You should have the following things installed: * Git * Java 25 - should be as unmodified as possible (Recommended: [Eclipse Adoptium](https://adoptium.net/temurin/releases/)) -* Maven (Note that the [Maven Wrapper](https://maven.apache.org/wrapper/) is shipped with the repo) +* Maven (Note that the [Maven Wrapper](https://maven.apache.org/tools/wrapper/) is shipped with the repo) ### Recommended setup * Install `IntelliJ` diff --git a/README.md b/README.md index 3b97901..e97be21 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ [Installation guide for the latest release](https://github.com/xdev-software/template-placeholder/releases/latest#Installation) ## Support -If you need support as soon as possible and you can't wait for any pull request, feel free to use [our support](https://xdev.software/en/services/support). +If you need support as soon as possible and you can't wait for any pull request, feel free to use [our support](https://xdev.software/en/services-products/support). ## Contributing See the [contributing guide](./CONTRIBUTING.md) for detailed instructions on how to get started with our project. From 05f54ff535e6b14a6a6d80f3ff683b3fc514d596 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 3 Aug 2026 08:47:07 +0200 Subject: [PATCH 126/150] Stackoverflow links return 403 when validated --- .github/.lycheeignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/.lycheeignore b/.github/.lycheeignore index dc88a07..217b0ae 100644 --- a/.github/.lycheeignore +++ b/.github/.lycheeignore @@ -1,3 +1,4 @@ # Ignorefile for broken link check localhost mvnrepository.com +stackoverflow.com From 19fce86358264d51c5dbbdb474931287625f9b1c Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 3 Aug 2026 09:19:46 +0200 Subject: [PATCH 127/150] CS 13.9 remove removed JavadocStyle and replace it with JavadocContentLocation --- .config/checkstyle/checkstyle.xml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index dcc19b4..b585880 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -87,9 +87,7 @@ - - - + From 25c8893930922162b91150eeb6023d79c81dccb2 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 3 Aug 2026 14:15:55 +0200 Subject: [PATCH 128/150] Update pmd-x.xml --- .idea/pmd-x.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.idea/pmd-x.xml b/.idea/pmd-x.xml index 260e454..7b3b48f 100644 --- a/.idea/pmd-x.xml +++ b/.idea/pmd-x.xml @@ -10,6 +10,7 @@     From bc90eb704e7189136c3fedf393c7ce444b1d363d Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 4 Aug 2026 08:28:46 +0200 Subject: [PATCH 129/150] Fix redirect link --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ee364fd..390a0cf 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -4,7 +4,7 @@ We would absolutely love to get the community involved, and we welcome any form ### Communication channels * Communication is primarily done using issues. -* If you need support as soon as possible and you can't wait for any pull request, feel free to use [our support](https://xdev.software/en/services/support). +* If you need support as soon as possible and you can't wait for any pull request, feel free to use [our support](https://xdev.software/en/services-products/support). * As a last resort measure or on otherwise important matter you may also [contact us directly](https://xdev.software/en/about-us/contact). ### Ways to help From 867b1fef77e8a7f8b1063ee5c227c437a752378f Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 7 Aug 2026 04:01:16 +0000 Subject: [PATCH 130/150] Update shogo82148/actions-create-release digest to 8674c0e --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6133d1a..dc0033e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -91,7 +91,7 @@ jobs: - name: Create Release id: create-release - uses: shogo82148/actions-create-release@6a396031bc74c57403da1018fec74d24c6aa03cd # v1 + uses: shogo82148/actions-create-release@8674c0ecee617c8dfb006526bcc22a362c70b88a # v1 with: tag_name: v${{ steps.version.outputs.release }} release_name: v${{ steps.version.outputs.release }} From 9be12abd04f2ef265cddf8e6a09762b1f86e3311 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 10 Aug 2026 03:36:47 +0000 Subject: [PATCH 131/150] Update dependency com.puppycrawl.tools:checkstyle to v13.10.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 333c1c2..30343dc 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.9.0 + 13.10.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 202e05b..15881e9 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.9.0 + 13.10.0 From 64dedb0ed09bc0cc2f17f45e63a5b59bc0666ebd Mon Sep 17 00:00:00 2001 From: "Alex \"Blex\" B" <45384811+AB-xdev@users.noreply.github.com> Date: Thu, 20 Aug 2026 11:44:21 +0200 Subject: [PATCH 132/150] Add hint to additional information that people can include screenshots or video recordings if they wish --- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 033bcdb..24f2519 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -61,4 +61,4 @@ body: attributes: label: Additional information description: | - Any other relevant information you'd like to include + Any other relevant information you'd like to include, e.g. screenshots or video recordings of the bug From 93bd66d271838bff4ba3faef24b75bb1d6ae2d88 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Tue, 25 Aug 2026 03:20:40 +0000 Subject: [PATCH 133/150] Update actions/setup-java action to v6 --- .github/workflows/check-build.yml | 6 +++--- .github/workflows/release.yml | 8 ++++---- .github/workflows/test-deploy.yml | 4 ++-- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index 0cd2d9b..da6afa9 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -34,7 +34,7 @@ jobs: - uses: actions/checkout@v7 - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} @@ -87,7 +87,7 @@ jobs: - uses: actions/checkout@v7 - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} @@ -123,7 +123,7 @@ jobs: - uses: actions/checkout@v7 - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dc0033e..3ce89fc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ jobs: - uses: actions/checkout@v7 - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: java-version: '17' distribution: 'temurin' @@ -124,7 +124,7 @@ jobs: git pull - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: # running setup-java overwrites the settings.xml distribution: 'temurin' java-version: '17' @@ -141,7 +141,7 @@ jobs: MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: # running setup-java again overwrites the settings.xml distribution: 'temurin' java-version: '17' @@ -172,7 +172,7 @@ jobs: git pull - name: Setup - Java - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: java-version: '17' distribution: 'temurin' diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml index 96e5d2a..9f66506 100644 --- a/.github/workflows/test-deploy.yml +++ b/.github/workflows/test-deploy.yml @@ -14,7 +14,7 @@ jobs: - uses: actions/checkout@v7 - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: # running setup-java overwrites the settings.xml distribution: 'temurin' java-version: '17' @@ -31,7 +31,7 @@ jobs: MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: # running setup-java again overwrites the settings.xml distribution: 'temurin' java-version: '17' From ee3a9cbc799f72be8e50cf7039955f0aeb272f0c Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 31 Aug 2026 08:55:55 +0200 Subject: [PATCH 134/150] Add new CheckStyle rules for v14 --- .config/checkstyle/checkstyle.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index b585880..cd40139 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -65,6 +65,7 @@ + @@ -144,6 +145,7 @@ + From 501e65a2c7340ea27e8e06046b62e531a07b6843 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Tue, 1 Sep 2026 03:04:23 +0000 Subject: [PATCH 135/150] Update dependency com.mycila:license-maven-plugin to v5.1.2 --- template-placeholder/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 15881e9..f449e8b 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -68,7 +68,7 @@ com.mycila license-maven-plugin - 5.1.1 + 5.1.2 ${project.organization.url} From 70c35248d434103e6aca58a78595c3a5e136eeb1 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Tue, 1 Sep 2026 03:04:27 +0000 Subject: [PATCH 136/150] Update net.sourceforge.pmd to v7.27.0 --- pom.xml | 4 ++-- template-placeholder/pom.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index 30343dc..3706fdd 100644 --- a/pom.xml +++ b/pom.xml @@ -83,12 +83,12 @@ net.sourceforge.pmd pmd-core - 7.26.0 + 7.27.0 net.sourceforge.pmd pmd-java - 7.26.0 + 7.27.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 15881e9..f204888 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,12 +253,12 @@ net.sourceforge.pmd pmd-core - 7.26.0 + 7.27.0 net.sourceforge.pmd pmd-java - 7.26.0 + 7.27.0 From 77fb7552e27b74d6399f3b08cd4516adbb5e2830 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Tue, 1 Sep 2026 03:04:29 +0000 Subject: [PATCH 137/150] Update dependency com.puppycrawl.tools:checkstyle to v14 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 30343dc..cb336fe 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.10.0 + 14.1.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 15881e9..71687b4 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.10.0 + 14.1.0 From 3070996074a88089b368915929aa397db28a84a4 Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 1 Sep 2026 16:45:03 +0200 Subject: [PATCH 138/150] PMD 7.27: Fix deprecation --- .config/pmd/java/ruleset.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 8dde42b..4c72bf2 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -169,7 +169,7 @@ - + From b2fe65b41da5ca50862aead385c1d222a0541c28 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Wed, 2 Sep 2026 03:04:02 +0000 Subject: [PATCH 139/150] Update dependency org.junit.jupiter:junit-jupiter-api to v6.1.3 --- expiring-limited-cache/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/expiring-limited-cache/pom.xml b/expiring-limited-cache/pom.xml index a42a853..afdaff4 100644 --- a/expiring-limited-cache/pom.xml +++ b/expiring-limited-cache/pom.xml @@ -64,7 +64,7 @@ org.junit.jupiter junit-jupiter-api - 6.0.3 + 6.1.3 test From 8fc9c92a0c74f81f4f823dffe004b4ca210f6ca9 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 3 Sep 2026 04:04:15 +0000 Subject: [PATCH 140/150] Update dependency org.apache.maven.plugins:maven-compiler-plugin to v3.16.0 --- expiring-limited-cache-demo/pom.xml | 2 +- expiring-limited-cache/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/expiring-limited-cache-demo/pom.xml b/expiring-limited-cache-demo/pom.xml index 988b877..9188445 100644 --- a/expiring-limited-cache-demo/pom.xml +++ b/expiring-limited-cache-demo/pom.xml @@ -50,7 +50,7 @@ org.apache.maven.plugins maven-compiler-plugin - 3.15.0 + 3.16.0 ${maven.compiler.release} diff --git a/expiring-limited-cache/pom.xml b/expiring-limited-cache/pom.xml index a42a853..1e9fffd 100644 --- a/expiring-limited-cache/pom.xml +++ b/expiring-limited-cache/pom.xml @@ -117,7 +117,7 @@ org.apache.maven.plugins maven-compiler-plugin - 3.15.0 + 3.16.0 compile-java-17 From 0bd1668f16d140a3e1c1434a8b4ab96ec1decf81 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 4 Sep 2026 03:01:45 +0000 Subject: [PATCH 141/150] Update dependency org.apache.maven.plugins:maven-surefire-plugin to v3.6.0 --- expiring-limited-cache/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/expiring-limited-cache/pom.xml b/expiring-limited-cache/pom.xml index a42a853..a0d44ab 100644 --- a/expiring-limited-cache/pom.xml +++ b/expiring-limited-cache/pom.xml @@ -183,7 +183,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.5.5 + 3.6.0 From 5714c313f1c0e84bd479d1cba163dd32bf77625e Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 5 Sep 2026 03:01:58 +0000 Subject: [PATCH 142/150] Update org.slf4j to v2.0.19 --- expiring-limited-cache-demo/pom.xml | 2 +- expiring-limited-cache/pom.xml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/expiring-limited-cache-demo/pom.xml b/expiring-limited-cache-demo/pom.xml index 988b877..47e29ef 100644 --- a/expiring-limited-cache-demo/pom.xml +++ b/expiring-limited-cache-demo/pom.xml @@ -39,7 +39,7 @@ org.slf4j slf4j-simple - 2.0.17 + 2.0.19 diff --git a/expiring-limited-cache/pom.xml b/expiring-limited-cache/pom.xml index a42a853..66e5c90 100644 --- a/expiring-limited-cache/pom.xml +++ b/expiring-limited-cache/pom.xml @@ -53,12 +53,12 @@ org.slf4j slf4j-api - 2.0.17 + 2.0.19 org.slf4j slf4j-simple - 2.0.17 + 2.0.19 test From ac8a7771515093356b32850b5f7fb8e677a4bc3b Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 15 Sep 2026 16:55:56 +0200 Subject: [PATCH 143/150] Add centralized contribution guide with AI policy attached to it Context: https://github.com/xdev-software/github/issues/41 `DEVELOPING.md` is meant for project specific development instructions e.g. what is required for building, releasing and so on --- CONTRIBUTING.md | 56 +++++++++++++++++++++++++++++++++++++++++++++++++ DEVELOPING.md | 0 2 files changed, 56 insertions(+) create mode 100644 CONTRIBUTING.md create mode 100644 DEVELOPING.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..0dfa56b --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,56 @@ +# Contributing + +We would absolutely love to get the community involved and we welcome any form of contributions - comments and questions, issues, pull request and anything that you build and share using our project. + +## Communication channels +* Communication is primarily done using issues. +* If you need support as soon as possible and you can't wait for any pull request, feel free to use [our support](https://xdev.software/en/services-products/support). +* As a last resort measure or on otherwise important matter you may also [contact us directly](https://xdev.software/en/about-us/contact). + +## Ways to help +* **Report bugs**
    Create an issue and send a pull request +* **Send pull requests**
    If you want to contribute code, check out the development instructions below. + * However when contributing larger new features, please first discuss the change you wish to make via issue with the owners of this repository before making it.
    Otherwise your work might be rejected and your effort was pointless. + * Please also note that your pull request might not be noticed immediately when it's not attached to an issue. + +We also encourage you to read the [contribution instructions by GitHub](https://docs.github.com/en/get-started/exploring-projects-on-github/contributing-to-a-project). + +## Developing + +Project specific development instructions can be found in [DEVELOPING.md](./DEVELOPING.md) + + +## On AI use / LLM generated content + +_Our reason for the strict policy is due to [unqualified people using the technology](https://en.wikipedia.org/wiki/AI_slop)._ + +This policy was inspired by the AI policies of `curl`, `MESA`, `matplotlib` and `Ghostty`. + +### Issues and security reports + +If you asked an AI tool to find problems in the project, you must make sure to reveal this fact in your issue. + +You must also double-check the findings carefully before reporting them to us to validate that the issue is indeed existing and working exactly as the AI says. AI-based tools frequently generate inaccurate or fabricated results. + +Further: It is rarely a good idea to copy and paste an AI generated report to the project. Those are typically too wordy and rarely to the point - in addition to the common fabricated details.
    +If you actually find a problem with an AI and you have verified it yourself to be true: Write the issue/report yourself and explain the problem as you have learned it. This makes sure the AI-generated inaccuracies and invented issues are filtered out early before they waste more people's time. + +As we take security reports seriously, we investigate each report with priority. This work is both time and energy consuming and pulls us away from doing other meaningful work. Fake and otherwise made up security problems effectively prevent us from doing real project work and make us waste time and resources. + +We will ban and report users who submit made up fake reports. + +### Pull requests + +When contributing content to the project, you give us permission to use it as-is and you must make sure you are allowed to distribute it to us. By submitting a change to us, you agree that the changes can and should be adopted and get redistributed under the project's license. Authors should be explicitly aware that the burden is on them to ensure no unlicensed code is submitted to the project. + +This is independent if AI is used or not. + +When contributing a pull request you should of course always make sure that the proposal is good quality and a best effort that follows our guidelines. A basic rule of thumb is that if someone can spot that the contribution was made with the help of AI, you have more work to do. + +We can accept code written with the help of AI into the project, but the code must still follow coding standards, be written clearly and adhere to all the normal requirements we have. + +### Further notices + +* External AI tooling (e.g. bots, agents) directly interacting with the project - without a human - are not allowed and will be banned and reported. +* For commit messages the same guidelines as described above for issues apply - fully generated messages are not allowed. +* AI assisted/generated commits can NOT use the `Co-authored-by` tag as this is reserved for humans - use `Assisted-by` instead. diff --git a/DEVELOPING.md b/DEVELOPING.md new file mode 100644 index 0000000..e69de29 From 1cb7ab0211196cbd5516b66479f3b8effc844758 Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 16 Sep 2026 13:06:10 +0200 Subject: [PATCH 144/150] Update renovate.json5 --- renovate.json5 | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/renovate.json5 b/renovate.json5 index 2874d45..1e1f3c0 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -2,6 +2,16 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "rebaseWhen": "behind-base-branch", "packageRules": [ + { + "description": "Don't manage Java version in actions", + "matchDepTypes": [ + "uses-with" + ], + "matchDatasources": [ + "java-version" + ], + "enabled": false + }, { "description": "Ignore project internal dependencies", "packagePattern": "^software.xdev:template-placeholder", From 8a4f1728f3a93e72f7d0ff379c0c6bef7f9e4370 Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 16 Sep 2026 13:15:26 +0200 Subject: [PATCH 145/150] Fix typo and reword --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0dfa56b..54d09e0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -53,4 +53,4 @@ We can accept code written with the help of AI into the project, but the code mu * External AI tooling (e.g. bots, agents) directly interacting with the project - without a human - are not allowed and will be banned and reported. * For commit messages the same guidelines as described above for issues apply - fully generated messages are not allowed. -* AI assisted/generated commits can NOT use the `Co-authored-by` tag as this is reserved for humans - use `Assisted-by` instead. +* AI assisted/generated commits can NOT use the `Co-authored-by` tag as this is reserved for humans - use `Assisted-by`/`Generated-by` instead. From 54a6f6050493e325bab4584dd507df720c859f3e Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 16 Sep 2026 13:29:06 +0200 Subject: [PATCH 146/150] Fill in DEVELOPING.md --- DEVELOPING.md | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/DEVELOPING.md b/DEVELOPING.md index e69de29..a852082 100644 --- a/DEVELOPING.md +++ b/DEVELOPING.md @@ -0,0 +1,56 @@ +### Software Requirements +You should have the following things installed: +* Git +* Java 25 - should be as unmodified as possible (Recommended: [Eclipse Adoptium](https://adoptium.net/temurin/releases/)) +* Maven (Note that the [Maven Wrapper](https://maven.apache.org/tools/wrapper/) is shipped with the repo) + +### Recommended setup +* Install `IntelliJ` + * Recommended setup actions + * Disable not needed plugins + * Disable [telemetry](https://www.jetbrains.com/help/idea/settings-usage-statistics.html) + * Configure the available memory + * Import the project + * You will get prompted to install the required plugins + * Ensure that everything is encoded in `UTF-8` + * Ensure that the JDK/Java-Version is correct + + +## Releasing [![Build](https://img.shields.io/github/actions/workflow/status/xdev-software/template-placeholder/release.yml?branch=master)](https://github.com/xdev-software/template-placeholder/actions/workflows/release.yml) + +Before releasing: +* Consider doing a [test-deployment](https://github.com/xdev-software/template-placeholder/actions/workflows/test-deploy.yml?query=branch%3Adevelop) before actually releasing. +* Check the [changelog](CHANGELOG.md) + +If the ``develop`` is ready for release, create a pull request to the ``master``-Branch and merge the changes + +When the release is finished do the following: +* Merge the auto-generated PR (with the incremented version number) back into the ``develop`` + +### Release failures + +There are 2 modes of release failure: +1. The remote server was e.g. down and non of the artifacts got published +2. There was a build failure during release and only parts of the artifacts got released + +In case 1 we can re-release the existing version,
    in case 2 we have to release a new version when we can't get the artifacts deleted (as is the case with Maven Central) + +#### How-to: Re-Releasing an existing version + +1. Delete the release on GitHub +2. Delete the release Git tag from the repo (locally and remote!) +3. Delete the ``master``-Branch and re-create it from the ``develop`` branch (or reset it to the state before the release-workflow commits have been done) + * This requires __temporarily__ removing the branch protection + * Once this was done a new release is triggered immediately! + +#### How-to: Releasing a new version + +1. Merge the ``master`` branch back into ``develop`` (or another temporary branch) +2. Make sure all master branch versions are prepared for a new release
    e.g. if the broken release was ``1.0.0`` the version should now be at ``1.0.1-SNAPSHOT`` - the ``SNAPSHOT`` is important for the workflow! +3. Mark the broken release as broken e.g. inside the Changelog, GitHub Release page, etc.
    +You can use something like this: + ``` + > [!WARNING] + > This release is broken as my cat accidentally clicked the abort button during the process + ``` +4. Merge the changes back into the ``master`` branch to trigger a new release From 8fcd26b21e515237ff65ce7401613e1c7e9552dc Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 16 Sep 2026 13:50:52 +0200 Subject: [PATCH 147/150] Use the power of parallelization in GHA --- .github/workflows/check-build.yml | 27 ++++++++++++++------------- .github/workflows/release.yml | 29 +++++++++++++++-------------- 2 files changed, 29 insertions(+), 27 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index da6afa9..1b75608 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -33,19 +33,20 @@ jobs: steps: - uses: actions/checkout@v7 - - name: Set up JDK - uses: actions/setup-java@v6 - with: - distribution: ${{ matrix.distribution }} - java-version: ${{ matrix.java }} - - - name: Cache Maven - uses: actions/cache@v6 - with: - path: ~/.m2/repository - key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} - restore-keys: | - ${{ runner.os }}-mvn-build- + - parallel: + - name: Set up JDK + uses: actions/setup-java@v6 + with: + distribution: ${{ matrix.distribution }} + java-version: ${{ matrix.java }} + + - name: Cache Maven + uses: actions/cache@v6 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-mvn-build- - name: Build with Maven run: ./mvnw -B clean package diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3ce89fc..008ec2c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,20 +20,21 @@ jobs: steps: - uses: actions/checkout@v7 - - name: Set up JDK - uses: actions/setup-java@v6 - with: - java-version: '17' - distribution: 'temurin' - - # Try to reuse existing cache from check-build - - name: Try restore Maven Cache - uses: actions/cache/restore@v6 - with: - path: ~/.m2/repository - key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} - restore-keys: | - ${{ runner.os }}-mvn-build- + - parallel: + - name: Set up JDK + uses: actions/setup-java@v6 + with: + java-version: '17' + distribution: 'temurin' + + # Try to reuse existing cache from check-build + - name: Try restore Maven Cache + uses: actions/cache/restore@v6 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-mvn-build- - name: Build with Maven run: ./mvnw -B clean package -T2C From 66af1c957676f95efbf71147ea909ee2638de5f4 Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 16 Sep 2026 13:53:53 +0200 Subject: [PATCH 148/150] Use parallelization in GHA --- .github/workflows/check-build.yml | 78 ++++++++++++++++--------------- 1 file changed, 40 insertions(+), 38 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index 1b75608..c28c5ea 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -87,27 +87,28 @@ jobs: steps: - uses: actions/checkout@v7 - - name: Set up JDK - uses: actions/setup-java@v6 - with: - distribution: ${{ matrix.distribution }} - java-version: ${{ matrix.java }} + - parallel: + - name: Set up JDK + uses: actions/setup-java@v6 + with: + distribution: ${{ matrix.distribution }} + java-version: ${{ matrix.java }} - - name: Cache Maven - uses: actions/cache@v6 - with: - path: ~/.m2/repository - key: ${{ runner.os }}-mvn-checkstyle-${{ hashFiles('**/pom.xml') }} - restore-keys: | - ${{ runner.os }}-mvn-checkstyle- + - name: Cache Maven + uses: actions/cache@v6 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-mvn-checkstyle-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-mvn-checkstyle- - - name: CheckStyle Cache - uses: actions/cache@v6 - with: - path: '**/target/checkstyle-cachefile' - key: ${{ runner.os }}-checkstyle-${{ hashFiles('**/pom.xml') }} - restore-keys: | - ${{ runner.os }}-checkstyle- + - name: CheckStyle Cache + uses: actions/cache@v6 + with: + path: '**/target/checkstyle-cachefile' + key: ${{ runner.os }}-checkstyle-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-checkstyle- - name: Run Checkstyle run: ./mvnw -B checkstyle:check -P checkstyle -T2C @@ -123,27 +124,28 @@ jobs: steps: - uses: actions/checkout@v7 - - name: Set up JDK - uses: actions/setup-java@v6 - with: - distribution: ${{ matrix.distribution }} - java-version: ${{ matrix.java }} + - parallel: + - name: Set up JDK + uses: actions/setup-java@v6 + with: + distribution: ${{ matrix.distribution }} + java-version: ${{ matrix.java }} - - name: Cache Maven - uses: actions/cache@v6 - with: - path: ~/.m2/repository - key: ${{ runner.os }}-mvn-pmd-${{ hashFiles('**/pom.xml') }} - restore-keys: | - ${{ runner.os }}-mvn-pmd- + - name: Cache Maven + uses: actions/cache@v6 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-mvn-pmd-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-mvn-pmd- - - name: PMD Cache - uses: actions/cache@v6 - with: - path: '**/target/pmd/pmd.cache' - key: ${{ runner.os }}-pmd-${{ hashFiles('**/pom.xml') }} - restore-keys: | - ${{ runner.os }}-pmd- + - name: PMD Cache + uses: actions/cache@v6 + with: + path: '**/target/pmd/pmd.cache' + key: ${{ runner.os }}-pmd-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-pmd- - name: Run PMD run: ./mvnw -B test pmd:aggregate-pmd-no-fork pmd:check -P pmd -DskipTests -T2C From 5fca13464538fa3e76c2c373851488c2945f515f Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 16 Sep 2026 14:17:15 +0200 Subject: [PATCH 149/150] Remove dynamically inserted project --- DEVELOPING.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/DEVELOPING.md b/DEVELOPING.md index a852082..10d175e 100644 --- a/DEVELOPING.md +++ b/DEVELOPING.md @@ -16,16 +16,16 @@ You should have the following things installed: * Ensure that the JDK/Java-Version is correct -## Releasing [![Build](https://img.shields.io/github/actions/workflow/status/xdev-software/template-placeholder/release.yml?branch=master)](https://github.com/xdev-software/template-placeholder/actions/workflows/release.yml) +## Releasing Before releasing: -* Consider doing a [test-deployment](https://github.com/xdev-software/template-placeholder/actions/workflows/test-deploy.yml?query=branch%3Adevelop) before actually releasing. +* Consider doing a `test-deployment` before actually releasing. * Check the [changelog](CHANGELOG.md) -If the ``develop`` is ready for release, create a pull request to the ``master``-Branch and merge the changes +If the `develop` is ready for release, create a pull request to the `master`-Branch and merge the changes When the release is finished do the following: -* Merge the auto-generated PR (with the incremented version number) back into the ``develop`` +* Merge the auto-generated PR (with the incremented version number) back into the `develop` ### Release failures From 933ec22c54e46ed62dcace732806bd4e9ced9c71 Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 16 Sep 2026 14:47:04 +0200 Subject: [PATCH 150/150] Update min Java to 21 VirtualThreads --- CHANGELOG.md | 3 ++ expiring-limited-cache-demo/pom.xml | 6 +-- expiring-limited-cache/pom.xml | 26 +----------- .../DefaultCreator.java | 11 ++--- .../DefaultCreator.java | 42 ------------------- pom.xml | 2 +- 6 files changed, 12 insertions(+), 78 deletions(-) delete mode 100644 expiring-limited-cache/src/main/java21/software/xdev/caching/scheduledexecutorservice/DefaultCreator.java diff --git a/CHANGELOG.md b/CHANGELOG.md index 687f5e5..feb012c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,6 @@ +# 2.3.0 +* Update minimum Java version to 21 + # 2.2.3 * Re-Release due to Sonatype/Maven Central incorrectly claiming that the previous release is incorrectly signed #153 diff --git a/expiring-limited-cache-demo/pom.xml b/expiring-limited-cache-demo/pom.xml index c71d3c6..5063dee 100644 --- a/expiring-limited-cache-demo/pom.xml +++ b/expiring-limited-cache-demo/pom.xml @@ -7,11 +7,11 @@ software.xdev expiring-limited-cache-root - 2.2.4-SNAPSHOT + 2.3.0-SNAPSHOT expiring-limited-cache-demo - 2.2.4-SNAPSHOT + 2.3.0-SNAPSHOT jar @@ -20,7 +20,7 @@ - 17 + 21 ${javaVersion} UTF-8 diff --git a/expiring-limited-cache/pom.xml b/expiring-limited-cache/pom.xml index 3950371..c75d730 100644 --- a/expiring-limited-cache/pom.xml +++ b/expiring-limited-cache/pom.xml @@ -6,7 +6,7 @@ software.xdev expiring-limited-cache - 2.2.4-SNAPSHOT + 2.3.0-SNAPSHOT jar expiring-limited-cache @@ -42,7 +42,7 @@ - 17 + 21 ${javaVersion} UTF-8 @@ -118,28 +118,6 @@ org.apache.maven.plugins maven-compiler-plugin 3.16.0 - - - compile-java-17 - - compile - - - - compile-java-21 - compile - - compile - - - 21 - - ${project.basedir}/src/main/java21 - - true - - - ${maven.compiler.release} diff --git a/expiring-limited-cache/src/main/java/software/xdev/caching/scheduledexecutorservice/DefaultCreator.java b/expiring-limited-cache/src/main/java/software/xdev/caching/scheduledexecutorservice/DefaultCreator.java index 5dd364c..253d3c3 100644 --- a/expiring-limited-cache/src/main/java/software/xdev/caching/scheduledexecutorservice/DefaultCreator.java +++ b/expiring-limited-cache/src/main/java/software/xdev/caching/scheduledexecutorservice/DefaultCreator.java @@ -18,22 +18,17 @@ import java.util.concurrent.Executors; import java.util.concurrent.ScheduledExecutorService; import java.util.concurrent.ScheduledThreadPoolExecutor; -import java.util.concurrent.atomic.AtomicInteger; public final class DefaultCreator { public static ScheduledExecutorService create() { - final AtomicInteger counter = new AtomicInteger(0); final ScheduledExecutorService scheduledExecutorService = Executors.newScheduledThreadPool( 1, - r -> { - final Thread thread = new Thread(r); - thread.setName("ELC-Cleanup-" + counter.getAndIncrement()); - thread.setDaemon(true); - return thread; - }); + Thread.ofVirtual() + .name("ELC-Cleanup-", 0) + .factory()); if(scheduledExecutorService instanceof final ScheduledThreadPoolExecutor scheduledThreadPoolExecutor) { scheduledThreadPoolExecutor.setRemoveOnCancelPolicy(true); diff --git a/expiring-limited-cache/src/main/java21/software/xdev/caching/scheduledexecutorservice/DefaultCreator.java b/expiring-limited-cache/src/main/java21/software/xdev/caching/scheduledexecutorservice/DefaultCreator.java deleted file mode 100644 index 253d3c3..0000000 --- a/expiring-limited-cache/src/main/java21/software/xdev/caching/scheduledexecutorservice/DefaultCreator.java +++ /dev/null @@ -1,42 +0,0 @@ -/* - * Copyright © 2024 XDEV Software (https://xdev.software) - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package software.xdev.caching.scheduledexecutorservice; - -import java.util.concurrent.Executors; -import java.util.concurrent.ScheduledExecutorService; -import java.util.concurrent.ScheduledThreadPoolExecutor; - - -public final class DefaultCreator -{ - public static ScheduledExecutorService create() - { - final ScheduledExecutorService scheduledExecutorService = Executors.newScheduledThreadPool( - 1, - Thread.ofVirtual() - .name("ELC-Cleanup-", 0) - .factory()); - if(scheduledExecutorService instanceof final ScheduledThreadPoolExecutor scheduledThreadPoolExecutor) - { - scheduledThreadPoolExecutor.setRemoveOnCancelPolicy(true); - } - return scheduledExecutorService; - } - - private DefaultCreator() - { - } -} diff --git a/pom.xml b/pom.xml index 3f89f96..aaa1fdd 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ software.xdev expiring-limited-cache-root - 2.2.4-SNAPSHOT + 2.3.0-SNAPSHOT pom