8ccfd638b2
Follow-up to the Dependabot action-bump merges and the cargo-deny ignore (#271). Three low-risk supply-chain housekeeping changes — config/docs only, no library code, no runtime change. ## 1. `osv-scanner.toml` (new) The OpenSSF Scorecard *Vulnerabilities* check runs OSV-Scanner over the repo and was flagging five advisory IDs (`score is 5`). These reduce to three findings, all assessed as not affecting Wickra: | Advisory | Assessment | |----------|------------| | RUSTSEC-2026-0176 / GHSA-36hh-v3qg-5jq4 (pyo3) | Vulnerable API unused; fix is pyo3 0.29 but rust-numpy 0.28 pins pyo3 `^0.28` → upstream-blocked. Already in `deny.toml`. | | RUSTSEC-2026-0177 / GHSA-chgr-c6px-7xpp (pyo3) | Same — `PyCFunction::new_closure` not called. Already in `deny.toml`. | | GHSA-72hv-8253-57qq (jackson-core 3.x) | **Not a dependency of this project.** No manifest, Maven plugin, or the GitHub dependency-graph SBOM references `tools.jackson` 3.x; the only jackson present is `com.fasterxml.jackson.core:jackson-databind` 2.17.1. | `osv-scanner.toml` records these as ignored-with-reason at the OSV layer, mirroring `deny.toml` and the SECURITY.md VEX section. The Scorecard finding also flip-flopped (fixed → reappeared) across unrelated release-bump commits, confirming it is not a stable real exposure. ## 2. Bump `central-publishing-maven-plugin` 0.5.0 → 0.10.0 The Java binding pinned a publishing plugin five versions behind. Validated locally with the JDK 22 toolchain (`mvn -Prelease validate`): the extension loads, the existing `publishingServerId`/`autoPublish` config is compatible, and all 14 binding tests pass. The actual `mvn deploy` upload path is only exercised at release time (needs the Central token + GPG key), so it will be confirmed at the next release. ## 3. Add a Maven ecosystem to Dependabot The Java binding had no Dependabot coverage, which is why the stale 0.5.0 plugin went unnoticed. Adds `package-ecosystem: maven` over `/bindings/java`, `/bindings/java/benchmarks`, and `/examples/java` so plugin and dependency updates (incl. the examples' jackson) are tracked going forward.
172 lines
5.7 KiB
XML
172 lines
5.7 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
<modelVersion>4.0.0</modelVersion>
|
|
|
|
<groupId>org.wickra</groupId>
|
|
<artifactId>wickra</artifactId>
|
|
<version>0.8.8</version>
|
|
<packaging>jar</packaging>
|
|
|
|
<name>Wickra</name>
|
|
<description>High-performance streaming technical-analysis indicators (514 indicators) for the
|
|
JVM, backed by the native Rust core through the Wickra C ABI via the Java FFM API (Panama).</description>
|
|
<url>https://github.com/wickra-lib/wickra</url>
|
|
|
|
<licenses>
|
|
<license>
|
|
<name>MIT</name>
|
|
<url>https://opensource.org/licenses/MIT</url>
|
|
<distribution>repo</distribution>
|
|
</license>
|
|
<license>
|
|
<name>Apache-2.0</name>
|
|
<url>https://www.apache.org/licenses/LICENSE-2.0</url>
|
|
<distribution>repo</distribution>
|
|
</license>
|
|
</licenses>
|
|
|
|
<developers>
|
|
<developer>
|
|
<id>kingchenc</id>
|
|
<name>kingchenc</name>
|
|
<url>https://github.com/kingchenc</url>
|
|
</developer>
|
|
</developers>
|
|
|
|
<scm>
|
|
<connection>scm:git:https://github.com/wickra-lib/wickra.git</connection>
|
|
<developerConnection>scm:git:https://github.com/wickra-lib/wickra.git</developerConnection>
|
|
<url>https://github.com/wickra-lib/wickra</url>
|
|
</scm>
|
|
|
|
<properties>
|
|
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
|
|
<maven.compiler.release>22</maven.compiler.release>
|
|
<junit.version>5.10.2</junit.version>
|
|
<!-- The FFM API is restricted; grant native access to the unnamed module so
|
|
tests and examples run without warnings. Consumers pass the same flag. -->
|
|
<native.access.arg>--enable-native-access=ALL-UNNAMED</native.access.arg>
|
|
</properties>
|
|
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.junit.jupiter</groupId>
|
|
<artifactId>junit-jupiter</artifactId>
|
|
<version>${junit.version}</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
</dependencies>
|
|
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-compiler-plugin</artifactId>
|
|
<version>3.13.0</version>
|
|
</plugin>
|
|
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-surefire-plugin</artifactId>
|
|
<version>3.2.5</version>
|
|
<configuration>
|
|
<argLine>${native.access.arg}</argLine>
|
|
</configuration>
|
|
</plugin>
|
|
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-jar-plugin</artifactId>
|
|
<version>3.4.1</version>
|
|
<configuration>
|
|
<archive>
|
|
<manifestEntries>
|
|
<!-- Grant native access when the jar is run directly. -->
|
|
<Enable-Native-Access>ALL-UNNAMED</Enable-Native-Access>
|
|
</manifestEntries>
|
|
</archive>
|
|
</configuration>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
|
|
<profiles>
|
|
<!--
|
|
Release profile (CI only, gated): attaches source + javadoc jars, GPG-signs
|
|
every artifact, and publishes to Maven Central via the central-publishing
|
|
plugin. The native libraries are unpacked from the wickra-c-<triple>.tar.gz
|
|
release assets into src/main/resources/native/<os>-<arch>/ before `mvn deploy`,
|
|
so the published jar carries every platform's library.
|
|
-->
|
|
<profile>
|
|
<id>release</id>
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-source-plugin</artifactId>
|
|
<version>3.3.1</version>
|
|
<executions>
|
|
<execution>
|
|
<id>attach-sources</id>
|
|
<goals><goal>jar-no-fork</goal></goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-javadoc-plugin</artifactId>
|
|
<version>3.7.0</version>
|
|
<configuration>
|
|
<!-- Generated members are self-descriptive; do not fail on doclint. -->
|
|
<doclint>none</doclint>
|
|
<quiet>true</quiet>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<id>attach-javadocs</id>
|
|
<goals><goal>jar</goal></goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-gpg-plugin</artifactId>
|
|
<version>3.2.4</version>
|
|
<executions>
|
|
<execution>
|
|
<id>sign-artifacts</id>
|
|
<phase>verify</phase>
|
|
<goals><goal>sign</goal></goals>
|
|
<configuration>
|
|
<!-- Non-interactive signing on CI: modern GPG needs loopback
|
|
pinentry to take the passphrase from the env without a TTY. -->
|
|
<gpgArguments>
|
|
<arg>--pinentry-mode</arg>
|
|
<arg>loopback</arg>
|
|
</gpgArguments>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
|
|
<plugin>
|
|
<groupId>org.sonatype.central</groupId>
|
|
<artifactId>central-publishing-maven-plugin</artifactId>
|
|
<version>0.10.0</version>
|
|
<extensions>true</extensions>
|
|
<configuration>
|
|
<publishingServerId>central</publishingServerId>
|
|
<autoPublish>true</autoPublish>
|
|
</configuration>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</profile>
|
|
</profiles>
|
|
</project>
|