Upgrade Dependencies and Refactor POMs #482
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
change pom configs so that project can be compiled with java 8
upgrade commons-io from 2.5 to 2.21.0 due to multiple vulnerabilities
upgrade JUnit from 4.12 to 5.14.1 due to multiple vulnerabilities
upgrade slf4j-api from 1.8.0-beta4 to 2.0.17 upgrade slf4j-simple from 1.8.0-beta4 to 2.0.17 upgrade commons-codec from 1.10 to 1.20.0
upgrade maven-compiler-plugin from 3.8.1 to 3.14.1 upgrade maven-source-plugin from 3.0.1 to 3.3.1 upgrade maven-javadoc-plugin from 3.4.0 to 3.12.0 upgrade maven-gpg-plugin from 1.6 to 3.2.8 upgrade maven-resources-plugin from 3.1.0 to 3.3.1 upgrade maven-release-plugin from 3.0.0-M5 to 3.1.1 upgrade maven-dependency-plugin from 3.3.0 to 3.8.1 upgrade nexus-staging-maven-plugin from 1.6.13 to 1.7.0
upgrade aspectj-maven-plugin from 1.14.0 to 1.15.0
Parent POM changes: - Remove deprecated <prerequisites> tag - Add version properties for all dependencies and plugins - Add to dependencyManagement: aspectjrt, aspectjtools, commons-io, commons-codec - Add to pluginManagement: maven-dependency-plugin, aspectj-maven-plugin - Update SCM tag from 'mp4parser-project-1.9.43' to 'HEAD' Child POM changes: - Remove redundant elements inherited from parent: - <groupId>, <url>, <properties>, <licenses>, <developers>, <scm> - Remove hardcoded dependency versions (now managed by parent) - Remove hardcoded plugin versions (now managed by parent) - Remove duplicate 'release-sign-artifacts' profile from streaming - Remove <defaultGoal> from isoparser (inherited from parent)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Maven POM Modernization and Security Fixes
Background
While attempting to use
org.mp4parser:isoparser:1.9.56as a dependency, security scanners flagged multiple vulnerabilities in its transitive dependencies. This PR addresses those vulnerabilities and modernizes the build configuration.Security Vulnerabilities Addressed
FileNameUtils.normalize()XmlStreamReaderCPU exhaustionTemporaryFolderDependency Upgrades
Plugin Upgrades
Structural Improvements
Centralized Dependency Management
<dependencyManagement>in parent POM for all shared dependenciesjunit-bomfor consistent JUnit version management${project.version}instead of hardcoded1.9.57-SNAPSHOTCentralized Plugin Management
maven-source-plugin,maven-javadoc-pluginwere declared twice)maven-gpg-pluginhad 1.5 and 1.6)Fixed AspectJ Configuration
complianceLevel/source/targetfrom 9 to 1.8 (was inconsistent with Java 8 target)slf4-api.jar→slf4j-api.jarCleanup
<prerequisites>tag<licenses>,<developers>,<scm>,<url>,<groupId>,<properties>)release-sign-artifactsprofile from streaming modulemp4parser-project-1.9.43→HEADResults
Not Addressed
Warning
nexus-staging-maven-pluginstill references OSSRH (https://oss.sonatype.org/) which shut down June 2025. A separate migration tocentral-publishing-maven-pluginis required for Maven Central publishing.