Skip to content

Improved: Introduce a Gradle version catalog for dependency versions (OFBIZ-13487) #1606

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mridulpathak merged 1 commit into from
Aug 9, 2026
+311 −100
Merged

Improved: Introduce a Gradle version catalog for dependency versions (OFBIZ-13487) #1606

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
189 changes: 89 additions & 100 deletions dependencies.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,120 +17,109 @@
* under the License.
*/
dependencies {
implementation 'com.drewnoakes:metadata-extractor:2.20.0'
implementation 'com.github.ben-manes.caffeine:caffeine:3.2.4'
implementation 'com.google.guava:guava:33.6.0-jre'
implementation 'com.google.zxing:core:3.5.4'
implementation 'com.googlecode.concurrentlinkedhashmap:concurrentlinkedhashmap-lru:1.4.2'
implementation 'com.googlecode.ez-vcard:ez-vcard:0.12.2'
implementation 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20240325.1'
implementation 'com.googlecode.libphonenumber:libphonenumber:8.13.55'
implementation 'com.ibm.icu:icu4j:76.1'
implementation 'com.github.librepdf:openpdf:1.4.2' // This is the last version with com.lowagie.text that is used (only) by PdfSurveyServices class.
implementation 'jakarta.mail:jakarta.mail-api:2.1.5'
implementation 'org.eclipse.angus:angus-mail:2.0.5'
implementation 'com.rometools:rome:2.1.0'
implementation 'com.thoughtworks.xstream:xstream:1.4.21'
implementation 'commons-cli:commons-cli:1.11.0'
implementation 'commons-net:commons-net:3.13.0'
implementation 'commons-validator:commons-validator:1.10.1'
implementation 'javax.activation:activation:1.1.1'
implementation 'javax.transaction:javax.transaction-api:1.3'
implementation 'net.fortuna.ical4j:ical4j:1.0-rc4-atlassian-12'
implementation 'net.lingala.zip4j:zip4j:2.11.6'
implementation 'org.activiti:activiti-juel-jakarta:8.1.0'
implementation 'org.apache.ant:ant-junit:1.10.17'
implementation 'org.apache.commons:commons-collections4:4.5.0'
implementation 'org.apache.commons:commons-csv:1.14.1'
implementation 'org.apache.commons:commons-dbcp2:2.14.0'
implementation 'org.apache.commons:commons-fileupload2-jakarta:2.0.0-M1'
implementation 'org.apache.commons:commons-imaging:1.0-alpha3' // Alpha but OK, "Imaging was working and was used by a number of projects in production even before reaching its initial release as an Apache Commons component." Since 1.0.0-alpha4 (note the use of semver) the API has changed. Better wait an "official release" to rewrite OFBiz code...
implementation 'org.apache.commons:commons-text:1.15.0'
implementation 'org.apache.geronimo.components:geronimo-transaction:3.1.5' // 4.0.0 does not compile
implementation 'org.apache.geronimo.specs:geronimo-jms_1.1_spec:1.1.1'
implementation 'org.apache.httpcomponents:httpclient-cache:4.5.14'
implementation 'org.apache.logging.log4j:log4j-api:2.25.4' // the API of log4j 2
implementation 'org.apache.logging.log4j:log4j-core:2.25.4' // Somehow needed by Buildbot to compile OFBizDynamicThresholdFilter.java
implementation 'org.apache.logging.log4j:log4j-layout-template-json:2.25.4' // JSON/ECS structured logging profile (log4j2-json.xml)
implementation 'org.apache.poi:poi:5.5.1'
implementation 'org.apache.pdfbox:pdfbox:3.0.7'
implementation 'org.apache.pdfbox:pdfbox-io:3.0.7'
implementation 'org.apache.shiro:shiro-core:1.13.0' // Got "Exception in thread "main" java.lang.UnsupportedOperationException: Cannot create a hash with the given algorithm: argon2" with 2.0.2 in integration tests
implementation 'org.apache.shiro:shiro-crypto-cipher:2.1.0'
implementation 'org.apache.sshd:sshd-core:2.17.1'
implementation 'org.apache.sshd:sshd-sftp:2.17.1'
implementation 'org.apache.tika:tika-core:3.3.1'
implementation 'org.apache.tika:tika-parsers:3.3.1'
implementation 'org.apache.tika:tika-parser-pdf-module:3.3.1'
implementation 'org.apache.cxf:cxf-rt-frontend-jaxrs:4.2.0'
implementation 'org.apache.tomcat:tomcat-catalina-ha:10.1.56' // Remember to change the version number (10 now) in javadoc block if needed.
implementation 'org.apache.tomcat:tomcat-jasper:10.1.56'
implementation 'org.apache.axis2:axis2-kernel:1.8.2'
implementation 'org.apache.xmlgraphics:batik-anim:1.19'
implementation 'org.apache.xmlgraphics:batik-util:1.19'
implementation 'org.apache.xmlgraphics:batik-bridge:1.19'
implementation 'org.apache.xmlgraphics:fop:2.11'
implementation 'org.clojure:clojure:1.12.4'
implementation 'org.apache.groovy:groovy-all:5.0.5'
implementation 'org.freemarker:freemarker:2.3.34' // Remember to change the version number in FreeMarkerWorker class when upgrading. See OFBIZ-10019 if >= 2.4
implementation 'org.owasp.esapi:esapi:2.7.0.0'
implementation 'org.springframework:spring-test:6.2.18'
implementation 'org.springframework:spring-web:6.2.18'
implementation 'com.fasterxml.jackson.core:jackson-databind:2.21.3'
implementation 'org.glassfish.jersey.containers:jersey-container-servlet:3.1.11'
implementation 'org.glassfish.jersey.inject:jersey-hk2:3.1.11'
implementation 'org.glassfish.jersey.media:jersey-media-multipart:3.1.11'
implementation 'org.glassfish.jersey.media:jersey-media-json-jackson:3.1.11'
implementation 'io.swagger.core.v3:swagger-jaxrs2:2.2.50'
implementation 'io.swagger.core.v3:swagger-jaxrs2-servlet-initializer:2.2.50'
implementation 'io.swagger.core.v3:swagger-annotations:2.2.50'
implementation 'oro:oro:2.0.8'
implementation 'wsdl4j:wsdl4j:1.6.3'
implementation 'com.auth0:java-jwt:4.5.2'
implementation 'com.auth0:jwks-rsa:0.24.0'
implementation 'org.jdom:jdom2:2.0.6.1'
implementation 'com.google.re2j:re2j:1.8'
implementation 'xerces:xercesImpl:2.12.2'
implementation('org.mustangproject:library:2.24.0') {
implementation libs.metadata.extractor
implementation libs.caffeine
implementation libs.guava
implementation libs.zxing.core
implementation libs.concurrentlinkedhashmap.lru
implementation libs.ez.vcard
implementation libs.owasp.java.html.sanitizer
implementation libs.libphonenumber
implementation libs.icu4j
implementation libs.openpdf
implementation libs.jakarta.mail.api
implementation libs.angus.mail
implementation libs.rome
implementation libs.xstream
implementation libs.commons.cli
implementation libs.commons.net
implementation libs.commons.validator
implementation libs.javax.activation
implementation libs.javax.transaction.api
implementation libs.ical4j
implementation libs.zip4j
implementation libs.activiti.juel.jakarta
implementation libs.ant.junit
implementation libs.commons.collections4
implementation libs.commons.csv
implementation libs.commons.dbcp2
implementation libs.commons.fileupload2.jakarta
implementation libs.commons.imaging
implementation libs.commons.text
implementation libs.geronimo.transaction
implementation libs.geronimo.jms.spec
implementation libs.httpclient.cache
implementation libs.log4j.api // the API of log4j 2
implementation libs.log4j.core // Somehow needed by Buildbot to compile OFBizDynamicThresholdFilter.java
implementation libs.log4j.layout.template.json // JSON/ECS structured logging profile (log4j2-json.xml)
implementation libs.poi
implementation libs.bundles.pdfbox
implementation libs.shiro.core
implementation libs.shiro.crypto.cipher
implementation libs.sshd.core
implementation libs.sshd.sftp
implementation libs.bundles.tika
implementation libs.cxf.rt.frontend.jaxrs
implementation libs.tomcat.catalina.ha
implementation libs.tomcat.jasper
implementation libs.axis2.kernel
implementation libs.bundles.batik
implementation libs.fop
implementation libs.clojure
implementation libs.groovy.all
implementation libs.freemarker
implementation libs.esapi
implementation libs.spring.test
implementation libs.spring.web
implementation libs.jackson.databind
implementation libs.bundles.jersey
implementation libs.bundles.swagger
implementation libs.oro
implementation libs.wsdl4j
implementation libs.java.jwt
implementation libs.jwks.rsa
implementation libs.jdom2
implementation libs.re2j
implementation libs.xerces.impl
implementation(libs.mustangproject.library) {
exclude group: 'pull-parser', module: 'pull-parser'
exclude group: 'xpp3', module: 'xpp3'
}

implementation 'org.junit.jupiter:junit-jupiter-api:6.1.0'
implementation 'org.junit.platform:junit-platform-launcher:6.1.0'
runtimeOnly 'org.junit.jupiter:junit-jupiter-engine:6.1.0'
implementation libs.junit.jupiter.api
implementation libs.junit.platform.launcher
runtimeOnly libs.junit.jupiter.engine

testImplementation 'org.junit.jupiter:junit-jupiter-params:6.1.0'
testImplementation 'org.junit.platform:junit-platform-launcher:6.1.0'
testImplementation 'org.hamcrest:hamcrest-library:2.2'
testImplementation 'org.mockito:mockito-core:5.23.0'
testImplementation libs.junit.jupiter.params
testImplementation libs.junit.platform.launcher
testImplementation libs.hamcrest.library
testImplementation libs.mockito.core

runtimeOnly 'javax.xml.soap:javax.xml.soap-api:1.4.0'
runtimeOnly 'net.sf.barcode4j:barcode4j-fop-ext:2.1'
runtimeOnly 'net.sf.barcode4j:barcode4j:2.1'
runtimeOnly 'org.apache.avalon.framework:avalon-framework-impl:4.3.1'
runtimeOnly 'org.apache.axis2:axis2-transport-http:1.8.2'
runtimeOnly 'org.apache.axis2:axis2-transport-local:1.8.2'
runtimeOnly 'com.h2database:h2:2.4.240'
runtimeOnly 'org.apache.geronimo.specs:geronimo-jaxrpc_1.1_spec:2.1'
runtimeOnly 'org.apache.logging.log4j:log4j-1.2-api:2.25.4' // for external jars using the old log4j1.2: routes logging to log4j 2
runtimeOnly 'org.apache.logging.log4j:log4j-jul:2.25.4' // for external jars using the java.util.logging: routes logging to log4j 2
runtimeOnly 'org.apache.logging.log4j:log4j-slf4j2-impl:2.25.4' // for external jars using slf4j 2.x: routes logging to log4j 2
runtimeOnly 'org.apache.logging.log4j:log4j-web:2.25.4' //???
runtimeOnly 'org.apache.logging.log4j:log4j-jcl:2.25.4' // need to constrain to version to avoid classpath conflict (ReflectionUtil)
runtimeOnly libs.javax.xml.soap.api
runtimeOnly libs.barcode4j.fop.ext
runtimeOnly libs.barcode4j.core
runtimeOnly libs.avalon.framework.impl
runtimeOnly libs.axis2.transport.http
runtimeOnly libs.axis2.transport.local
runtimeOnly libs.h2
runtimeOnly libs.geronimo.jaxrpc.spec
runtimeOnly libs.log4j.legacy.api // for external jars using the old log4j1.2: routes logging to log4j 2
runtimeOnly libs.log4j.jul // for external jars using the java.util.logging: routes logging to log4j 2
runtimeOnly libs.log4j.slf4j2.impl // for external jars using slf4j 2.x: routes logging to log4j 2
runtimeOnly libs.log4j.web //???
runtimeOnly libs.log4j.jcl // need to constrain to version to avoid classpath conflict (ReflectionUtil)

// specify last codenarc version for java 17 compliance
codenarc('org.codenarc:CodeNarc:3.7.0-groovy-4.0')
codenarc(libs.codenarc)

// use constraints to update transitive dependencies
constraints {
implementation('org.apache.james:apache-mime4j-core:0.8.14') {
implementation(libs.apache.mime4j.core) {
because 'CVE-2024-21742'
}
implementation('org.bouncycastle:bcprov-jdk18on:1.84') {
implementation(libs.bcprov.jdk18on) {
because 'CVE-2024-29857, CVE-2024-30171, CVE-2024-30172, CVE-2024-34447'
}
implementation('org.testng:testng:7.12.0') {
implementation(libs.testng) {
because 'CVE-2022-4065'
}
}
Expand Down
Loading
Loading