Repository: CycloneDX/cyclonedx-maven-plugin
Pull request #478 (2024-03-20 11:16:15)

Bump org.apache.maven.plugins:maven-compiler-plugin from 3.12.1 to 3.13.0
Bumps [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) from 3.12.1 to 3.13.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/apache/maven-compiler-plugin/releases">org.apache.maven.plugins:maven-compiler-plugin's releases</a>.</em></p>
<blockquote>
<h2>3.13.0</h2>
<!-- raw HTML omitted -->
<h2>🚀 New features and improvements</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/MCOMPILER-574">[MCOMPILER-574]</a> - Propagate cause of exception in AbstractCompilerMojo (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/232">#232</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/MCOMPILER-582">[MCOMPILER-582]</a> - Automatic detection of release option for JDK &lt; 9 (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/228">#228</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/MCOMPILER-583">[MCOMPILER-583]</a> - Require Maven 3.6.3 (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/229">#229</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/MCOMPILER-577">[MCOMPILER-577]</a> - Rename parameter &quot;forceJavacCompilerUse&quot; (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/225">#225</a>) <a href="https://github.com/kwin"><code>@​kwin</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/MCOMPILER-570">[MCOMPILER-570]</a> - Add links to javac documentation of JDK17 (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/224">#224</a>) <a href="https://github.com/kwin"><code>@​kwin</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/MCOMPILER-576">[MCOMPILER-576]</a> - Deprecate parameter &quot;compilerVersion&quot; (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/223">#223</a>) <a href="https://github.com/kwin"><code>@​kwin</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/MCOMPILER-575">[MCOMPILER-575]</a> - Bump plexusCompilerVersion from 2.14.2 to 2.15.0 (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/227">#227</a>) <a href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
<li>Bump apache/maven-gh-actions-shared from 3 to 4 (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/226">#226</a>) <a href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
</ul>
<h2>📝 Documentation updates</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/MCOMPILER-548">[MCOMPILER-548]</a> - JDK 21 throws annotations processing warning that can not be turned off (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/200">#200</a>) <a href="https://github.com/hgschmie"><code>@​hgschmie</code></a></li>
</ul>
<h2>👻 Maintenance</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/MCOMPILER-584">[MCOMPILER-584]</a> - Refresh page - Using Non-Javac Compilers (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/231">#231</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/MCOMPILER-585">[MCOMPILER-585]</a> - Refresh plugins versions in ITs (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/230">#230</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li>subject verb agreement (<a href="https://redirect.github.com/apache/maven-compiler-plugin/pull/221">#221</a>) <a href="https://github.com/elharo"><code>@​elharo</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/apache/maven-compiler-plugin/commit/a1415aa3833df5985ecdc2b854ef516d3afbf348"><code>a1415aa</code></a> [maven-release-plugin] prepare release maven-compiler-plugin-3.13.0</li>
<li><a href="https://github.com/apache/maven-compiler-plugin/commit/b2b9196f61198daddcac513d849c0d808e02c8d7"><code>b2b9196</code></a> [MCOMPILER-574] Propagate cause of exception in AbstractCompilerMojo</li>
<li><a href="https://github.com/apache/maven-compiler-plugin/commit/6d2ce5a46507ea6c44c2d4a81aaf183baad2784e"><code>6d2ce5a</code></a> [MCOMPILER-584] Refresh page - Using Non-Javac Compilers</li>
<li><a href="https://github.com/apache/maven-compiler-plugin/commit/eebad60f7500c3db44050f599d5fc13f01af116b"><code>eebad60</code></a> [MCOMPILER-585] Refresh plugins versions in ITs</li>
<li><a href="https://github.com/apache/maven-compiler-plugin/commit/ceacf6884dc98be921f78cbb6de9a88213955471"><code>ceacf68</code></a> [MCOMPILER-582] Automatic detection of release option for JDK &lt; 9</li>
<li><a href="https://github.com/apache/maven-compiler-plugin/commit/110293f730f03bd2361aafb39789055b52efe6ab"><code>110293f</code></a> [MCOMPILER-583] Require Maven 3.6.3</li>
<li><a href="https://github.com/apache/maven-compiler-plugin/commit/90131df544a466a7d2f35e2c1da88f56b2b9368e"><code>90131df</code></a> [MCOMPILER-575] Bump plexusCompilerVersion from 2.14.2 to 2.15.0 (<a href="https://redirect.github.com/apache/maven-compiler-plugin/issues/227">#227</a>)</li>
<li><a href="https://github.com/apache/maven-compiler-plugin/commit/74cfc72acae4f55708bca189b2170167e83df6b3"><code>74cfc72</code></a> [MCOMPILER-548] JDK 21 throws annotations processing warning that can not be ...</li>
<li><a href="https://github.com/apache/maven-compiler-plugin/commit/f85aa27d7cc28664ed7cfdd19b8e250652a66471"><code>f85aa27</code></a> Bump apache/maven-gh-actions-shared from 3 to 4</li>
<li><a href="https://github.com/apache/maven-compiler-plugin/commit/d59ef49ead31f7d85c24f98ca6747f9b3a1906a2"><code>d59ef49</code></a> extract Maven 3.3.1 specific method call</li>
<li>Additional commits viewable in <a href="https://github.com/apache/maven-compiler-plugin/compare/maven-compiler-plugin-3.12.1...maven-compiler-plugin-3.13.0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.apache.maven.plugins:maven-compiler-plugin&package-manager=maven&previous-version=3.12.1&new-version=3.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/pom.xml b/pom.xml
index de13987..dbc0785 100644
--- a/pom.xml
+++ b/pom.xml
@@ -332,7 +332,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-compiler-plugin</artifactId>
-                    <version>3.12.1</version>
+                    <version>3.13.0</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
diff --git a/src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java b/src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java
index 8a4aac4..78e6dd8 100644
--- a/src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java
+++ b/src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java
@@ -82,6 +82,7 @@ public abstract class BaseCycloneDxMojo extends AbstractMojo {
      */
     @Parameter(property = "schemaVersion", defaultValue = "1.5", required = false)
     private String schemaVersion;
+    private CycloneDxSchema.Version effectiveSchemaVersion = null;
 
     /**
      * The CycloneDX output format that should be generated (<code>xml</code>, <code>json</code> or <code>all</code>).
@@ -311,6 +312,10 @@ public abstract class BaseCycloneDxMojo extends AbstractMojo {
             }
             return;
         }
+        if (!schemaVersion().getVersionString().equals(schemaVersion)) {
+            getLog().warn("Invalid schemaVersion configured '" + schemaVersion +"', using " + effectiveSchemaVersion.getVersionString());
+            schemaVersion = effectiveSchemaVersion.getVersionString();
+        }
         logParameters();
 
         // top level components do not currently set their scope, we track these to prevent merging of scopes
@@ -465,19 +470,22 @@ public abstract class BaseCycloneDxMojo extends AbstractMojo {
      * @return the CycloneDX schema to use
      */
     protected CycloneDxSchema.Version schemaVersion() {
-        if ("1.0".equals(schemaVersion)) {
-            return CycloneDxSchema.Version.VERSION_10;
-        } else if ("1.1".equals(schemaVersion)) {
-            return CycloneDxSchema.Version.VERSION_11;
-        } else if ("1.2".equals(schemaVersion)) {
-            return CycloneDxSchema.Version.VERSION_12;
-        } else if ("1.3".equals(schemaVersion)) {
-            return CycloneDxSchema.Version.VERSION_13;
-        } else if ("1.4".equals(schemaVersion)) {
-            return CycloneDxSchema.Version.VERSION_14;
-        } else {
-            return CycloneDxSchema.Version.VERSION_15;
+        if (effectiveSchemaVersion == null) {
+            if ("1.0".equals(schemaVersion)) {
+                effectiveSchemaVersion = CycloneDxSchema.Version.VERSION_10;
+            } else if ("1.1".equals(schemaVersion)) {
+                effectiveSchemaVersion = CycloneDxSchema.Version.VERSION_11;
+            } else if ("1.2".equals(schemaVersion)) {
+                effectiveSchemaVersion = CycloneDxSchema.Version.VERSION_12;
+            } else if ("1.3".equals(schemaVersion)) {
+                effectiveSchemaVersion = CycloneDxSchema.Version.VERSION_13;
+            } else if ("1.4".equals(schemaVersion)) {
+                effectiveSchemaVersion = CycloneDxSchema.Version.VERSION_14;
+            } else {
+                effectiveSchemaVersion = CycloneDxSchema.Version.VERSION_15;
+            }
         }
+        return effectiveSchemaVersion;
     }
 
     protected void logAdditionalParameters() {


Test patch:
diff --git a/src/test/java/org/cyclonedx/maven/VerboseTest.java b/src/test/java/org/cyclonedx/maven/VerboseTest.java
index 2b3355e..7072813 100644
--- a/src/test/java/org/cyclonedx/maven/VerboseTest.java
+++ b/src/test/java/org/cyclonedx/maven/VerboseTest.java
@@ -2,6 +2,7 @@ package org.cyclonedx.maven;
 
 import java.io.File;
 
+import org.cyclonedx.CycloneDxSchema;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
@@ -47,4 +48,19 @@ public class VerboseTest extends BaseMavenVerifier {
                 .assertErrorFreeLog()
                 .assertLogText("[INFO] CycloneDX: Parameters"); // check goal verbose output
     }
+
+    @Test
+    public void testUnsupportedSchemaVersionCli() throws Exception {
+        File projDir = resources.getBasedir("verbose");
+
+        verifier
+                .forProject(projDir)
+                .withCliOption("-Dcurrent.version=" + getCurrentVersion()) // inject cyclonedx-maven-plugin version
+                .withCliOption("-B")
+                .withCliOption("-DschemaVersion=1.5.1")
+                .execute("verify")
+                .assertErrorFreeLog()
+                .assertLogText("[WARNING] Invalid schemaVersion configured '1.5.1', using " + CycloneDxSchema.VERSION_LATEST.getVersionString()) // check warning on invalid schema version
+                .assertLogText("[INFO] CycloneDX: Creating BOM version " + CycloneDxSchema.VERSION_LATEST.getVersionString() + " with 0 component(s)"); // and display effective schema version
+    }
 }