Repository: SAP/cloud-security-xsuaa-integration
Pull request #779 (2021-12-28 10:03:47)

Bump system-lambda from 1.2.0 to 1.2.1
Bumps [system-lambda](https://github.com/stefanbirkner/system-lambda) from 1.2.0 to 1.2.1.
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/stefanbirkner/system-lambda/commit/a5b7f466aeb32f2c237a08c3de6200ffdd9e850e"><code>a5b7f46</code></a> Replace assertThrownBy with assertThrows</li>
<li><a href="https://github.com/stefanbirkner/system-lambda/commit/76f4b1d4abcebb3110e760ddcff139bcbba51188"><code>76f4b1d</code></a> Test System Lambda with different Java versions</li>
<li><a href="https://github.com/stefanbirkner/system-lambda/commit/a359b6e3c1c784a3959cdbe34187753f152a8c20"><code>a359b6e</code></a> Run GitHub Actions on all branches</li>
<li><a href="https://github.com/stefanbirkner/system-lambda/commit/5e206a703e2900e0d3e65cbd0245df8c003de227"><code>5e206a7</code></a> Add script for running Maven in Docker</li>
<li>See full diff in <a href="https://github.com/stefanbirkner/system-lambda/compare/system-lambda-1.2.0...system-lambda-1.2.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.github.stefanbirkner:system-lambda&package-manager=maven&previous-version=1.2.0&new-version=1.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 8d878093..77c99562 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -11,15 +11,19 @@ on:
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        java-version: [ 8, 11 ]
+    name: Build with Java ${{ matrix.java-version }}
 
     steps:
       - uses: actions/checkout@v2
-      - name: Set up JDK 1.8
-        uses: actions/setup-java@v1
+      - name: Set up JDK ${{ matrix.java-version }}
+        uses: actions/setup-java@v2
         with:
-          java-version: 1.8
+          distribution: 'adopt'
+          java-version: ${{ matrix.java-version }}
       - name: Build with Maven
         run: mvn -B install --file pom.xml
       - name: Run integration tests
diff --git a/env/pom.xml b/env/pom.xml
index 45e90bcd..ccdcc977 100644
--- a/env/pom.xml
+++ b/env/pom.xml
@@ -130,8 +130,8 @@
                 <artifactId>maven-pmd-plugin</artifactId>
             </plugin>
             <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>findbugs-maven-plugin</artifactId>
+                <groupId>com.github.spotbugs</groupId>
+                <artifactId>spotbugs-maven-plugin</artifactId>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
diff --git a/java-api/pom.xml b/java-api/pom.xml
index b8b5e49e..480a42d3 100644
--- a/java-api/pom.xml
+++ b/java-api/pom.xml
@@ -24,8 +24,8 @@
 			<scope>provided</scope>
 		</dependency>
 		<dependency>
-			<groupId>com.google.code.findbugs</groupId>
-			<artifactId>jsr305</artifactId>
+			<groupId>com.github.spotbugs</groupId>
+			<artifactId>spotbugs-annotations</artifactId>
 		</dependency>
 		<dependency>
 			<groupId>javax.servlet</groupId>
@@ -112,8 +112,8 @@
 				<artifactId>maven-pmd-plugin</artifactId>
 			</plugin>
 			<plugin>
-				<groupId>org.codehaus.mojo</groupId>
-				<artifactId>findbugs-maven-plugin</artifactId>
+				<groupId>com.github.spotbugs</groupId>
+				<artifactId>spotbugs-maven-plugin</artifactId>
 			</plugin>
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
diff --git a/java-security/pom.xml b/java-security/pom.xml
index d6eb6f02..8a372d08 100644
--- a/java-security/pom.xml
+++ b/java-security/pom.xml
@@ -117,7 +117,7 @@
 		<dependency>
 			<groupId>com.github.stefanbirkner</groupId>
 			<artifactId>system-lambda</artifactId>
-			<version>1.2.0</version>
+			<version>1.2.1</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
@@ -177,8 +177,8 @@
 				<artifactId>maven-pmd-plugin</artifactId>
 			</plugin>
 			<plugin>
-				<groupId>org.codehaus.mojo</groupId>
-				<artifactId>findbugs-maven-plugin</artifactId>
+				<groupId>com.github.spotbugs</groupId>
+				<artifactId>spotbugs-maven-plugin</artifactId>
 			</plugin>
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
diff --git a/pom.xml b/pom.xml
index 0d8511a6..655e0163 100644
--- a/pom.xml
+++ b/pom.xml
@@ -81,6 +81,9 @@
 		<assertj.version>3.21.0</assertj.version>
 		<reactor.test.version>3.4.13</reactor.test.version>
 		<wiremock.version>2.32.0</wiremock.version>
+		<javax.annotation.version>1.3.2</javax.annotation.version>
+		<spotbugs.annotations.version>4.5.2</spotbugs.annotations.version>
+		<spotbugs.version>4.5.0.0</spotbugs.version>
 		<skipTests>false</skipTests>
 		<jacoco.skip>${skipTests}</jacoco.skip>
 	</properties>
@@ -182,6 +185,11 @@
 				</exclusion>
 			</exclusions>
 			</dependency>
+			<dependency>
+				<groupId>javax.annotation</groupId>
+				<artifactId>javax.annotation-api</artifactId>
+				<version>${javax.annotation.version}</version>
+			</dependency>
 			<!-- logging -->
 			<dependency>
 				<groupId>org.apache.logging.log4j</groupId>
@@ -211,9 +219,9 @@
 				<version>${org.json.version}</version>
 			</dependency>
 			<dependency>
-				<groupId>com.google.code.findbugs</groupId>
-				<artifactId>jsr305</artifactId>
-				<version>${google.jsr305.version}</version>
+				<groupId>com.github.spotbugs</groupId>
+				<artifactId>spotbugs-annotations</artifactId>
+				<version>${spotbugs.annotations.version}</version>
 			</dependency>
 			<dependency>
 				<groupId>org.apache.httpcomponents</groupId>
@@ -346,17 +354,19 @@
 							</executions>
 						</plugin>
 						<plugin>
-							<groupId>org.codehaus.mojo</groupId>
-							<artifactId>findbugs-maven-plugin</artifactId>
-							<version>3.0.5</version>
+							<groupId>com.github.spotbugs</groupId>
+							<artifactId>spotbugs-maven-plugin</artifactId>
+							<version>${spotbugs.version}</version>
 							<configuration>
 								<skip>${skipTests}</skip>
+								<effort>Max</effort>
+								<threshold>Low</threshold>
 							</configuration>
 							<executions>
 								<execution>
 									<phase>verify</phase>
 									<goals>
-										<goal>findbugs</goal>
+										<goal>spotbugs</goal>
 									</goals>
 								</execution>
 							</executions>
diff --git a/spring-security/pom.xml b/spring-security/pom.xml
index 454454cb..49186205 100644
--- a/spring-security/pom.xml
+++ b/spring-security/pom.xml
@@ -122,8 +122,8 @@
 				<artifactId>maven-pmd-plugin</artifactId>
 			</plugin>
 			<plugin>
-				<groupId>org.codehaus.mojo</groupId>
-				<artifactId>findbugs-maven-plugin</artifactId>
+				<groupId>com.github.spotbugs</groupId>
+				<artifactId>spotbugs-maven-plugin</artifactId>
 			</plugin>
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
diff --git a/spring-xsuaa-mock/pom.xml b/spring-xsuaa-mock/pom.xml
index a394afe8..edbc41c2 100644
--- a/spring-xsuaa-mock/pom.xml
+++ b/spring-xsuaa-mock/pom.xml
@@ -109,8 +109,8 @@
 				<artifactId>maven-pmd-plugin</artifactId>
 			</plugin>
 			<plugin>
-				<groupId>org.codehaus.mojo</groupId>
-				<artifactId>findbugs-maven-plugin</artifactId>
+				<groupId>com.github.spotbugs</groupId>
+				<artifactId>spotbugs-maven-plugin</artifactId>
 			</plugin>
 		</plugins>
 	</build>
diff --git a/spring-xsuaa/pom.xml b/spring-xsuaa/pom.xml
index 3ad8f962..e963aa46 100644
--- a/spring-xsuaa/pom.xml
+++ b/spring-xsuaa/pom.xml
@@ -33,6 +33,10 @@
 			</exclusions>
 			<scope>provided</scope>
 		</dependency>
+		<dependency>
+			<groupId>javax.annotation</groupId>
+			<artifactId>javax.annotation-api</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>org.apache.logging.log4j</groupId>
 			<artifactId>log4j-to-slf4j</artifactId>
@@ -86,7 +90,6 @@
 			<optional>true</optional>
 		</dependency>
 
-
 		<dependency>
 			<groupId>junit</groupId>
 			<artifactId>junit</artifactId>
@@ -200,8 +203,8 @@
 				<artifactId>maven-pmd-plugin</artifactId>
 			</plugin>
 			<plugin>
-				<groupId>org.codehaus.mojo</groupId>
-				<artifactId>findbugs-maven-plugin</artifactId>
+				<groupId>com.github.spotbugs</groupId>
+				<artifactId>spotbugs-maven-plugin</artifactId>
 			</plugin>
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
diff --git a/token-client/pom.xml b/token-client/pom.xml
index 87634389..530cd434 100644
--- a/token-client/pom.xml
+++ b/token-client/pom.xml
@@ -44,8 +44,8 @@
 			<artifactId>json</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>com.google.code.findbugs</groupId>
-			<artifactId>jsr305</artifactId>
+			<groupId>com.github.spotbugs</groupId>
+			<artifactId>spotbugs-annotations</artifactId>
 		</dependency>
 		<dependency>
 			<groupId>com.github.ben-manes.caffeine</groupId>
@@ -144,8 +144,8 @@
 				<artifactId>maven-pmd-plugin</artifactId>
 			</plugin>
 			<plugin>
-				<groupId>org.codehaus.mojo</groupId>
-				<artifactId>findbugs-maven-plugin</artifactId>
+				<groupId>com.github.spotbugs</groupId>
+				<artifactId>spotbugs-maven-plugin</artifactId>
 			</plugin>
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>


Test patch:
diff --git a/java-security-it/src/test/java/com/sap/cloud/security/test/integration/XsuaaMultipleBindingsIntegrationTest.java b/java-security-it/src/test/java/com/sap/cloud/security/test/integration/XsuaaMultipleBindingsIntegrationTest.java
index e3c84223..e7f5c6e7 100644
--- a/java-security-it/src/test/java/com/sap/cloud/security/test/integration/XsuaaMultipleBindingsIntegrationTest.java
+++ b/java-security-it/src/test/java/com/sap/cloud/security/test/integration/XsuaaMultipleBindingsIntegrationTest.java
@@ -31,7 +31,7 @@ public class XsuaaMultipleBindingsIntegrationTest {
 	@Test
 	public void createToken_integrationTest_tokenValidation() {
 		Token token = rule.getPreconfiguredJwtGenerator().createToken();
-		OAuth2ServiceConfiguration configuration = Environments.readFromInput(ClassLoader.class.getResourceAsStream("/vcap_services-multiple.json")).getXsuaaConfiguration();
+		OAuth2ServiceConfiguration configuration = Environments.readFromInput(XsuaaMultipleBindingsIntegrationTest.class.getResourceAsStream("/vcap_services-multiple.json")).getXsuaaConfiguration();
 		CombiningValidator<Token> tokenValidator = JwtValidatorBuilder.getInstance(configuration).build();
 
 		ValidationResult result = tokenValidator.validate(token);
diff --git a/spring-xsuaa-test/pom.xml b/spring-xsuaa-test/pom.xml
index 442c8ca3..0305d428 100644
--- a/spring-xsuaa-test/pom.xml
+++ b/spring-xsuaa-test/pom.xml
@@ -87,8 +87,8 @@
 				<artifactId>maven-pmd-plugin</artifactId>
 			</plugin>
 			<plugin>
-				<groupId>org.codehaus.mojo</groupId>
-				<artifactId>findbugs-maven-plugin</artifactId>
+				<groupId>com.github.spotbugs</groupId>
+				<artifactId>spotbugs-maven-plugin</artifactId>
 			</plugin>
 		</plugins>
 	</build>