kevin
cc0ec65714
Build-time tooling only — never a compile or runtime dependency, so it adds nothing to the shipped jar and no new transitive surface to the artifact. (Noting per CLAUDE.md that the pom CVE gate could not be run: no JetBrains MCP server is connected this session.) Report at target/site/jacoco/index.html, machine-readable at jacoco.csv. Deliberately NO check rule or threshold. A coverage gate rewards writing tests that merely execute lines, which is the exact failure mode this codebase has already been bitten by — CB-507 shipped a null-argument NPE with 311 green tests because FakeWorktrees.repoRoot records its argument instead of shelling out, so the broken line was covered and still wrong. Coverage is a map of where to look, not a target to hit. Baseline: 66.9% line, 60.6% branch, 76.4% method.
242 lines
11 KiB
XML
242 lines
11 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
<modelVersion>4.0.0</modelVersion>
|
|
|
|
<groupId>dev.ltms</groupId>
|
|
<artifactId>bridged</artifactId>
|
|
<version>0.1.0-SNAPSHOT</version>
|
|
<packaging>jar</packaging>
|
|
|
|
<name>bridged</name>
|
|
<description>claude-bridge message server: sole gateway between primary/worker Claude sessions and herdr</description>
|
|
|
|
<properties>
|
|
<maven.compiler.release>25</maven.compiler.release>
|
|
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
|
|
<mainClass>dev.ltms.bridged.Bridged</mainClass>
|
|
|
|
<jackson.version>2.19.0</jackson.version>
|
|
<javalin.version>6.7.0</javalin.version>
|
|
<jetty.version>11.0.25</jetty.version>
|
|
<mcp.version>2.0.0</mcp.version>
|
|
<slf4j.version>2.0.16</slf4j.version>
|
|
<logback.version>1.5.18</logback.version>
|
|
<junit.version>5.11.4</junit.version>
|
|
<amqp.version>5.22.0</amqp.version>
|
|
<testcontainers.version>1.20.4</testcontainers.version>
|
|
<commons-compress.version>1.27.1</commons-compress.version>
|
|
<commons-lang3.version>3.18.0</commons-lang3.version>
|
|
</properties>
|
|
|
|
<!--
|
|
Dependency security (validate with the JetBrains analyzer's Mend.io check on this pom).
|
|
Deps are pinned to the latest available versions. Residual advisories with NO upstream fix,
|
|
accepted for this loopback-bound daemon that processes no untrusted config:
|
|
- jetty-http 11.0.25 (via Javalin): CVE-2026-2332, CVE-2025-11143 — Jetty 11 is EOL;
|
|
fixed only in Jetty 12, which needs a Javalin major (6.x rides Jetty 11).
|
|
- logback-core 1.5.18: CVE-2025-11226, CVE-2026-1225 — both require a MALICIOUS
|
|
logback.xml (attacker with config write already has code execution); ours is trusted.
|
|
- jackson-core 2.19.0: WS-2026-0003 — "insufficient information", no fixed version published.
|
|
- tools.jackson.core (Jackson 3) 3.0.3 via the MCP SDK: CVE-2026-29062 (nesting-depth
|
|
resource exhaustion). The SDK 2.0.0 is pinned to Jackson 3.0.3 + jackson-annotations
|
|
3.0-rc5; bumping Jackson 3 to the patched 3.2.x breaks the SDK (annotation mismatch).
|
|
Only the loopback /mcp endpoint parses this JSON, from trusted local Claude clients.
|
|
The 11.0.23 -> 11.0.25 bump did clear jetty CVE-2024-8184 (5.9) and CVE-2024-6763.
|
|
-->
|
|
|
|
<!-- Force the latest patched Jetty 11.x across all Javalin-pulled Jetty modules (no version
|
|
skew). Javalin 6.x rides Jetty 11; a move to Jetty 12 needs a Javalin major. -->
|
|
<dependencyManagement>
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.eclipse.jetty</groupId>
|
|
<artifactId>jetty-bom</artifactId>
|
|
<version>${jetty.version}</version>
|
|
<type>pom</type>
|
|
<scope>import</scope>
|
|
</dependency>
|
|
<!-- The MCP SDK (Jackson 3) needs jackson-annotations with JsonFormat.Shape.POJO
|
|
(the 3.0 line); it shares the com.fasterxml.jackson.annotation package with our
|
|
Jackson 2.19 databind, so both must resolve to the same jar. 3.0 is built to work
|
|
with Jackson 2.19 databind too — pin it to reconcile the two. -->
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson.core</groupId>
|
|
<artifactId>jackson-annotations</artifactId>
|
|
<version>3.0-rc5</version>
|
|
</dependency>
|
|
<!-- Testcontainers 1.20.4 pulls commons-compress 1.24.0 (test scope), which carries
|
|
CVE-2024-25710 (8.1) + CVE-2024-26308 — both fixed in 1.26.0. Pin the patched line.
|
|
Test-scope only (never shipped in the jar), but bumped per the CVE policy. -->
|
|
<dependency>
|
|
<groupId>org.apache.commons</groupId>
|
|
<artifactId>commons-compress</artifactId>
|
|
<version>${commons-compress.version}</version>
|
|
</dependency>
|
|
<!-- Testcontainers 1.20.4 also pulls commons-lang3 3.16.0 (test scope): CVE-2025-48924
|
|
(uncontrolled recursion in ClassUtils), fixed in 3.18.0. Pin the patched line.
|
|
Test-scope only (never shipped in the jar), bumped per the CVE policy. -->
|
|
<dependency>
|
|
<groupId>org.apache.commons</groupId>
|
|
<artifactId>commons-lang3</artifactId>
|
|
<version>${commons-lang3.version}</version>
|
|
</dependency>
|
|
</dependencies>
|
|
</dependencyManagement>
|
|
|
|
<dependencies>
|
|
<!-- JSON + YAML (config, herdr wire format, REST bodies) -->
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson.core</groupId>
|
|
<artifactId>jackson-databind</artifactId>
|
|
<version>${jackson.version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson.dataformat</groupId>
|
|
<artifactId>jackson-dataformat-yaml</artifactId>
|
|
<version>${jackson.version}</version>
|
|
</dependency>
|
|
|
|
<!-- REST: the testability surface. MCP tools are thin adapters over these endpoints. -->
|
|
<dependency>
|
|
<groupId>io.javalin</groupId>
|
|
<artifactId>javalin</artifactId>
|
|
<version>${javalin.version}</version>
|
|
</dependency>
|
|
|
|
<!-- MCP server: the SERVER face. Streamable-HTTP servlet mounted on Javalin's Jetty at
|
|
/mcp, exposing bridge_send/bridge_reply/bridge_status as thin adapters over REST. -->
|
|
<dependency>
|
|
<groupId>io.modelcontextprotocol.sdk</groupId>
|
|
<artifactId>mcp</artifactId>
|
|
<version>${mcp.version}</version>
|
|
</dependency>
|
|
|
|
<!-- Broker client (CB-307 Stage 2): AMQP 0-9-1. Default deploy targets LavinMQ; this same
|
|
client speaks to RabbitMQ unchanged (URI-only swap), so integration tests run against a
|
|
stock RabbitMQ container. Only wired when a broker: block is present in config; absent →
|
|
the in-memory ReplyInbox. -->
|
|
<dependency>
|
|
<groupId>com.rabbitmq</groupId>
|
|
<artifactId>amqp-client</artifactId>
|
|
<version>${amqp.version}</version>
|
|
</dependency>
|
|
|
|
<!-- Logging -->
|
|
<dependency>
|
|
<groupId>org.slf4j</groupId>
|
|
<artifactId>slf4j-api</artifactId>
|
|
<version>${slf4j.version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>ch.qos.logback</groupId>
|
|
<artifactId>logback-classic</artifactId>
|
|
<version>${logback.version}</version>
|
|
</dependency>
|
|
|
|
<!-- Tests -->
|
|
<dependency>
|
|
<groupId>org.junit.jupiter</groupId>
|
|
<artifactId>junit-jupiter</artifactId>
|
|
<version>${junit.version}</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
|
|
<!-- Testcontainers RabbitMQ: spins a real broker for the @Tag("contract") AMQP integration
|
|
test only. Excluded from the default build (contract group), so `mvn clean install`
|
|
stays hermetic and green without Docker; run under -Pcontract with Docker present. -->
|
|
<dependency>
|
|
<groupId>org.testcontainers</groupId>
|
|
<artifactId>rabbitmq</artifactId>
|
|
<version>${testcontainers.version}</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.testcontainers</groupId>
|
|
<artifactId>junit-jupiter</artifactId>
|
|
<version>${testcontainers.version}</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
</dependencies>
|
|
|
|
<build>
|
|
<finalName>bridged</finalName>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-compiler-plugin</artifactId>
|
|
<version>3.14.0</version>
|
|
</plugin>
|
|
|
|
<!--
|
|
Coverage (CB-509). Build-time tooling only — never a compile/runtime dependency, so
|
|
it adds nothing to the shipped jar. Report lands at target/site/jacoco/index.html and
|
|
target/site/jacoco/jacoco.csv. No `check` rule / threshold is wired: a coverage gate
|
|
rewards writing tests that execute lines, which is the failure mode this project is
|
|
trying to avoid, not encourage.
|
|
-->
|
|
<plugin>
|
|
<groupId>org.jacoco</groupId>
|
|
<artifactId>jacoco-maven-plugin</artifactId>
|
|
<version>0.8.13</version>
|
|
<executions>
|
|
<execution>
|
|
<id>prepare-agent</id>
|
|
<goals><goal>prepare-agent</goal></goals>
|
|
</execution>
|
|
<execution>
|
|
<id>report</id>
|
|
<phase>test</phase>
|
|
<goals><goal>report</goal></goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
|
|
<!-- Unit tests run by default; contract tests (live herdr) are tag-excluded. -->
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-surefire-plugin</artifactId>
|
|
<version>3.5.2</version>
|
|
<configuration>
|
|
<excludedGroups>${excludedGroups}</excludedGroups>
|
|
</configuration>
|
|
</plugin>
|
|
|
|
<!-- Runnable fat jar: java -jar target/bridged.jar -->
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-shade-plugin</artifactId>
|
|
<version>3.6.0</version>
|
|
<executions>
|
|
<execution>
|
|
<phase>package</phase>
|
|
<goals><goal>shade</goal></goals>
|
|
<configuration>
|
|
<transformers>
|
|
<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
|
|
<mainClass>${mainClass}</mainClass>
|
|
</transformer>
|
|
<transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
|
|
</transformers>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
|
|
<profiles>
|
|
<!-- `mvn test` excludes contract tests. `mvn test -Pcontract` runs them against a live herdr. -->
|
|
<profile>
|
|
<id>default-excludes</id>
|
|
<activation><activeByDefault>true</activeByDefault></activation>
|
|
<properties><excludedGroups>contract</excludedGroups></properties>
|
|
</profile>
|
|
<profile>
|
|
<id>contract</id>
|
|
<properties><excludedGroups/></properties>
|
|
</profile>
|
|
</profiles>
|
|
</project>
|