kevin
8a549d8610
Bump bridged to 1.0.0 and add the release notes: the single-leader, single-host scope is closed — gateway, lifecycle, two-way delivery, pluggable peers, auth/authz/audit, supervision, CI. Cross-host federation (CB-308) is the next major line. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013ZGgxLQ2VpwZhEYoru8rkf
262 lines
12 KiB
XML
262 lines
12 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
<modelVersion>4.0.0</modelVersion>
|
|
|
|
<groupId>dev.ltms</groupId>
|
|
<artifactId>bridged</artifactId>
|
|
<version>1.0.0</version>
|
|
<packaging>jar</packaging>
|
|
|
|
<name>bridged</name>
|
|
<description>claude-bridge message server: sole gateway between primary/worker Claude sessions and herdr</description>
|
|
|
|
<properties>
|
|
<maven.compiler.release>25</maven.compiler.release>
|
|
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
|
|
<mainClass>dev.ltms.bridged.Bridged</mainClass>
|
|
|
|
<jackson.version>2.19.0</jackson.version>
|
|
<javalin.version>6.7.0</javalin.version>
|
|
<jetty.version>11.0.25</jetty.version>
|
|
<mcp.version>2.0.0</mcp.version>
|
|
<slf4j.version>2.0.16</slf4j.version>
|
|
<logback.version>1.5.18</logback.version>
|
|
<junit.version>5.11.4</junit.version>
|
|
<amqp.version>5.22.0</amqp.version>
|
|
<testcontainers.version>1.20.4</testcontainers.version>
|
|
<commons-compress.version>1.27.1</commons-compress.version>
|
|
<commons-lang3.version>3.18.0</commons-lang3.version>
|
|
</properties>
|
|
|
|
<!--
|
|
Dependency security (validate with the JetBrains analyzer's Mend.io check on this pom).
|
|
Deps are pinned to the latest available versions. Residual advisories with NO upstream fix,
|
|
accepted for this loopback-bound daemon that processes no untrusted config:
|
|
- jetty-http 11.0.25 (via Javalin): CVE-2026-2332, CVE-2025-11143 — Jetty 11 is EOL;
|
|
fixed only in Jetty 12, which needs a Javalin major (6.x rides Jetty 11).
|
|
- logback-core 1.5.18: CVE-2025-11226, CVE-2026-1225 — both require a MALICIOUS
|
|
logback.xml (attacker with config write already has code execution); ours is trusted.
|
|
- jackson-core 2.19.0: WS-2026-0003 — "insufficient information", no fixed version published.
|
|
- tools.jackson.core (Jackson 3) 3.0.3 via the MCP SDK: CVE-2026-29062 (nesting-depth
|
|
resource exhaustion). The SDK 2.0.0 is pinned to Jackson 3.0.3 + jackson-annotations
|
|
3.0-rc5; bumping Jackson 3 to the patched 3.2.x breaks the SDK (annotation mismatch).
|
|
Only the loopback /mcp endpoint parses this JSON, from trusted local Claude clients.
|
|
The 11.0.23 -> 11.0.25 bump did clear jetty CVE-2024-8184 (5.9) and CVE-2024-6763.
|
|
-->
|
|
|
|
<!-- Force the latest patched Jetty 11.x across all Javalin-pulled Jetty modules (no version
|
|
skew). Javalin 6.x rides Jetty 11; a move to Jetty 12 needs a Javalin major. -->
|
|
<dependencyManagement>
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.eclipse.jetty</groupId>
|
|
<artifactId>jetty-bom</artifactId>
|
|
<version>${jetty.version}</version>
|
|
<type>pom</type>
|
|
<scope>import</scope>
|
|
</dependency>
|
|
<!-- The MCP SDK (Jackson 3) needs jackson-annotations with JsonFormat.Shape.POJO
|
|
(the 3.0 line); it shares the com.fasterxml.jackson.annotation package with our
|
|
Jackson 2.19 databind, so both must resolve to the same jar. 3.0 is built to work
|
|
with Jackson 2.19 databind too — pin it to reconcile the two. -->
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson.core</groupId>
|
|
<artifactId>jackson-annotations</artifactId>
|
|
<version>3.0-rc5</version>
|
|
</dependency>
|
|
<!-- Testcontainers 1.20.4 pulls commons-compress 1.24.0 (test scope), which carries
|
|
CVE-2024-25710 (8.1) + CVE-2024-26308 — both fixed in 1.26.0. Pin the patched line.
|
|
Test-scope only (never shipped in the jar), but bumped per the CVE policy. -->
|
|
<dependency>
|
|
<groupId>org.apache.commons</groupId>
|
|
<artifactId>commons-compress</artifactId>
|
|
<version>${commons-compress.version}</version>
|
|
</dependency>
|
|
<!-- Testcontainers 1.20.4 also pulls commons-lang3 3.16.0 (test scope): CVE-2025-48924
|
|
(uncontrolled recursion in ClassUtils), fixed in 3.18.0. Pin the patched line.
|
|
Test-scope only (never shipped in the jar), bumped per the CVE policy. -->
|
|
<dependency>
|
|
<groupId>org.apache.commons</groupId>
|
|
<artifactId>commons-lang3</artifactId>
|
|
<version>${commons-lang3.version}</version>
|
|
</dependency>
|
|
</dependencies>
|
|
</dependencyManagement>
|
|
|
|
<dependencies>
|
|
<!-- JSON + YAML (config, herdr wire format, REST bodies) -->
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson.core</groupId>
|
|
<artifactId>jackson-databind</artifactId>
|
|
<version>${jackson.version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson.dataformat</groupId>
|
|
<artifactId>jackson-dataformat-yaml</artifactId>
|
|
<version>${jackson.version}</version>
|
|
</dependency>
|
|
|
|
<!-- REST: the testability surface. MCP tools are thin adapters over these endpoints. -->
|
|
<dependency>
|
|
<groupId>io.javalin</groupId>
|
|
<artifactId>javalin</artifactId>
|
|
<version>${javalin.version}</version>
|
|
</dependency>
|
|
|
|
<!-- MCP server: the SERVER face. Streamable-HTTP servlet mounted on Javalin's Jetty at
|
|
/mcp, exposing bridge_send/bridge_reply/bridge_status as thin adapters over REST. -->
|
|
<dependency>
|
|
<groupId>io.modelcontextprotocol.sdk</groupId>
|
|
<artifactId>mcp</artifactId>
|
|
<version>${mcp.version}</version>
|
|
</dependency>
|
|
|
|
<!-- Broker client (CB-307 Stage 2): AMQP 0-9-1. Default deploy targets LavinMQ; this same
|
|
client speaks to RabbitMQ unchanged (URI-only swap), so integration tests run against a
|
|
stock RabbitMQ container. Only wired when a broker: block is present in config; absent →
|
|
the in-memory ReplyInbox. -->
|
|
<dependency>
|
|
<groupId>com.rabbitmq</groupId>
|
|
<artifactId>amqp-client</artifactId>
|
|
<version>${amqp.version}</version>
|
|
</dependency>
|
|
|
|
<!-- Logging -->
|
|
<dependency>
|
|
<groupId>org.slf4j</groupId>
|
|
<artifactId>slf4j-api</artifactId>
|
|
<version>${slf4j.version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>ch.qos.logback</groupId>
|
|
<artifactId>logback-classic</artifactId>
|
|
<version>${logback.version}</version>
|
|
</dependency>
|
|
|
|
<!-- Tests -->
|
|
<dependency>
|
|
<groupId>org.junit.jupiter</groupId>
|
|
<artifactId>junit-jupiter</artifactId>
|
|
<version>${junit.version}</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
|
|
<!-- Testcontainers RabbitMQ: spins a real broker for the @Tag("contract") AMQP integration
|
|
test only. Excluded from the default build (contract group), so `mvn clean install`
|
|
stays hermetic and green without Docker; run under -Pcontract with Docker present. -->
|
|
<dependency>
|
|
<groupId>org.testcontainers</groupId>
|
|
<artifactId>rabbitmq</artifactId>
|
|
<version>${testcontainers.version}</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.testcontainers</groupId>
|
|
<artifactId>junit-jupiter</artifactId>
|
|
<version>${testcontainers.version}</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
</dependencies>
|
|
|
|
<build>
|
|
<finalName>bridged</finalName>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-compiler-plugin</artifactId>
|
|
<version>3.14.0</version>
|
|
</plugin>
|
|
|
|
<!--
|
|
Coverage (CB-509). Build-time tooling only — never a compile/runtime dependency, so
|
|
it adds nothing to the shipped jar. Report lands at target/site/jacoco/index.html and
|
|
target/site/jacoco/jacoco.csv. No `check` rule / threshold is wired: a coverage gate
|
|
rewards writing tests that execute lines, which is the failure mode this project is
|
|
trying to avoid, not encourage.
|
|
-->
|
|
<plugin>
|
|
<groupId>org.jacoco</groupId>
|
|
<artifactId>jacoco-maven-plugin</artifactId>
|
|
<version>0.8.13</version>
|
|
<executions>
|
|
<execution>
|
|
<id>prepare-agent</id>
|
|
<goals><goal>prepare-agent</goal></goals>
|
|
</execution>
|
|
<execution>
|
|
<id>report</id>
|
|
<phase>test</phase>
|
|
<goals><goal>report</goal></goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
|
|
<!-- Unit tests run by default; contract tests (live herdr) are tag-excluded. -->
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-surefire-plugin</artifactId>
|
|
<version>3.5.2</version>
|
|
<configuration>
|
|
<excludedGroups>${excludedGroups}</excludedGroups>
|
|
</configuration>
|
|
</plugin>
|
|
|
|
<!-- Runnable fat jar: java -jar target/bridged.jar -->
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-shade-plugin</artifactId>
|
|
<version>3.6.0</version>
|
|
<executions>
|
|
<execution>
|
|
<phase>package</phase>
|
|
<goals><goal>shade</goal></goals>
|
|
<configuration>
|
|
<transformers>
|
|
<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
|
|
<mainClass>${mainClass}</mainClass>
|
|
</transformer>
|
|
<transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
|
|
</transformers>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
|
|
<profiles>
|
|
<!-- `mvn test` excludes contract tests. `mvn test -Pcontract` runs them against a live herdr. -->
|
|
<profile>
|
|
<id>default-excludes</id>
|
|
<activation><activeByDefault>true</activeByDefault></activation>
|
|
<properties><excludedGroups>contract</excludedGroups></properties>
|
|
</profile>
|
|
<profile>
|
|
<id>contract</id>
|
|
<properties><excludedGroups/></properties>
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<artifactId>maven-surefire-plugin</artifactId>
|
|
<configuration>
|
|
<!-- Docker-engine compat (see "Running the contract tests" in
|
|
docs/CB-307-Reliable-Delivery.md): Testcontainers 1.20.4's docker-java
|
|
client defaults to Docker API 1.32 when no version is set, but modern
|
|
engines (OrbStack on this dev host, min 1.40) reject that as too old —
|
|
which surfaces as "Could not find a valid Docker environment". Pinning
|
|
api.version=1.43 works on OrbStack and Docker 24+, and is overridable
|
|
per-host via -Dapi.version. Only active under -Pcontract, so the
|
|
default hermetic build never sets it. -->
|
|
<systemPropertyVariables>
|
|
<api.version>1.43</api.version>
|
|
</systemPropertyVariables>
|
|
</configuration>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</profile>
|
|
</profiles>
|
|
</project>
|