API DocHelpBrowseSign In

pmd

Used in: 2 components

Overview

Description

PMD is a source code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It supports many languages. It can be extended with custom rules. It uses JavaCC and Antlr to parse source files into abstract syntax trees (AST) and runs rules against them to find violations. Rules can be written in Java or using a XPath query. It supports Java, JavaScript, Salesforce.com Apex and Visualforce, Kotlin, Swift, Modelica, PLSQL, Apache Velocity, JSP, WSDL, HTML, XML and XSL. Scala is supported, but there are currently no Scala rules available. Additionally, it includes CPD, the copy-paste-detector. CPD finds duplicated code in Coco, C/C++, C#, Dart, Fortran, Gherkin, Go, Groovy, HTML, Java, JavaScript, JSP, Julia, Kotlin, Lua, Matlab, Modelica, Objective-C, Perl, PHP, PLSQL, Python, Ruby, Salesforce.com Apex and Visualforce, Scala, Swift, T-SQL, Typescript and XML.

Snippets

<dependency>
    <groupId>net.sourceforge.pmd</groupId>
    <artifactId>pmd</artifactId>
    <version>7.0.0-rc4</version>
</dependency>

Maven POM File

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>net.sourceforge.pmd</groupId>
    <artifactId>pmd</artifactId>
    <version>7.0.0-rc4</version>
    <packaging>pom</packaging>
    <name>PMD</name>

    <description>
        PMD is a source code analyzer. It finds common programming flaws like unused variables, empty catch blocks,
        unnecessary object creation, and so forth. It supports many languages. It can be extended with custom rules.
        It uses JavaCC and Antlr to parse source files into abstract syntax trees (AST) and runs rules against them to find violations.
        Rules can be written in Java or using a XPath query.

        It supports Java, JavaScript, Salesforce.com Apex and Visualforce,
        Kotlin, Swift, Modelica, PLSQL, Apache Velocity, JSP, WSDL, HTML, XML and XSL.
        Scala is supported, but there are currently no Scala rules available.

        Additionally, it includes CPD, the copy-paste-detector. CPD finds duplicated code in
        Coco, C/C++, C#, Dart, Fortran, Gherkin, Go, Groovy, HTML, Java, JavaScript, JSP, Julia, Kotlin, Lua, Matlab, Modelica,
        Objective-C, Perl, PHP, PLSQL, Python, Ruby, Salesforce.com Apex and Visualforce, Scala, Swift, T-SQL, Typescript and XML.
    </description>

    <url>https://pmd.github.io/</url>
    <ciManagement>
        <url>https://github.com/pmd/pmd/actions</url>
    </ciManagement>
    <inceptionYear>2002</inceptionYear>
    <licenses>
        <license>
            <name>BSD-style</name>
            <url>http://pmd.sourceforge.net/license.html</url>
            <distribution>repo</distribution>
        </license>
    </licenses>
    <mailingLists>
        <mailingList>
            <name>PMD development</name>
            <subscribe>https://lists.sourceforge.net/lists/listinfo/pmd-devel</subscribe>
            <unsubscribe>https://lists.sourceforge.net/lists/listinfo/pmd-devel</unsubscribe>
            <archive>https://sourceforge.net/p/pmd/mailman/pmd-devel</archive>
        </mailingList>
        <mailingList>
            <name>PMD commits</name>
            <subscribe>https://lists.sourceforge.net/lists/listinfo/pmd-commits</subscribe>
            <unsubscribe>https://lists.sourceforge.net/lists/listinfo/pmd-commits</unsubscribe>
            <archive>https://sourceforge.net/p/pmd/mailman/pmd-commits</archive>
        </mailingList>
    </mailingLists>
    <developers>
        <developer>
            <id>github</id>
            <name>github contributors</name>
            <organization>github</organization>
            <organizationUrl>https://github.com/pmd/pmd/graphs/contributors</organizationUrl>
        </developer>
    </developers>
    <scm>
        <connection>scm:git:git://github.com/pmd/pmd.git</connection>
        <developerConnection>scm:git:ssh://git@github.com/pmd/pmd.git</developerConnection>
        <url>https://github.com/pmd/pmd</url>
        <tag>pmd_releases/7.0.0-rc4</tag>
    </scm>
    <distributionManagement>
        <snapshotRepository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
        </snapshotRepository>
        <repository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
        </repository>
    </distributionManagement>
    <organization>
        <name>PMD</name>
        <url>https://pmd.github.io/</url>
    </organization>
    <issueManagement>
        <url>https://github.com/pmd/pmd/issues</url>
    </issueManagement>

    <properties>
        <project.build.outputTimestamp>2023-09-30T14:54:28Z</project.build.outputTimestamp>

        <java.version>8</java.version>

        <maven.compiler.test.source>1.8</maven.compiler.test.source>
        <maven.compiler.test.target>1.8</maven.compiler.test.target>


        <kotlin.compiler.jvmTarget>${maven.compiler.test.target}</kotlin.compiler.jvmTarget>
        <kotlin.version>1.7.20</kotlin.version>
        <kotest.version>5.5.5</kotest.version>
        <junit5.version>5.8.2</junit5.version> <!-- needed by kotest -->
        <dokka.version>1.7.20</dokka.version>

        <javacc.version>5.0</javacc.version>
        <surefire.version>3.0.0-M8</surefire.version>
        <checkstyle.version>10.7.0</checkstyle.version>
        <checkstyle.plugin.version>3.2.1</checkstyle.plugin.version>
        <pmd.plugin.version>3.20.0</pmd.plugin.version>
        <ant.version>1.10.13</ant.version>
        <javadoc.plugin.version>3.4.1</javadoc.plugin.version>
        <antlr.version>4.9.1</antlr.version>
        <slf4j.version>1.7.36</slf4j.version>
        <saxon.version>10.7</saxon.version>

        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <pmd.website.baseurl>https://docs.pmd-code.org/snapshot</pmd.website.baseurl>

        <argLine>-Xmx512m -Dfile.encoding=${project.build.sourceEncoding} ${extraArgLine}</argLine>
        <extraArgLine /> <!-- empty by default, profiles set it as needed -->

        <pmd.build-tools.version>22</pmd.build-tools.version>

        <pmd-designer.version>7.0.0-rc4</pmd-designer.version>
        <javacc.jar>${settings.localRepository}/net/java/dev/javacc/javacc/${javacc.version}/javacc-${javacc.version}.jar</javacc.jar>
        <javacc.outputDirectory>${project.build.directory}/generated-sources/javacc</javacc.outputDirectory>
        <javacc.ant.wrapper>${project.basedir}/../javacc-wrapper.xml</javacc.ant.wrapper>

        <antlr4.outputDirectory>${project.build.directory}/generated-sources/antlr4</antlr4.outputDirectory>
        <antlr4.ant.wrapper>${project.basedir}/../antlr4-wrapper.xml</antlr4.ant.wrapper>
    </properties>

    <build>
        <testResources>
            <testResource>
                <directory>${project.basedir}/src/test/resources</directory>
            </testResource>
            <!-- Adding kotlin files to test resources, so that checkstyle verifies the license header -->
            <testResource>
                <directory>${project.basedir}/src/test/kotlin</directory>
            </testResource>
        </testResources>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.antlr</groupId>
                    <artifactId>antlr4-maven-plugin</artifactId>
                    <version>${antlr.version}</version>
                    <configuration>
                        <inputEncoding>${project.build.sourceEncoding}</inputEncoding>
                        <visitor>true</visitor>
                        <listener>true</listener>
                    </configuration>
                    <executions>
                        <execution>
                            <id>antlr</id>
                            <goals>
                                <goal>antlr4</goal>
                            </goals>
                            <!-- This is default but let's be clear -->
                            <phase>generate-sources</phase>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-antrun-plugin</artifactId>
                    <version>3.1.0</version>
                    <dependencies>
                        <dependency>
                            <groupId>net.java.dev.javacc</groupId>
                            <artifactId>javacc</artifactId>
                            <version>${javacc.version}</version>
                        </dependency>
                    </dependencies>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-assembly-plugin</artifactId>
                    <version>3.5.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-dependency-plugin</artifactId>
                    <version>3.5.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-release-plugin</artifactId>
                    <version>3.0.0-M7</version>
                    <configuration>
                        <releaseProfiles>pmd-release,sign</releaseProfiles>
                        <pushChanges>true</pushChanges>
                        <localCheckout>true</localCheckout>
                        <autoVersionSubmodules>true</autoVersionSubmodules>
                        <tagNameFormat>pmd_releases/@{project.version}</tagNameFormat>
                        <goals>deploy</goals>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-clean-plugin</artifactId>
                    <version>3.2.0</version>
                </plugin>

                <!-- Kotlin compiler for test-compile -->
                <!-- The kotlin plugin has to run before the java plugin-->
                <plugin>
                    <artifactId>kotlin-maven-plugin</artifactId>
                    <groupId>org.jetbrains.kotlin</groupId>
                    <version>${kotlin.version}</version>
                    <executions>
                        <execution>
                            <id>kotlin-test-compile</id>
                            <goals>
                                <goal>test-compile</goal>
                            </goals>
                            <phase>process-test-sources</phase>
                            <configuration>
                                <sourceDirs>
                                    <sourceDir>${project.basedir}/src/test/kotlin</sourceDir>
                                    <sourceDir>${project.basedir}/src/test/java</sourceDir>
                                </sourceDirs>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>

                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.10.1</version>
                    <configuration>
                        <release>${java.version}</release>
                    </configuration>
                    <executions>
                        <!-- Replacing default-compile as it is treated specially by maven -->
                        <execution>
                            <id>default-compile</id>
                            <phase>none</phase>
                        </execution>
                        <!-- Replacing default-testCompile as it is treated specially by maven -->
                        <execution>
                            <id>default-testCompile</id>
                            <phase>none</phase>
                        </execution>
                        <execution>
                            <id>java-compile</id>
                            <phase>compile</phase>
                            <goals>
                                <goal>compile</goal>
                            </goals>
                        </execution>
                        <execution>
                            <id>java-test-compile</id>
                            <phase>test-compile</phase>
                            <goals>
                                <goal>testCompile</goal>
                            </goals>
                            <configuration>
                                <source>${maven.compiler.test.source}</source>
                                <target>${maven.compiler.test.target}</target>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-deploy-plugin</artifactId>
                    <version>3.1.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-install-plugin</artifactId>
                    <version>3.1.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-jar-plugin</artifactId>
                    <version>3.3.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-resources-plugin</artifactId>
                    <version>3.3.0</version>
                    <configuration>
                        <propertiesEncoding>${project.build.sourceEncoding}</propertiesEncoding>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-shade-plugin</artifactId>
                    <version>3.4.1</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>${surefire.version}</version>
                    <configuration>
                        <runOrder>alphabetical</runOrder>
                        <systemPropertyVariables>
                            <mvn.project.src.test.resources>${project.build.testResources[0].directory}</mvn.project.src.test.resources>
                        </systemPropertyVariables>
                        <statelessTestsetInfoReporter implementation="net.sourceforge.pmd.buildtools.surefire.PMDStatelessTestSetInfoConsoleReporter">
                            <showFailedTests>true</showFailedTests>
                            <showSuccessfulTests>false</showSuccessfulTests>
                            <showSkippedTests>true</showSkippedTests>
                            <usePhrasedFileName>true</usePhrasedFileName>
                            <usePhrasedClassNameInRunning>true</usePhrasedClassNameInRunning>
                            <usePhrasedClassNameInTestCaseSummary>true</usePhrasedClassNameInTestCaseSummary>
                        </statelessTestsetInfoReporter>

                        <statelessTestsetReporter implementation="org.apache.maven.plugin.surefire.extensions.junit5.JUnit5Xml30StatelessReporter">
                            <usePhrasedFileName>true</usePhrasedFileName>
                            <usePhrasedTestSuiteClassName>true</usePhrasedTestSuiteClassName>
                            <usePhrasedTestCaseClassName>true</usePhrasedTestCaseClassName>
                            <usePhrasedTestCaseMethodName>true</usePhrasedTestCaseMethodName>
                        </statelessTestsetReporter>
                    </configuration>
                    <dependencies>
                        <dependency>
                            <groupId>net.sourceforge.pmd</groupId>
                            <artifactId>pmd-build-tools-config</artifactId>
                            <version>${pmd.build-tools.version}</version>
                        </dependency>
                    </dependencies>
                </plugin>
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>build-helper-maven-plugin</artifactId>
                    <version>3.3.0</version>
                </plugin>
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>exec-maven-plugin</artifactId>
                    <version>3.1.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-source-plugin</artifactId>
                    <version>3.2.1</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-javadoc-plugin</artifactId>
                    <version>${javadoc.plugin.version}</version>
                    <configuration>
                        <quiet>true</quiet>
                        <doclint>none</doclint>
                        <excludePackageNames>*.internal</excludePackageNames>
                        <detectOfflineLinks>false</detectOfflineLinks>
                        <offlineLinks>
                            <offlineLink>
                                <location>${project.basedir}/../pmd-lang-test/target/dokkaJavadocJar</location>
                                <url>../../pmd-lang-test/${project.version}</url>
                            </offlineLink>
                            <offlineLink>
                                <location>${project.basedir}/../pmd-test/target/apidocs</location>
                                <url>../../pmd-test/${project.version}</url>
                            </offlineLink>
                            <!-- core needs to be last, because the package "net.sourceforge.pmd.lang" is both in pmd-core and pmd-test -->
                            <offlineLink>
                                <location>${project.basedir}/../pmd-core/target/apidocs</location>
                                <url>../../pmd-core/${project.version}</url>
                            </offlineLink>
                        </offlineLinks>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-checkstyle-plugin</artifactId>
                    <version>${checkstyle.plugin.version}</version>
                    <executions>
                        <execution>
                            <id>checkstyle-check</id>
                            <phase>verify</phase>
                            <goals>
                                <goal>check</goal>
                            </goals>
                        </execution>
                    </executions>
                    <dependencies>
                        <dependency>
                            <groupId>com.puppycrawl.tools</groupId>
                            <artifactId>checkstyle</artifactId>
                            <version>${checkstyle.version}</version>
                        </dependency>
                        <dependency>
                            <groupId>net.sourceforge.pmd</groupId>
                            <artifactId>pmd-build-tools-config</artifactId>
                            <version>${pmd.build-tools.version}</version>
                        </dependency>
                    </dependencies>
                    <configuration>
                        <configLocation>/net/sourceforge/pmd/pmd-checkstyle-config.xml</configLocation>
                        <suppressionsLocation>/net/sourceforge/pmd/pmd-checkstyle-suppressions.xml</suppressionsLocation>
                        <includeTestSourceDirectory>true</includeTestSourceDirectory>
                        <sourceDirectories>
                            <!-- this sets only src/main/java and ignores e.g. target/generated-sources/javacc -->
                            <sourceDirectory>${project.build.sourceDirectory}</sourceDirectory>
                        </sourceDirectories>
                        <resourceIncludes>**/*.properties,**/*.less,**/*.kt</resourceIncludes>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-enforcer-plugin</artifactId>
                    <version>3.2.1</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-failsafe-plugin</artifactId>
                    <version>${surefire.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-pmd-plugin</artifactId>
                    <version>${pmd.plugin.version}</version>
                    <executions>
                        <execution>
                            <id>pmd-main</id>
                            <phase>verify</phase>
                            <goals>
                                <goal>check</goal>
                                <goal>cpd-check</goal>
                            </goals>
                        </execution>
                        <execution>
                            <id>pmd-test</id>
                            <phase>verify</phase>
                            <goals>
                                <goal>pmd</goal>
                                <goal>check</goal>
                            </goals>
                            <configuration>
                                <targetDirectory>${project.build.directory}/pmdTest/</targetDirectory>
                                <includeTests>true</includeTests>
                                <rulesets>
                                    <ruleset>/net/sourceforge/pmd/pmd-test-dogfood-config.xml</ruleset>
                                </rulesets>
                            </configuration>
                        </execution>
                    </executions>
                    <configuration>
                        <linkXRef>false</linkXRef>
                        <minimumTokens>100</minimumTokens>
                        <targetJdk>1.${java.version}</targetJdk>
                        <rulesets>
                            <ruleset>/net/sourceforge/pmd/pmd-dogfood-config.xml</ruleset>
                            <ruleset>/net/sourceforge/pmd/pmd7-dogfood-config.xml</ruleset>
                        </rulesets>
                        <excludeRoots>
                            <excludeRoot>target/generated-sources/javacc</excludeRoot>
                            <excludeRoot>target/generated-sources/antlr4</excludeRoot>
                        </excludeRoots>
                        <skipPmdError>false</skipPmdError>
                        <failurePriority>2</failurePriority>
                        <failOnViolation>true</failOnViolation>
                        <printFailingErrors>true</printFailingErrors>
                    </configuration>
                    <dependencies>
                        <!-- Note: we can't use a property for the version here due to https://issues.apache.org/jira/browse/MRELEASE-932 -->
                        <!-- We use the comment "pmd.dogfood.version" as a marker and manually change the version - see .ci/build.sh -->
                        <dependency>
                            <groupId>net.sourceforge.pmd</groupId>
                            <artifactId>pmd-core</artifactId>
                            <version>6.55.0</version> <!-- pmd.dogfood.version -->
                        </dependency>
                        <dependency>
                            <groupId>net.sourceforge.pmd</groupId>
                            <artifactId>pmd-java</artifactId>
                            <version>6.55.0</version> <!-- pmd.dogfood.version -->
                        </dependency>
                        <dependency>
                            <groupId>net.sourceforge.pmd</groupId>
                            <artifactId>pmd-jsp</artifactId>
                            <version>6.55.0</version> <!-- pmd.dogfood.version -->
                        </dependency>
                        <dependency>
                            <groupId>net.sourceforge.pmd</groupId>
                            <artifactId>pmd-javascript</artifactId>
                            <version>6.55.0</version> <!-- pmd.dogfood.version -->
                        </dependency>
                        <!-- This contains the dogfood ruleset -->
                        <dependency>
                            <groupId>net.sourceforge.pmd</groupId>
                            <artifactId>pmd-build-tools-config</artifactId>
                            <version>${pmd.build-tools.version}</version>
                        </dependency>
                    </dependencies>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-site-plugin</artifactId>
                    <version>4.0.0-M4</version>
                </plugin>
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>versions-maven-plugin</artifactId>
                    <version>2.14.2</version>
                </plugin>
                <plugin>
                    <groupId>org.sonatype.plugins</groupId>
                    <artifactId>nexus-staging-maven-plugin</artifactId>
                    <version>1.6.13</version>
                </plugin>
                <plugin>
                    <groupId>org.jacoco</groupId>
                    <artifactId>jacoco-maven-plugin</artifactId>
                    <version>0.8.8</version>
                </plugin>
                <plugin>
                    <groupId>org.cyclonedx</groupId>
                    <artifactId>cyclonedx-maven-plugin</artifactId>
                    <version>2.7.9</version>
                </plugin>
                <!--This plugin's configuration is used to store Eclipse
                    m2e settings only. It has no influence on the Maven build itself. -->
                <plugin>
                    <groupId>org.eclipse.m2e</groupId>
                    <artifactId>lifecycle-mapping</artifactId>
                    <version>1.0.0</version>
                    <configuration>
                        <lifecycleMappingMetadata>
                            <pluginExecutions>
                                <pluginExecution>
                                    <pluginExecutionFilter>
                                        <groupId>org.apache.maven.plugins</groupId>
                                        <artifactId>maven-antrun-plugin</artifactId>
                                        <versionRange>[1.7,)</versionRange>
                                        <goals>
                                            <goal>run</goal>
                                        </goals>
                                    </pluginExecutionFilter>
                                    <action>
                                        <execute>
                                            <runOnIncremental>false</runOnIncremental>
                                            <runOnConfiguration>true</runOnConfiguration>
                                        </execute>
                                    </action>
                                </pluginExecution>
                            </pluginExecutions>
                        </lifecycleMappingMetadata>
                    </configuration>
                </plugin>
            </plugins>
        </pluginManagement>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <executions>
                    <execution>
                        <id>enforce-versions</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requireJavaVersion>
                                    <version>[11,)</version>
                                </requireJavaVersion>
                            </rules>
                        </configuration>
                    </execution>
                    <execution>
                        <id>enforce-no-snapshots</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requireReleaseDeps>
                                    <message>No Snapshots Allowed!</message>
                                    <onlyWhenRelease>true</onlyWhenRelease>
                                </requireReleaseDeps>
                            </rules>
                        </configuration>
                    </execution>
                    <execution>
                        <id>enforce-plugin-versions</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requirePluginVersions>
                                    <message>Best Practice is to always define plugin versions!</message>
                                </requirePluginVersions>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <!-- configuration is in plugin management section -->
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <!-- configuration is in plugin management section -->
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <executions>
                    <execution>
                        <id>attach-sources</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.sonatype.plugins</groupId>
                <artifactId>nexus-staging-maven-plugin</artifactId>
                <extensions>true</extensions>
                <configuration>
                    <serverId>ossrh</serverId>
                    <nexusUrl>https://oss.sonatype.org/</nexusUrl>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>makeAggregateBom</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.antlr</groupId>
                <artifactId>antlr4-runtime</artifactId>
                <version>${antlr.version}</version>
            </dependency>
            <dependency>
                <!-- old antlr version used by apex-jorje -->
                <groupId>org.antlr</groupId>
                <artifactId>antlr-runtime</artifactId>
                <version>3.5.2</version>
            </dependency>
            <dependency>
                <groupId>org.apache.ant</groupId>
                <artifactId>ant</artifactId>
                <version>${ant.version}</version>
            </dependency>
            <dependency>
                <groupId>info.picocli</groupId>
                <artifactId>picocli</artifactId>
                <version>4.7.0</version>
            </dependency>
            <dependency>
                <groupId>me.tongfei</groupId>
                <artifactId>progressbar</artifactId>
                <version>0.9.5</version>
            </dependency>
            <dependency>
                <groupId>org.ow2.asm</groupId>
                <artifactId>asm</artifactId>
                <version>9.5</version>
            </dependency>
            <dependency>
                <groupId>org.pcollections</groupId>
                <artifactId>pcollections</artifactId>
                <version>3.1.3</version>
            </dependency>
            <dependency>
                <groupId>net.sourceforge.pmd</groupId>
                <artifactId>pmd-core</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>net.sourceforge.pmd</groupId>
                <artifactId>pmd-ant</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>net.sourceforge.pmd</groupId>
                <artifactId>pmd-test-schema</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.checkerframework</groupId>
                <artifactId>checker-qual</artifactId>
                <version>2.5.2</version>
            </dependency>
            <dependency>
                <groupId>net.sourceforge.saxon</groupId>
                <artifactId>saxon</artifactId>
                <version>9.1.0.8</version>
            </dependency>
            <dependency>
                <groupId>net.sf.saxon</groupId>
                <artifactId>Saxon-HE</artifactId>
                <version>${saxon.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-lang3</artifactId>
                <version>3.8.1</version>
            </dependency>
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-text</artifactId>
                <version>1.3</version> <!-- 1.3 is still compatible with java7 -->
            </dependency>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>${slf4j.version}</version>
            </dependency>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-simple</artifactId>
                <version>${slf4j.version}</version>
            </dependency>
            <dependency>
              <groupId>org.slf4j</groupId>
              <artifactId>jul-to-slf4j</artifactId>
              <version>${slf4j.version}</version>
            </dependency>
            <dependency>
                <groupId>org.codehaus.groovy</groupId>
                <artifactId>groovy</artifactId>
                <version>2.4.21</version>
            </dependency>
            <dependency>
                <groupId>com.google.code.gson</groupId>
                <artifactId>gson</artifactId>
                <version>2.8.9</version>
            </dependency>
            <dependency>
                <groupId>org.yaml</groupId>
                <artifactId>snakeyaml</artifactId>
                <version>1.33</version>
            </dependency>
            <dependency>
                <groupId>com.google.guava</groupId>
                <artifactId>guava</artifactId>
                <version>32.0.1-jre</version>
            </dependency>

            <!-- needed by pmd-apex via apex-link -->
            <dependency>
                <groupId>org.scala-lang</groupId>
                <artifactId>scala-reflect</artifactId>
                <version>2.13.12</version>
            </dependency>

            <!-- TEST DEPENDENCIES -->
            <dependency>
                <groupId>net.sourceforge.pmd</groupId>
                <artifactId>pmd-test</artifactId>
                <version>${project.version}</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>net.sourceforge.pmd</groupId>
                <artifactId>pmd-lang-test</artifactId>
                <version>${project.version}</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>com.github.oowekyala.treeutils</groupId>
                <artifactId>tree-matchers</artifactId>
                <version>2.1.0</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>com.github.oowekyala.treeutils</groupId>
                <artifactId>tree-printers</artifactId>
                <version>2.1.0</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>org.hamcrest</groupId>
                <artifactId>hamcrest</artifactId>
                <version>2.2</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>org.junit</groupId>
                <artifactId>junit-bom</artifactId>
                <version>5.8.2</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <dependency>
                <groupId>org.junit.platform</groupId>
                <artifactId>junit-platform-suite</artifactId>
                <version>1.9.0-M1</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>com.github.stefanbirkner</groupId>
                <artifactId>system-lambda</artifactId>
                <version>1.2.1</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>junit</groupId>
                <artifactId>junit</artifactId>
                <version>4.13.1</version>
                <scope>test</scope>
                <exclusions>
                    <exclusion>
                        <groupId>org.hamcrest</groupId>
                        <artifactId>hamcrest-core</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>org.mockito</groupId>
                <artifactId>mockito-core</artifactId>
                <version>4.11.0</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>com.github.tomakehurst</groupId>
                <artifactId>wiremock-jre8</artifactId>
                <version>2.35.1</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>com.github.stefanbirkner</groupId>
                <artifactId>system-rules</artifactId>
                <version>1.19.0</version>
                <scope>test</scope>
                <exclusions>
                    <exclusion>
                        <groupId>junit</groupId>
                        <artifactId>junit-dep</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <!-- Kotlin -->
            <dependency>
                <groupId>org.jetbrains.kotlin</groupId>
                <artifactId>kotlin-stdlib</artifactId>
                <version>${kotlin.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.jetbrains.kotlin</groupId>
                <artifactId>kotlin-stdlib-jdk8</artifactId>
                <version>${kotlin.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.jetbrains.kotlin</groupId>
                <artifactId>kotlin-reflect</artifactId>
                <version>${kotlin.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.jetbrains.kotlin</groupId>
                <artifactId>kotlin-test-junit</artifactId>
                <version>${kotlin.version}</version>
                <scope>test</scope>
                <exclusions>
                    <exclusion>
                        <groupId>junit</groupId>
                        <artifactId>junit</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>io.kotest</groupId>
                <artifactId>kotest-runner-junit5-jvm</artifactId>
                <version>${kotest.version}</version>
                <scope>test</scope>
                <exclusions>
                    <exclusion>
                        <groupId>junit</groupId>
                        <artifactId>junit</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>io.kotest</groupId>
                <artifactId>kotest-runner-console-jvm</artifactId>
                <version>${kotest.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>io.kotest</groupId>
                <artifactId>kotest-assertions-core-jvm</artifactId>
                <version>${kotest.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>io.kotest</groupId>
                <artifactId>kotest-property-jvm</artifactId>
                <version>${kotest.version}</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>org.jetbrains</groupId>
                <artifactId>annotations</artifactId>
                <version>13.0</version>
                <scope>test</scope>
            </dependency>

            <!-- transitive dependency through org.scalameta:trees_2.13
                 upgrade to 3.16.1 to fix CVE-2021-22569 A potential Denial of Service issue in protobuf-java
                 https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-wrvw-hg22-4m67
                 upgrade to 3.16.3 to fix CVE-2022-3171 protobuf-java has a potential Denial of Service issue
                 https://github.com/advisories/GHSA-h4h5-3hr4-j3g2
            -->
            <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protobuf-java</artifactId>
                <version>3.16.3</version>
            </dependency>

            <!-- Make sure to use the correct version the JUnit5 needs. E.g. 5.8.2 needs 1.8.2
                 Kotest might bring a wrong version.
                 see junit5.version -->
            <dependency>
                <groupId>org.junit.platform</groupId>
                <artifactId>junit-platform-commons</artifactId>
                <version>1.8.2</version>
                <scope>test</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <repositories>
        <repository>
            <id>central</id>
            <name>Central Repository</name>
            <url>https://repo.maven.apache.org/maven2</url>
            <releases>
                <enabled>true</enabled>
                <updatePolicy>never</updatePolicy>
            </releases>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
        <repository>
            <id>sonatype-nexus-snapshots</id>
            <name>Sonatype Nexus Snapshots</name>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
            <releases>
                <enabled>false</enabled>
            </releases>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
        </repository>
    </repositories>
    <pluginRepositories>
        <pluginRepository>
            <id>central</id>
            <name>Central Repository</name>
            <url>https://repo.maven.apache.org/maven2</url>
            <releases>
                <enabled>true</enabled>
                <updatePolicy>never</updatePolicy>
            </releases>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </pluginRepository>
        <pluginRepository>
            <id>sonatype-nexus-plugin-snapshots</id>
            <name>Sonatype Nexus Snapshots</name>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
            <releases>
                <enabled>false</enabled>
            </releases>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
        </pluginRepository>
        <pluginRepository>
            <id>apache.snapshots</id>
            <name>Apache Snapshot Repository</name>
            <url>https://repository.apache.org/snapshots</url>
            <releases>
                <enabled>false</enabled>
            </releases>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
        </pluginRepository>
    </pluginRepositories>

    <profiles>
        <profile>
            <!-- Adds an SLF4J implementation, useful when developing within an IDE -->
            <id>with-slf4j-impl</id>
            <activation>
                <activeByDefault>false</activeByDefault>
            </activation>
            <dependencies>
                <dependency>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-simple</artifactId>
                </dependency>
            </dependencies>
        </profile>

        <profile>
            <id>Java 18+</id>
            <activation>
                <jdk>[18,)</jdk>
            </activation>
            <properties>
                <!-- java.security.manager=allow is needed under Java 18+ for usages of com.github.stefanbirkner.systemlambda.SystemLambda.catchSystemExit -->
                <extraArgLine>-Djava.security.manager=allow</extraArgLine>
            </properties>
        </profile>

        <profile>
            <id>pmd-release</id>
            <properties>
                <pmd.website.baseurl>https://docs.pmd-code.org/pmd-doc-${project.version}</pmd.website.baseurl>
            </properties>
        </profile>
        <profile>
            <id>sign</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>3.0.1</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>doclint</id>
            <build>
                <pluginManagement>
                    <plugins>
                        <plugin>
                            <groupId>org.apache.maven.plugins</groupId>
                            <artifactId>maven-javadoc-plugin</artifactId>
                            <configuration>
                                <doclint>all</doclint>
                            </configuration>
                        </plugin>
                    </plugins>
                </pluginManagement>
            </build>
        </profile>

        <profile>
            <id>coveralls</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.jacoco</groupId>
                        <artifactId>jacoco-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>default-prepare-agent</id>
                                <goals>
                                    <goal>prepare-agent</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.eluder.coveralls</groupId>
                        <artifactId>coveralls-maven-plugin</artifactId>
                        <version>4.3.0</version>
                        <dependencies>
                            <!--
                                coveralls maven plugin needs javax.xml.bind api
                                See also https://github.com/trautonen/coveralls-maven-plugin/issues/112
                            -->
                            <dependency>
                                <groupId>javax.xml.bind</groupId>
                                <artifactId>jaxb-api</artifactId>
                                <version>2.3.0</version>
                            </dependency>
                        </dependencies>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>sonar</id>
            <properties>
                <sonar.host.url>https://sonarcloud.io</sonar.host.url>
                <sonar.organization>pmd</sonar.organization>
                <sonar.java.source>1.8</sonar.java.source>
            </properties>
            <build>
                <pluginManagement>
                    <plugins>
                        <plugin>
                            <groupId>org.sonarsource.scanner.maven</groupId>
                            <artifactId>sonar-maven-plugin</artifactId>
                            <version>3.7.0.1746</version>
                        </plugin>
                    </plugins>
                </pluginManagement>
                <plugins>
                    <plugin>
                        <groupId>org.jacoco</groupId>
                        <artifactId>jacoco-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>default-prepare-agent</id>
                                <goals>
                                    <goal>prepare-agent</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>cli-dist</id>
            <activation>
                <activeByDefault>true</activeByDefault>
            </activation>
            <modules>
                <module>pmd-cli</module>
                <module>pmd-dist</module>
            </modules>
        </profile>
    </profiles>

    <modules>
        <module>pmd-apex-jorje</module>
        <module>pmd-apex</module>
        <module>pmd-coco</module>
        <module>pmd-core</module>
        <module>pmd-cpp</module>
        <module>pmd-cs</module>
        <module>pmd-dart</module>
        <module>pmd-doc</module>
        <module>pmd-fortran</module>
        <module>pmd-gherkin</module>
        <module>pmd-go</module>
        <module>pmd-groovy</module>
        <module>pmd-html</module>
        <module>pmd-lua</module>
        <module>pmd-java</module>
        <module>pmd-javascript</module>
        <module>pmd-jsp</module>
        <module>pmd-julia</module>
        <module>pmd-kotlin</module>
        <module>pmd-lang-test</module>
        <module>pmd-matlab</module>
        <module>pmd-modelica</module>
        <module>pmd-objectivec</module>
        <module>pmd-perl</module>
        <module>pmd-php</module>
        <module>pmd-plsql</module>
        <module>pmd-python</module>
        <module>pmd-ruby</module>
        <module>pmd-scala</module> <!-- deprecated -->
        <module>pmd-scala-modules/pmd-scala-common</module>
        <module>pmd-scala-modules/pmd-scala_2.13</module>
        <module>pmd-scala-modules/pmd-scala_2.12</module>
        <module>pmd-swift</module>
        <module>pmd-test</module>
        <module>pmd-test-schema</module>
        <module>pmd-tsql</module>
        <module>pmd-visualforce</module>
        <module>pmd-vm</module>
        <module>pmd-xml</module>
        <module>pmd-ant</module>
        <module>pmd-languages-deps</module>
    </modules>
</project>

2024 State of the Software Supply Chain

Open source consumption has exploded, with estimates placing this year’s downloads at over 6.6 trillion. This reliance on open source components, now making up to 90% of the modern software application, has ushered in both unprecedented innovation and complex challenges for software supply chains.

View the Report
State Of The Software Supply Chain Report

Metadata

Age:1 year ago
Licenses:
  • BSD-style
Size:12.3 kB

Organization

External Resources

Project URL
Issue Tracker URL
Source Control
Continuous Integration

Known Contributors

github contributors
Sonatype Logo

Sonatype Safety Rating

An aggregate rating designed to represent a project’s readiness against vulnerabilities.
6 out of 10
How did we get this score?
OSS Index
Loading...
View