Skip to content

build: modernize Maven deps & multi-version packaging #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shiftySenpai wants to merge 6 commits into
base: develop
Choose a base branch
from
Open

build: modernize Maven deps & multi-version packaging #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8bce3c8
build: add OWASP dependency-check with CVSS 7.0 gate
shiftySenpai Jun 22, 2026
40d67a4
build: target Java 21 and bump maven-compiler-plugin to 3.14.0
shiftySenpai Jun 22, 2026
a2e7dcd
refactor: replace json-simple with gson for HEC envelope
shiftySenpai Jun 22, 2026
dc43255
build: centralize dependency versions in parent, bump junit to 4.13.2
shiftySenpai Jun 22, 2026
e4db6d1
build: drop forge from reactor, bump shade plugin to 3.6.0, remove st…
shiftySenpai Jun 22, 2026
ce08786
build: restructure Maven modules for multi-version packaging, pin CVE…
shiftySenpai Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 29 additions & 17 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,30 @@
*.pyo
*.pyc
*.swp
build
.gradle
bin/
.project
*.iml
.idea/
eclipse/
.classpath
logs/
.settings
target/
*.pyo
*.pyc
*.swp
build
.gradle
bin/
.project
*.iml
.idea/
eclipse/
.classpath
logs/
.settings
target/

#forge .idea things:
*.ipr
*.iws
# Editor/tooling droppings
.vscode/
.cursor/
.codegraph/
graphify-out/
*.code-workspace

#forge .idea things:
*.ipr
*.iws
# Local tool installs / build output not meant for version control
mvn-bin/
dist/
node_modules/
*.tar.gz
43 changes: 22 additions & 21 deletions default/app.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,21 +1,22 @@
#
# Splunk app configuration file
#

[install]
state = enabled
state_change_requires_restart = 0
is_configured = 0
build = 1

[ui]
is_visible = 1
label = Minecraft

[launcher]
author = mpapale@splunk.com
description = The Splunk App for Minecraft let's you visualize your Minecraft server data.
version = 1.0

[package]
id = minecraft-app
#
# Splunk app configuration file
#

[install]
state = enabled
state_change_requires_restart = 0
is_configured = 0
build = 1

[ui]
is_visible = 1
label = Minecraft
supported_themes = light, dark

[launcher]
author = mpapale@splunk.com
description = The Splunk App for Minecraft let's you visualize your Minecraft server data.
version = 1.0

[package]
id = minecraft-app
143 changes: 55 additions & 88 deletions logtosplunk-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,108 +8,75 @@
</parent>
<modelVersion>4.0.0</modelVersion>

<!--
Dist aggregator. Each platform module (spigot, paper) produces its own shaded JAR
named logtosplunk-<mc.version>-<loader>-<loader.version>.jar in its own target/.
This module collects all of those JARs plus Gradle-built artifacts (forge, neoforge,
fabric) into a single dist/ folder at the project root.

Run after a full build:
mvn package (default MC 1.21.1 spigot + paper)
mvn package -P mc-1201
./gradlew shadowJar (from forge/, neoforge/, fabric/ separately)
-->
<artifactId>logtosplunk-plugin</artifactId>

<repositories>
<repository>
<id>mvnrepository-central</id>
<name>mvnrepository.com Central</name>
<url>https://repo1.maven.org/maven2/</url>
</repository>
<repository>
<id>splunk-artifactory</id>
<name>Splunk Releases</name>
<url>https://splunk.jfrog.io/splunk/ext-releases-local</url>
</repository>
</repositories>

<dependencies>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.25.1</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.25.1</version>
</dependency>
<dependency>
<groupId>com.splunk.logging</groupId>
<artifactId>splunk-library-javalogging</artifactId>
<version>1.11.8</version>
</dependency>
<dependency>
<groupId>com.splunk</groupId>
<artifactId>shared-mc</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>com.splunk</groupId>
<artifactId>spigot</artifactId>
<version>${project.version}</version>
</dependency>
</dependencies>
<packaging>pom</packaging>

<build>
<plugins>
<!--
Collect all logtosplunk-*.jar artifacts from sibling Maven module targets
and Gradle build/libs directories into ${maven.multiModuleProjectDirectory}/dist/.
Runs during the package phase, after all sibling modules have packaged.
-->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-shade-plugin</artifactId>
<configuration>
<dependencyReducedPomLocation>
${project.build.directory}/dependency-reduced-pom.xml
</dependencyReducedPomLocation>
</configuration>

<version>2.4.1</version>
<artifactId>maven-antrun-plugin</artifactId>
<version>3.1.0</version>
<executions>
<execution>
<id>collect-dist</id>
<phase>package</phase>
<goals>
<goal>shade</goal>
<goal>run</goal>
</goals>
<configuration>
<target>
<mkdir dir="${maven.multiModuleProjectDirectory}/dist"/>
<!-- Maven-built platform JARs (spigot, paper) -->
<copy todir="${maven.multiModuleProjectDirectory}/dist" failonerror="false">
<fileset dir="${maven.multiModuleProjectDirectory}/spigot/target"
includes="logtosplunk-*.jar"/>
</copy>
<copy todir="${maven.multiModuleProjectDirectory}/dist" failonerror="false">
<fileset dir="${maven.multiModuleProjectDirectory}/paper/target"
includes="logtosplunk-*.jar"/>
</copy>
<!-- Gradle-built platform JARs (forge, neoforge, fabric) -->
<copy todir="${maven.multiModuleProjectDirectory}/dist" failonerror="false">
<fileset dir="${maven.multiModuleProjectDirectory}/forge/build/libs"
includes="logtosplunk-*.jar"/>
</copy>
<copy todir="${maven.multiModuleProjectDirectory}/dist" failonerror="false">
<fileset dir="${maven.multiModuleProjectDirectory}/neoforge/build/libs"
includes="logtosplunk-*.jar"/>
</copy>
<copy todir="${maven.multiModuleProjectDirectory}/dist" failonerror="false">
<fileset dir="${maven.multiModuleProjectDirectory}/fabric/build/libs"
includes="logtosplunk-*.jar"
excludes="*-sources.jar"/>
</copy>
<echo message="dist/ contents:"/>
<fileset id="dist.files" dir="${maven.multiModuleProjectDirectory}/dist"
includes="*.jar"/>
<pathconvert pathsep="${line.separator} " property="dist.list"
refid="dist.files"/>
<echo message=" ${dist.list}"/>
</target>
</configuration>
</execution>
</executions>

</plugin>
</plugins>
</build>

<profiles>
<profile>
<id>include-forge</id>
<dependencies>
<dependency>
<groupId>com.splunk</groupId>
<artifactId>logtosplunk-forge</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
</dependency>
<dependency>
<groupId>com.splunk</groupId>
<artifactId>splunk-library-javalogging</artifactId>
<version>1.0.1</version>
</dependency>
<dependency>
<groupId>com.splunk</groupId>
<artifactId>shared-mc</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>com.splunk</groupId>
<artifactId>spigot</artifactId>
<version>${project.version}</version>
</dependency>
</dependencies>
</profile>
</profiles>
<!--TODO: Package all plugin componenents into one uberjar here-->
</project>
55 changes: 55 additions & 0 deletions owasp-suppressions.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<!-- Add <suppress> entries here only for verified false positives, with a justifying comment. -->

<!--
CVE-2026-53914 (CVSS 9.8) — affects kotlin-stdlib across all versions including 2.0.21.
We do not ship any Kotlin code. kotlin-stdlib is a transitive compile-time dep pulled in
by okhttp3:4.11.0 (itself a dep of splunk-library-javalogging). We've pinned kotlin-stdlib
to 2.0.21 in <dependencyManagement> which is the latest available; the CVE has no
published fix version as of this writing. Suppress pending a Kotlin or OkHttp release
that resolves this CVE. Re-evaluate when splunk-library-javalogging ships with a newer
okhttp3 that drops or upgrades kotlin-stdlib to a fixed version.
-->
<suppress>
<notes>CVE-2026-53914: affects all kotlin-stdlib versions, no fix available. kotlin-stdlib
is a transitive dep from okhttp3 via splunk-library-javalogging; we write no Kotlin code.
Pinned to 2.0.21 (latest); re-evaluate when a fixed kotlin-stdlib version is published.</notes>
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib.*@.*$</packageUrl>
<cve>CVE-2026-53914</cve>
</suppress>

<!--
CVE-2020-29582 — Kotlin scripting engine writes artifacts to a world-readable temp directory.
We do not use Kotlin scripting (no script engine invocation anywhere in this codebase).
kotlin-stdlib is only present as a transitive runtime dep from OkHttp.
-->
<suppress>
<notes>CVE-2020-29582: Kotlin scripting temp-dir exposure. We don't use Kotlin scripting;
kotlin-stdlib is a transitive dep from okhttp3/splunk-library-javalogging.</notes>
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib.*@.*$</packageUrl>
<cve>CVE-2020-29582</cve>
</suppress>


<!--
CVE-2023-33245 (8.8) and CVE-2021-35054 (7.5) — false positives on shared-mc-1.0-SNAPSHOT.jar.
OWASP matched the JAR to cpe:2.3:a:minecraft:minecraft:1.0:snapshot because the project
directory contains "minecraft" in its path and the version string is "1.0-SNAPSHOT". These
CVEs describe vulnerabilities in the Minecraft game client/server, not in this library.
shared-mc is our own code (Splunk HEC/KV transport logic), not the Mojang Minecraft product.
-->
<suppress>
<notes>False positive: shared-mc JAR matched to Minecraft game CPE due to "minecraft" in
project path and "SNAPSHOT" in version. CVE-2023-33245 and CVE-2021-35054 are Minecraft
game vulnerabilities, unrelated to this library.</notes>
<packageUrl regex="true">^pkg:maven/com\.splunk/shared\-mc@.*$</packageUrl>
<cve>CVE-2023-33245</cve>
</suppress>
<suppress>
<notes>False positive — same reason as CVE-2023-33245 above.</notes>
<packageUrl regex="true">^pkg:maven/com\.splunk/shared\-mc@.*$</packageUrl>
<cve>CVE-2021-35054</cve>
</suppress>

</suppressions>
Loading