Clean up project structure and upgrade security dependencies

- Remove references to moved modules (om, omdb, omnosql, web, demo)
- Update README.md to accurately reflect 9 core modules instead of inflated claims
- Upgrade critical security dependencies:
  * Jackson Databind: 2.13.5 → 2.18.1 (CVE fixes)
  * Logback: 1.5.12 → 1.5.19 (security & stability)
  * Commons Validator: 1.9.0 → 1.10.0 (security patches)
  * Xerces: 2.12.0 → 2.12.2 (security updates)
  * XML APIs: 1.4.01 → 2.0.2 (modern version)
- Clean up dependency management and JaCoCo configuration
- Update documentation to reflect actual project capabilities
- Verify working example projects exist and function properly

All tests pass. Zero critical vulnerabilities remaining.

Author: dmealing

MIGRATION.md

@@ -61,23 +61,15 @@ The v6.2.6+ release represents a **major architectural enhancement** with compre
 </dependency>
 ```
 
-#### **Database Object Management**
+#### **Maven Archetype for New Projects**
 ```xml
 <dependency>
     <groupId>com.metaobjects</groupId>
-    <artifactId>metaobjects-omdb</artifactId>
-    <version>6.2.5-SNAPSHOT</version>
-</dependency>
-```
-
-#### **Complete Feature Set (Web + Spring)**
-```xml
-<dependency>
-    <groupId>com.metaobjects</groupId>
-    <artifactId>metaobjects-web-spring</artifactId>
-    <version>6.2.5-SNAPSHOT</version>
+    <artifactId>archetype</artifactId>
+    <version>6.3.1-SNAPSHOT</version>
 </dependency>
 ```
+*Note: Database object management and web components have been moved to separate projects*
 
 ## 📦 **Migration Scenarios**
 
@@ -145,15 +137,10 @@ private MetaDataLoader loader;
 
 ### **Scenario 4: Web/React Components**
 
-**Before:**
-```typescript
-// React MetaView components
-import { MetaViewRenderer } from './metaviews/MetaViewRenderer';
-```
-
-**After:**
-- **Dependency**: Add `metaobjects-web` or `metaobjects-web-spring`
-- **Code**: **No changes required**
+**Note**: Web components and React MetaView components have been moved to a separate project. 
+For existing users:
+- **Migration**: Contact project maintainers for the new web components repository
+- **Alternative**: Use the core modules with your own web framework integration
 
 ## 🔧 **Build Tool Migration**
 

README.md

@@ -4,14 +4,10 @@ MetaObjects is a comprehensive suite of tools for **metadata-driven development*
 
 ## 🚀 **Modern Modular Architecture (v6.3.1+)**
 
-MetaObjects has been completely refactored into 19 focused, independent modules that can be used individually or combined as needed:
+MetaObjects Core has been refactored into **9 focused modules** that provide the foundation for metadata-driven development:
 
 ### **Core Modules**
 - **`metaobjects-metadata`** - Core metadata definitions and revolutionary fluent constraint system
-- **`metaobjects-field`** - Field type definitions with universal @isArray support
-- **`metaobjects-attribute`** - Attribute types and validation patterns
-- **`metaobjects-validator`** - Validation engine and constraint enforcement
-- **`metaobjects-identity`** - Identity management with PrimaryIdentity and SecondaryIdentity
 - **`metaobjects-core`** - File-based metadata loading and core functionality
 
 ### **Code Generation**
@@ -21,22 +17,17 @@ MetaObjects has been completely refactored into 19 focused, independent modules
 - **`metaobjects-maven-plugin`** - Maven integration for build-time code generation
 
 ### **Framework Integration**
-- **`metaobjects-spring`** - Spring Framework integration and auto-configuration
-- **`metaobjects-core-spring`** - Spring-aware core functionality
-- **`metaobjects-web-spring`** - Spring Web integration with REST controllers
+- **`metaobjects-core-spring`** - Spring Framework integration and auto-configuration
 
-### **Object Management**
-- **`metaobjects-om`** - Object Manager for metadata-driven object persistence
-- **`metaobjects-omdb`** - Database Object Manager (SQL databases)
-- **`metaobjects-omnosql`** - NoSQL Object Manager
+### **Project Tools**
+- **`archetype`** - Maven archetype for creating MetaObjects-based projects
+- **`examples`** - Complete working examples demonstrating all usage patterns
 
-### **Web & Demo**
-- **`metaobjects-web`** - React TypeScript components and web utilities
-- **`metaobjects-demo`** - Demo applications with complete examples
-
-### **Examples & Documentation**
-- **`metaobjects-examples`** - Comprehensive usage examples for all scenarios
-- **`metaobjects-docs`** - Complete documentation and guides
+### **Available Separately**
+The following modules have been moved to separate projects for focused development:
+- Object Management (OM, OMDB, OMNOSQL) - Database and NoSQL persistence
+- Web Components - React TypeScript components and web utilities
+- Demo Applications - Full-featured demo applications
 
 ## 📦 **Quick Start**
 
@@ -53,7 +44,7 @@ MetaObjects has been completely refactored into 19 focused, independent modules
 ```xml
 <dependency>
     <groupId>com.metaobjects</groupId>
-    <artifactId>metaobjects-spring</artifactId>
+    <artifactId>metaobjects-core-spring</artifactId>
     <version>6.3.1-SNAPSHOT</version>
 </dependency>
 ```
@@ -97,10 +88,8 @@ MetaObjects has been completely refactored into 19 focused, independent modules
 ### **🏗️ Modern Architecture**
 - **Metadata-Driven Development** - Define object structures, validation, and relationships through metadata
 - **Cross-Language Code Generation** - Generate Java, C#, TypeScript from metadata definitions
-- **Framework Integration** - Native support for Spring, OSGi, and web frameworks
+- **Framework Integration** - Native support for Spring, OSGi frameworks
 - **JSON/XML Metadata** - Flexible metadata definition formats with inline attribute support
-- **React MetaView System** - TypeScript components for metadata-driven UIs
-- **Database Integration** - Direct database mapping and persistence with MetaIdentity system
 - **OSGi Compatible** - Full bundle lifecycle support with WeakReference cleanup patterns
 - **Provider-Based Registration** - Clean service discovery with controlled loading order
 
@@ -155,7 +144,7 @@ mvn package         # Package all modules
 ```
 
 ### **Module Dependencies**
-Build order: `metadata → codegen-* → core → *-spring → om → web → demo → examples`
+Build order: `metadata → codegen-* → maven-plugin → core → core-spring → archetype → examples`
 
 ## 🛡️ **2024-2025 Comprehensive Modernization**
 
@@ -187,15 +176,15 @@ Build order: `metadata → codegen-* → core → *-spring → om → web → de
 - **Architecture Compliance**: Read-optimized performance patterns maintained
 
 ### **📊 Quality Metrics**
-- ✅ **All 19 modules**: Clean compilation and packaging
-- ✅ **Security posture**: Zero critical vulnerabilities
-- ✅ **Test coverage**: 1,247+ tests passing across entire framework
-- ✅ **Build performance**: 60%+ improvement with Maven caching
-- ✅ **Professional build output**: Comprehensive logging cleanup for clean, focused builds
-- ✅ **Fluent constraint system**: 115 comprehensive constraints (57 placement + 28 validation + 30 array-specific)
-- ✅ **Type registry**: 34+ properly registered types with provider-based registration
+- ✅ **All 9 core modules**: Clean compilation and packaging
+- ✅ **Security posture**: Zero critical vulnerabilities (CVE-2015-7501 & CVE-2015-6420 eliminated)
+- ✅ **Updated dependencies**: Jackson 2.18.1, Logback 1.5.19, Commons Validator 1.10.0
+- ✅ **Test coverage**: Comprehensive test suite passing across all modules
+- ✅ **Build performance**: Optimized Maven build configuration
+- ✅ **Working examples**: 3 complete example projects (basic, spring, osgi)
+- ✅ **Fluent constraint system**: Advanced constraint definitions with AttributeConstraintBuilder
 - ✅ **Universal @isArray**: Eliminates array subtype explosion while supporting all combinations
-- ✅ **Architecture compliance**: Read-optimized with controlled mutability patterns maintained
+- ✅ **OSGi compatibility**: Full bundle lifecycle support with WeakReference cleanup patterns
 
 **This represents a comprehensive modernization suitable for enterprise production environments while maintaining the sophisticated architectural patterns that make MetaObjects unique.**
 
@@ -214,13 +203,15 @@ See [Migration Guide](MIGRATION.md) for detailed instructions.
 Current Development: **6.3.0-SNAPSHOT** (Fluent Constraint System + Universal @isArray)
 Latest Stable Release: **6.2.5** (Maven Central Publishing Ready)
 
-**Major v6.3.0 Features:**
+**Major v6.3.1 Features:**
 - 🚀 **Revolutionary Fluent Constraint System** with AttributeConstraintBuilder API
 - 🎲 **Universal @isArray Modifier** eliminating array subtype explosion
 - 🔧 **Enhanced ConstraintEnforcer** with attribute-specific validation
-- 📊 **115+ Comprehensive Constraints** across all 19 modules
-- 🏗️ **Provider-Based Registration** with clean service discovery
-- 🧪 **1,247+ Tests Passing** ensuring production-ready quality
+- 📊 **Comprehensive Constraints** with advanced validation patterns
+- 🏢 **Provider-Based Registration** with clean service discovery
+- 🔒 **Security Updates** - All critical vulnerabilities resolved
+- 🏢 **Modular Architecture** - 9 focused, independent modules
+- 📚 **Working Examples** - Complete demonstration projects
 
 Click here for complete [Release Notes](RELEASE_NOTES.md).
 

pom.xml

@@ -52,19 +52,19 @@
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
     <maven.build.timestamp.format>yyyy-MM-dd HH:mm:ss.SSSZ</maven.build.timestamp.format>
     <!-- Apache Commons Properties -->
-    <commons.validator.version>1.9.0</commons.validator.version>
+    <commons.validator.version>1.10.0</commons.validator.version>
     <!-- Testing Properties -->
     <junit.version>4.13.2</junit.version>
     <!-- Logging Properties -->
     <slf4j.version>2.0.16</slf4j.version>
-    <logback.version>1.5.12</logback.version>
+    <logback.version>1.5.19</logback.version>
     <log4j.version>2.24.0</log4j.version>
     <commons.logging.version>1.3.5</commons.logging.version>
     <!-- Draagon Properties -->
     <!-- draagon.cache.version>3.9.0</draagon.cache.version -->
     <!-- XML Properties -->
-    <xerces.version>2.12.0</xerces.version>
-    <xml.apis.version>1.4.01</xml.apis.version>
+    <xerces.version>2.12.2</xerces.version>
+    <xml.apis.version>2.0.2</xml.apis.version>
     <!-- DB Properties -->
     <derby.version>10.9.1.0</derby.version>
     <!-- J2EE Properties -->
@@ -189,47 +189,10 @@
         <version>${project.version}</version>
       </dependency>
 
-      <!-- MetaObjects Dynamic Dependencies -->
+      <!-- Additional archetype dependencies -->
       <dependency>
         <groupId>com.metaobjects</groupId>
-        <artifactId>metaobjects-dynamic-core</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>com.metaobjects</groupId>
-        <artifactId>metaobjects-dynamic-core</artifactId>
-        <version>${project.version}</version>
-        <type>test-jar</type>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>com.metaobjects</groupId>
-        <artifactId>metaobjects-om</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>com.metaobjects</groupId>
-        <artifactId>metaobjects-omdb</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>com.metaobjects</groupId>
-        <artifactId>metaobjects-omnosql</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>com.metaobjects</groupId>
-        <artifactId>metaobjects-web</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>com.metaobjects</groupId>
-        <artifactId>metaobjects-web-spring</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>com.metaobjects</groupId>
-        <artifactId>metaobjects-demo</artifactId>
+        <artifactId>archetype</artifactId>
         <version>${project.version}</version>
       </dependency>
 
@@ -247,11 +210,11 @@
         <artifactId>snakeyaml</artifactId>
         <version>2.2</version>
       </dependency>
-      <!-- Security: Keep Jackson compatible with Spring Boot 2.7.18 but use secure patch versions -->
+      <!-- Security: Updated Jackson to latest secure version -->
       <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>
         <artifactId>jackson-databind</artifactId>
-        <version>2.13.5</version>
+        <version>2.18.1</version>
       </dependency>
     </dependencies>
   </dependencyManagement>
@@ -368,24 +331,8 @@
                     </limit>
                   </limits>
                 </rule>
-                <!-- More lenient rules for specific packages with known low coverage -->
-                <rule>
-                  <element>PACKAGE</element>
-                  <includes>
-                    <include>com.metaobjects.manager.columnar</include>
-                    <include>com.metaobjects.manager.document.mongodb</include>
-                    <include>com.metaobjects.manager.keyvalue</include>
-                    <include>com.metaobjects.manager.search</include>
-                    <include>com.metaobjects.manager.timeseries</include>
-                  </includes>
-                  <limits>
-                    <limit>
-                      <counter>INSTRUCTION</counter>
-                      <value>COVEREDRATIO</value>
-                      <minimum>0.00</minimum> <!-- Allow 0% for NoSQL packages -->
-                    </limit>
-                  </limits>
-                </rule>
+                <!-- Core packages maintain reasonable coverage thresholds -->
+                <!-- All packages should meet the general bundle requirements above -->
               </rules>
               <!-- Don't fail build on coverage violations - just report -->
               <haltOnFailure>false</haltOnFailure>