[NCL-9724] Fix CVEs

communication/src/main/java/org/jboss/da/communication/scm/api/SCMConnector.java

@@ -5,12 +5,12 @@
 import java.util.Optional;
 import java.util.Set;
 
-import org.apache.maven.scm.ScmException;
 import org.jboss.da.communication.pom.PomAnalysisException;
 import org.jboss.da.communication.pom.model.MavenProject;
 import org.jboss.da.communication.repository.model.GAVDependencyTree;
 import org.jboss.da.model.rest.GA;
 import org.jboss.da.model.rest.GAV;
+import org.jboss.da.scm.api.ScmException;
 
 /**
  *

communication/src/main/java/org/jboss/da/communication/scm/impl/SCMConnectorImpl.java

@@ -9,7 +9,6 @@
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
 
-import org.apache.maven.scm.ScmException;
 import org.jboss.da.communication.pom.PomAnalysisException;
 import org.jboss.da.communication.pom.api.PomAnalyzer;
 import org.jboss.da.communication.pom.model.MavenProject;
@@ -18,7 +17,7 @@
 import org.jboss.da.model.rest.GA;
 import org.jboss.da.model.rest.GAV;
 import org.jboss.da.scm.api.SCM;
-import org.jboss.da.scm.api.SCMType;
+import org.jboss.da.scm.api.ScmException;
 
 /**
  *
@@ -36,10 +35,7 @@ public class SCMConnectorImpl implements SCMConnector {
     @Override
     public GAVDependencyTree getDependencyTreeOfRevision(String scmUrl, String revision, GAV gav)
             throws ScmException, PomAnalysisException {
-        // git clone
-        // TODO: hardcoded to git right now
-        // TODO: enable the svn test if svn support is added
-        File tempDir = scmManager.cloneRepository(SCMType.GIT, scmUrl, revision);
+        File tempDir = scmManager.cloneRepository(scmUrl, revision);
 
         GAVDependencyTree gavDependencyTree = pomAnalyzer.readRelationships(tempDir, gav);
         return gavDependencyTree;
@@ -48,10 +44,7 @@ public GAVDependencyTree getDependencyTreeOfRevision(String scmUrl, String revis
     @Override
     public Set<GAV> getToplevelDependencyOfRevision(String scmUrl, String revision, GAV gav)
             throws ScmException, PomAnalysisException {
-        // git clone
-        // TODO: hardcoded to git right now
-        // TODO: enable the svn test if svn support is added
-        File tempDir = scmManager.cloneRepository(SCMType.GIT, scmUrl, revision);
+        File tempDir = scmManager.cloneRepository(scmUrl, revision);
 
         return pomAnalyzer.getToplevelDependency(tempDir, gav);
     }
@@ -62,10 +55,7 @@ public GAVDependencyTree getDependencyTreeOfRevision(
             String revision,
             String pomPath,
             List<String> repositories) throws ScmException, PomAnalysisException {
-        // git clone
-        // TODO: hardcoded to git right now
-        // TODO: enable the svn test if svn support is added
-        File tempDir = scmManager.cloneRepository(SCMType.GIT, scmUrl, revision);
+        File tempDir = scmManager.cloneRepository(scmUrl, revision);
 
         GAVDependencyTree gavDependencyTree = pomAnalyzer.readRelationships(tempDir, pomPath, repositories);
 
@@ -78,10 +68,7 @@ public Set<GAV> getToplevelDependencyOfRevision(
             String revision,
             String pomPath,
             List<String> repositories) throws ScmException, PomAnalysisException {
-        // git clone
-        // TODO: hardcoded to git right now
-        // TODO: enable the svn test if svn support is added
-        File tempDir = scmManager.cloneRepository(SCMType.GIT, scmUrl, revision);
+        File tempDir = scmManager.cloneRepository(scmUrl, revision);
 
         return pomAnalyzer.getToplevelDependency(tempDir, pomPath, repositories);
     }
@@ -92,27 +79,21 @@ public Optional<MavenProject> getPom(String scmUrl, String revision, String pomP
             pomPath += "/pom.xml";
         }
 
-        // git clone
-        // TODO: hardcoded to git right now
-        File tempDir = scmManager.cloneRepository(SCMType.GIT, scmUrl, revision);
+        File tempDir = scmManager.cloneRepository(scmUrl, revision);
 
         return pomAnalyzer.readPom(new File(tempDir, pomPath));
     }
 
     @Override
     public boolean isGAVInRepository(String scmUrl, String revision, GAV gav) throws ScmException {
-        // git clone
-        // TODO: hardcoded to git right now
-        File tempDir = scmManager.cloneRepository(SCMType.GIT, scmUrl, revision);
+        File tempDir = scmManager.cloneRepository(scmUrl, revision);
 
         return pomAnalyzer.getPOMFileForGAV(tempDir, gav).isPresent();
     }
 
     @Override
     public Optional<MavenProject> getPom(String scmUrl, String revision, GAV gav) throws ScmException {
-        // git clone
-        // TODO: hardcoded to git right now
-        File tempDir = scmManager.cloneRepository(SCMType.GIT, scmUrl, revision);
+        File tempDir = scmManager.cloneRepository(scmUrl, revision);
 
         return pomAnalyzer.getPOMFileForGAV(tempDir, gav).flatMap(file -> pomAnalyzer.readPom(file));
     }
@@ -123,9 +104,7 @@ public Map<GA, Set<GAV>> getDependenciesOfModules(
             String revision,
             String pomPath,
             List<String> repositories) throws ScmException, PomAnalysisException {
-        // git clone
-        // TODO: hardcoded to git right now
-        File tempDir = scmManager.cloneRepository(SCMType.GIT, scmUrl, revision);
+        File tempDir = scmManager.cloneRepository(scmUrl, revision);
 
         return pomAnalyzer.getDependenciesOfModules(tempDir, pomPath, repositories);
     }

pom.xml

@@ -91,9 +91,6 @@
     <quarkus.platform.version>3.37.0</quarkus.platform.version>
     <quarkus.wiremock>1.6.3</quarkus.wiremock>
 
-    <!-- Don't update to 2.x as it causes test failures -->
-    <mvn-scm.version>1.13.0</mvn-scm.version>
-
     <!-- OTEL Dependencies for Instrumentation -->
     <version.io.opentelemetry.instrumentation>2.27.0</version.io.opentelemetry.instrumentation>
 
@@ -330,6 +327,14 @@
             <groupId>org.commonjava.maven.galley</groupId>
             <artifactId>*</artifactId>
           </exclusion>
+          <!--
+            partyline pins vulnerable infinispan version,
+            infinispan related implementation there is not used by DA
+          -->
+          <exclusion>
+            <groupId>org.infinispan</groupId>
+            <artifactId>*</artifactId>
+          </exclusion>
         </exclusions>
       </dependency>
       <dependency>
@@ -352,28 +357,10 @@
         <scope>provided</scope>
       </dependency>
 
-      <!-- maven scm libraries -->
-      <dependency>
-        <groupId>org.apache.maven.scm</groupId>
-        <artifactId>maven-scm-api</artifactId>
-        <version>${mvn-scm.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven.scm</groupId>
-        <artifactId>maven-scm-provider-jgit</artifactId>
-        <version>${mvn-scm.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven.scm</groupId>
-        <artifactId>maven-scm-provider-svnexe</artifactId>
-        <version>${mvn-scm.version}</version>
-      </dependency>
-      <!-- maven scm libraries -->
-
       <dependency>
         <groupId>com.thetransactioncompany</groupId>
         <artifactId>jsonrpc2-base</artifactId>
-        <version>2.2</version>
+        <version>2.2.1</version>
       </dependency>
 
       <dependency>

reports-backend/src/main/java/org/jboss/da/reports/api/ReportsGenerator.java

@@ -4,7 +4,6 @@
 import java.util.Optional;
 import java.util.Set;
 
-import org.apache.maven.scm.ScmException;
 import org.jboss.da.common.CommunicationException;
 import org.jboss.da.communication.pom.PomAnalysisException;
 import org.jboss.da.reports.model.api.SCMLocator;
@@ -15,6 +14,7 @@
 import org.jboss.da.reports.model.response.LookupReport;
 import org.jboss.da.reports.model.response.NPMLookupReport;
 import org.jboss.da.reports.model.response.NPMVersionsReport;
+import org.jboss.da.scm.api.ScmException;
 
 /**
  *

reports-backend/src/main/java/org/jboss/da/reports/backend/api/DependencyTreeGenerator.java

@@ -1,10 +1,10 @@
 package org.jboss.da.reports.backend.api;
 
-import org.apache.maven.scm.ScmException;
 import org.jboss.da.communication.pom.PomAnalysisException;
 import org.jboss.da.communication.repository.model.GAVDependencyTree;
 import org.jboss.da.model.rest.GAV;
 import org.jboss.da.reports.model.api.SCMLocator;
+import org.jboss.da.scm.api.ScmException;
 
 /**
  *

reports-backend/src/main/java/org/jboss/da/reports/backend/impl/DependencyTreeGeneratorImpl.java

@@ -9,7 +9,6 @@
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
 
-import org.apache.maven.scm.ScmException;
 import org.jboss.da.communication.pom.PomAnalysisException;
 import org.jboss.da.communication.pom.model.MavenProject;
 import org.jboss.da.communication.repository.model.GAVDependencyTree;
@@ -19,6 +18,7 @@
 import org.jboss.da.reports.backend.api.DependencyTreeGenerator;
 import org.jboss.da.reports.backend.api.GAVToplevelDependencies;
 import org.jboss.da.reports.model.api.SCMLocator;
+import org.jboss.da.scm.api.ScmException;
 
 /**
  *

reports-backend/src/main/java/org/jboss/da/reports/impl/ReportsGeneratorImpl.java

@@ -27,8 +27,6 @@
 import jakarta.validation.ValidationException;
 
 import org.apache.commons.lang3.BooleanUtils;
-import org.apache.maven.scm.ScmException;
-import org.codehaus.plexus.util.StringUtils;
 import org.jboss.da.common.CommunicationException;
 import org.jboss.da.common.config.Configuration;
 import org.jboss.da.common.logging.UserLog;
@@ -69,7 +67,7 @@
 import org.jboss.da.reports.model.response.NPMLookupReport;
 import org.jboss.da.reports.model.response.NPMVersionsReport;
 import org.jboss.da.scm.api.SCM;
-import org.jboss.da.scm.api.SCMType;
+import org.jboss.da.scm.api.ScmException;
 import org.jboss.pnc.common.log.LogSanitizer;
 import org.jboss.pnc.common.version.SuffixedVersion;
 import org.jboss.pnc.common.version.VersionAnalyzer;
@@ -231,9 +229,8 @@ public Optional<AdvancedArtifactReport> getAdvancedReportFromSCM(SCMReportReques
 
         GAVDependencyTree dt = dependencyTreeGenerator.getDependencyTree(scml);
         Optional<ArtifactReport> artifactReport = createReport(dt);
-        // TODO: hardcoded to git
         // hopefully we'll get the cached cloned folder for this repo
-        File repoFolder = scmManager.cloneRepository(SCMType.GIT, scml.getScmUrl(), scml.getRevision());
+        File repoFolder = scmManager.cloneRepository(scml.getScmUrl(), scml.getRevision());
         return artifactReport.map(r -> generateAdvancedArtifactReport(r, repoFolder));
     }
 
@@ -705,7 +702,7 @@ private static List<RestProductInput> toWhitelisted(Set<ProductArtifacts> whitel
 
     private LookupMode getLookupMode(String modeName, String suffix) {
         LookupMode mode;
-        if (StringUtils.isEmpty(modeName)) {
+        if (modeName == null || modeName.isEmpty()) {
             mode = new LookupMode();
             mode.setName("ON_THE_FLY_MODE");
             mode.getBuildCategories().add(BuildCategory.STANDARD);

reports-rest/src/main/java/org/jboss/da/rest/exceptions/AllExceptionsMapper.java

@@ -14,11 +14,11 @@
 import jakarta.ws.rs.ext.ExceptionMapper;
 import jakarta.ws.rs.ext.Provider;
 
-import org.apache.maven.scm.ScmException;
 import org.jboss.da.common.CommunicationException;
 import org.jboss.da.communication.pom.PomAnalysisException;
 import org.jboss.da.communication.repository.api.RepositoryException;
 import org.jboss.da.model.rest.ErrorMessage;
+import org.jboss.da.scm.api.ScmException;
 import org.jboss.da.validation.ValidationException;
 import org.slf4j.Logger;
 

reports-rest/src/main/java/org/jboss/da/rest/facade/ReportsFacade.java

@@ -9,7 +9,6 @@
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
 
-import org.apache.maven.scm.ScmException;
 import org.jboss.da.common.CommunicationException;
 import org.jboss.da.communication.pom.PomAnalysisException;
 import org.jboss.da.reports.api.AdvancedArtifactReport;
@@ -31,6 +30,7 @@
 import org.jboss.da.reports.model.response.NPMLookupReport;
 import org.jboss.da.reports.model.response.NPMVersionsReport;
 import org.jboss.da.reports.model.response.Report;
+import org.jboss.da.scm.api.ScmException;
 import org.jboss.da.validation.Validation;
 import org.jboss.da.validation.ValidationException;
 

reports-rest/src/main/java/org/jboss/da/rest/reports/Reports.java

@@ -12,7 +12,6 @@
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.Response.Status;
 
-import org.apache.maven.scm.ScmException;
 import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.media.Content;
@@ -36,6 +35,7 @@
 import org.jboss.da.reports.model.response.NPMVersionsReport;
 import org.jboss.da.reports.model.response.Report;
 import org.jboss.da.rest.facade.ReportsFacade;
+import org.jboss.da.scm.api.ScmException;
 import org.jboss.da.validation.ValidationException;
 import org.jboss.pnc.common.log.LogSanitizer;
 import org.slf4j.Logger;

source-code-manager/pom.xml

@@ -21,18 +21,6 @@
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-api</artifactId>
     </dependency>
-    <dependency>
-      <groupId>org.apache.maven.scm</groupId>
-      <artifactId>maven-scm-api</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.maven.scm</groupId>
-      <artifactId>maven-scm-provider-jgit</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.maven.scm</groupId>
-      <artifactId>maven-scm-provider-svnexe</artifactId>
-    </dependency>
 
     <dependency>
       <groupId>io.quarkus</groupId>
@@ -53,6 +41,10 @@
       <groupId>commons-io</groupId>
       <artifactId>commons-io</artifactId>
     </dependency>
+    <dependency>
+      <groupId>io.smallrye.common</groupId>
+      <artifactId>smallrye-common-process</artifactId>
+    </dependency>
   </dependencies>
 
   <build>

source-code-manager/src/main/java/org/jboss/da/scm/api/SCM.java

@@ -4,8 +4,6 @@
 import java.time.Duration;
 import java.time.temporal.TemporalAmount;
 
-import org.apache.maven.scm.ScmException;
-
 /**
  *
  * @author Honza Brázdil <jbrazdil@redhat.com>
@@ -22,12 +20,11 @@ public interface SCM {
      * As long as it is referenced the repository will stay cloned. The repository will stay cloned for at least
      * {@link SCM#TIME_TO_KEEP} after the File object was garbage collected.
      *
-     * @param scmType
      * @param scmUrl
      * @param revision
      * @return
      * @throws ScmException
      * @see SCM#TIME_TO_KEEP
      */
-    File cloneRepository(SCMType scmType, String scmUrl, String revision) throws ScmException;
+    File cloneRepository(String scmUrl, String revision) throws ScmException;
 }

source-code-manager/src/main/java/org/jboss/da/scm/api/ScmException.java

@@ -0,0 +1,15 @@
+package org.jboss.da.scm.api;
+
+/**
+ * Thrown when an operation with an SCM repository fails.
+ */
+public class ScmException extends Exception {
+
+    public ScmException(String message) {
+        super(message);
+    }
+
+    public ScmException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}