Merge branch 'main' into bump-qodana-2025.2

Author: rob93c

.editorconfig

@@ -18,7 +18,7 @@ ij_wrap_on_typing = false
 
 [*.java]
 indent_style = tab
-ij_java_imports_layout = $*,|,*,|,javax.**,java.**,|
+ij_java_imports_layout = $*, |, *, |, javax.**, java.**, |, @*
 ij_java_names_count_to_use_import_on_demand = 999
 ij_java_class_count_to_use_import_on_demand = 999
 ij_java_align_consecutive_assignments = false
@@ -103,14 +103,6 @@ ij_java_doc_param_description_on_new_line = false
 ij_java_doc_preserve_line_breaks = false
 ij_java_doc_use_throws_not_exception_tag = true
 ij_java_else_on_new_line = false
-ij_java_entity_dd_suffix = EJB
-ij_java_entity_eb_suffix = Bean
-ij_java_entity_hi_suffix = Home
-ij_java_entity_lhi_prefix = Local
-ij_java_entity_lhi_suffix = Home
-ij_java_entity_li_prefix = Local
-ij_java_entity_pk_class = java.lang.String
-ij_java_entity_vo_suffix = VO
 ij_java_enum_constants_wrap = off
 ij_java_extends_keyword_wrap = off
 ij_java_extends_list_wrap = off
@@ -147,8 +139,6 @@ ij_java_layout_static_imports_separately = true
 ij_java_line_comment_add_space = false
 ij_java_line_comment_add_space_on_reformat = false
 ij_java_line_comment_at_first_column = true
-ij_java_message_dd_suffix = EJB
-ij_java_message_eb_suffix = Bean
 ij_java_method_annotation_wrap = split_into_lines
 ij_java_method_brace_style = end_of_line
 ij_java_method_call_chain_wrap = off
@@ -177,13 +167,6 @@ ij_java_resource_list_wrap = off
 ij_java_rparen_on_new_line_in_annotation = false
 ij_java_rparen_on_new_line_in_deconstruction_pattern = true
 ij_java_rparen_on_new_line_in_record_header = false
-ij_java_session_dd_suffix = EJB
-ij_java_session_eb_suffix = Bean
-ij_java_session_hi_suffix = Home
-ij_java_session_lhi_prefix = Local
-ij_java_session_lhi_suffix = Home
-ij_java_session_li_prefix = Local
-ij_java_session_si_suffix = Service
 ij_java_space_after_closing_angle_bracket_in_type_argument = false
 ij_java_space_after_colon = true
 ij_java_space_after_comma = true

.github/workflows/bump.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code changes
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Update dependencies
         uses: wader/bump/action@master

.github/workflows/docker-image.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code changes
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Prepare Docker
         uses: docker/setup-buildx-action@v3

.github/workflows/unit-test.yml

@@ -21,7 +21,7 @@ jobs:
         os: [ ubuntu-latest, windows-latest, macos-13 ] # pin macos to latest x64 image
     steps:
       - name: Checkout code changes
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup FFmpeg
         uses: FedericoCarboni/setup-ffmpeg@v3
@@ -61,13 +61,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code changes
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
       - name: Download coverage report
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: coverage_report
           path: .qodana/code-coverage

Dockerfile

@@ -14,14 +14,12 @@ RUN curl -L --fail --retry 3 --retry-delay 5 "$LIBWEBP_URL" -O && \
     tar -xzf "$LIBWEBP_FILE" --one-top-level=libwebp --strip-components=1 && \
     rm "$LIBWEBP_FILE"
 
-ENV GRADLE_OPTS="-Dorg.gradle.daemon=false"
-COPY settings.gradle build.gradle gradlew ./
-COPY gradle gradle
-RUN --mount=type=cache,target=/root/.gradle ./gradlew dependencies
 COPY . .
-RUN --mount=type=cache,target=/root/.gradle ./gradlew jre shadowJar
+RUN --mount=type=cache,target=/root/.gradle ./gradlew jlink shadowJar
 
-FROM alpine AS bot
+# bump: alpine /FROM alpine:([\d.]+)/ docker:alpine|^3
+# bump: alpine link "Release notes" https://alpinelinux.org/posts/Alpine-$LATEST-released.html
+FROM alpine:3.22.1 AS bot
 
 # bump: ffmpeg /static-ffmpeg:([\d.]+)/ docker:mwader/static-ffmpeg|~7.0
 COPY --from=mwader/static-ffmpeg:7.0.2 /ffmpeg /usr/local/bin/
@@ -30,7 +28,7 @@ ENV FFMPEG_PATH=/usr/local/bin/ffmpeg
 COPY --from=builder /app/libwebp/bin/cwebp /usr/local/bin/
 COPY --from=builder /app/libwebp/bin/dwebp /usr/local/bin/
 
-COPY --from=builder /app/build/jre jre
+COPY --from=builder /app/build/jlink/jre jre
 COPY --from=builder /app/build/libs/Stickerify-1.0-all.jar Stickerify.jar
 
 CMD ["jre/bin/java", "-Dcom.sksamuel.scrimage.webp.binary.dir=/usr/local/bin/", "-jar", "Stickerify.jar"]

build.gradle

@@ -1,39 +1,43 @@
-import org.apache.tools.ant.taskdefs.condition.Os
+import com.github.stickerifier.stickerify.JlinkJavaLauncher
+import com.github.stickerifier.stickerify.JlinkTask
 
 plugins {
+    id('application')
+    id('java')
+    id('jacoco')
     alias(libs.plugins.shadow)
-    id 'application'
-    id 'java'
-    id 'jacoco'
 }
 
 repositories {
     mavenCentral()
 }
 
 dependencies {
-    implementation libs.batik
-    implementation libs.gson
-    implementation libs.imageio.batik
-    implementation libs.imageio.psd
-    implementation libs.jave
-    implementation libs.logback.classic
-    implementation libs.logback.core
-    implementation libs.scrimage.core
-    implementation libs.scrimage.formats.extra
-    implementation libs.scrimage.webp
-    implementation libs.slf4j.api
-    implementation libs.telegram.bot.api
-    implementation libs.tika
-
-    testRuntimeOnly libs.junit.platform
-    testImplementation libs.hamcrest
-    testImplementation libs.junit
-    testImplementation libs.mockwebserver
+    implementation(libs.batik)
+    implementation(libs.gson)
+    implementation(libs.imageio.batik)
+    implementation(libs.imageio.psd)
+    implementation(libs.jave)
+    implementation(libs.logback.classic)
+    implementation(libs.logback.core)
+    implementation(libs.scrimage.core)
+    implementation(libs.scrimage.formats.extra)
+    implementation(libs.scrimage.webp)
+    implementation(libs.slf4j.api)
+    implementation(libs.telegram.bot.api)
+    implementation(libs.tika)
+
+    testImplementation(libs.hamcrest)
+    testImplementation(libs.junit.jupiter)
+    testImplementation(libs.mockwebserver)
+    testRuntimeOnly(libs.junit.platform)
 
     constraints {
-        implementation(libs.okio) {
-            because 'CVE-2023-3635: Okio Signed to Unsigned Conversion Error vulnerability'
+        implementation('org.apache.commons:commons-lang3') {
+            version {
+                strictly('[3.18.0, 4)')
+            }
+            because('CVE-2025-48924: Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs')
         }
     }
 }
@@ -42,67 +46,34 @@ group = 'com.github.stickerifier'
 version = '1.0'
 description = 'Telegram bot to convert medias in the format required to be used as Telegram stickers'
 
-java {
-    toolchain {
-        languageVersion = JavaLanguageVersion.of(24)
-        vendor = JvmVendorSpec.AZUL
-    }
+java.toolchain {
+    languageVersion = JavaLanguageVersion.of(24)
+    vendor = JvmVendorSpec.AZUL
 }
 
-tasks.withType(JavaCompile).configureEach {
-    options.encoding = 'UTF-8'
+updateDaemonJvm {
+    languageVersion = JavaLanguageVersion.of(24)
+    vendor = JvmVendorSpec.AZUL
 }
 
-def jreOutputDir = layout.buildDirectory.dir('jre')
-tasks.register('jre') {
-    inputs.property('options', ['--strip-debug', '--no-header-files', '--no-man-pages'])
-    inputs.property('modules', ['java.desktop', 'java.instrument', 'java.naming', 'java.sql', 'jdk.crypto.ec', 'jdk.unsupported'])
-
-    outputs.dir(jreOutputDir)
-
-    doFirst {
-        delete(jreOutputDir)
-    }
-
-    def javaLauncher = javaToolchains.launcherFor(java.toolchain)
-
-    doLast {
-        def installationPath = javaLauncher.get().metadata.installationPath
-
-        def jlink = installationPath.file(Os.isFamily(Os.FAMILY_WINDOWS) ? 'bin\\jlink.exe' : 'bin/jlink')
-        def jmods = installationPath.dir('jmods')
-
-        def output = providers.exec {
-            ignoreExitValue = true
-            commandLine = [
-                    jlink.toString(), '-v',
-                    *(inputs.properties['options'] as List),
-                    '--module-path', jmods.toString(),
-                    '--add-modules', (inputs.properties['modules'] as List).join(','),
-                    '--output', jreOutputDir.get().toString()
-            ]
-        }
+def jlink = tasks.register('jlink', JlinkTask) {
+    options = ['--strip-debug', '--no-header-files', '--no-man-pages']
+    modules = ['java.desktop', 'java.instrument', 'java.naming', 'java.sql', 'jdk.crypto.ec', 'jdk.unsupported']
 
-        def result = output.result.get()
-        if (result.exitValue == 0) {
-            logger.info(output.standardOutput.asText.get())
-        } else {
-            logger.log(LogLevel.ERROR, output.standardError.asText.get())
-        }
-
-        result.assertNormalExitValue()
-        result.rethrowFailure()
-    }
+    group = 'build'
+    description = 'Generates a minimal JRE for the project.'
 }
 
 test {
-    dependsOn tasks.named('jre')
-    inputs.dir(jreOutputDir)
-
-    executable = jreOutputDir.get().file(Os.isFamily(Os.FAMILY_WINDOWS) ? 'bin\\java.exe' : 'bin/java')
+    inputs.dir(jlink.map { it.outputDirectory.get().asFile })
+    javaLauncher = providers.provider { new JlinkJavaLauncher(jlink.get()) }
 
     useJUnitPlatform()
-    finalizedBy jacocoTestReport
+    finalizedBy(jacocoTestReport)
+
+    testLogging {
+        events "passed"
+    }
 }
 
 jacocoTestReport {
@@ -117,7 +88,7 @@ jacocoTestReport {
             fileTree(dir: it, exclude: ['**/MediaConstraints.class',
                                         '**/stickerify/exception/**',
                                         '**/stickerify/process/**',
-                                        '**/stickerify/runner**',
+                                        '**/stickerify/runner/**',
                                         '**/stickerify/telegram/**'])
         })
     }
@@ -128,9 +99,18 @@ application {
 }
 
 shadowJar {
+    duplicatesStrategy = DuplicatesStrategy.INCLUDE
     mergeServiceFiles()
-
-    dependencies {
-        exclude('dist_webp_binaries/')
-    }
+    failOnDuplicateEntries = true
+
+    exclude('dist_webp_binaries/',
+            'META-INF/LICENSE',
+            'META-INF/LICENSE.txt',
+            'META-INF/NOTICE',
+            'META-INF/NOTICE.txt',
+            'license/LICENSE',
+            'license/LICENSE.dom-documentation.txt',
+            'license/LICENSE.dom-software.txt',
+            'license/NOTICE',
+            'license/README.dom.txt')
 }

buildSrc/build.gradle

@@ -0,0 +1,12 @@
+plugins {
+    id('java-library')
+}
+
+repositories {
+    gradlePluginPortal()
+}
+
+java.toolchain {
+    languageVersion = JavaLanguageVersion.of(24)
+    vendor = JvmVendorSpec.AZUL
+}

buildSrc/src/main/java/com/github/stickerifier/stickerify/JlinkJavaLauncher.java

@@ -0,0 +1,24 @@
+package com.github.stickerifier.stickerify;
+
+import org.gradle.api.file.RegularFile;
+import org.gradle.api.provider.Provider;
+import org.gradle.jvm.toolchain.JavaCompiler;
+import org.gradle.jvm.toolchain.JavaInstallationMetadata;
+import org.gradle.jvm.toolchain.JavaLauncher;
+import org.jetbrains.annotations.NotNull;
+
+public record JlinkJavaLauncher(Provider<@NotNull JavaInstallationMetadata> metadata, Provider<@NotNull RegularFile> executablePath) implements JavaLauncher {
+	public JlinkJavaLauncher(JlinkTask task) {
+		this(task.getJavaCompiler().map(JavaCompiler::getMetadata), task.getOutputDirectory().file("jre/bin/java"));
+	}
+
+	@Override
+	public @NotNull JavaInstallationMetadata getMetadata() {
+		return metadata.get();
+	}
+
+	@Override
+	public @NotNull RegularFile getExecutablePath() {
+		return executablePath.get();
+	}
+}