build: use maven jdk toolchains to build with Java 25; test against Java 11/17/21/25

[chadlwilson]

Description of Change

As discussed in #8275 (comment) this change switches Dependency Check to

• run Maven and compile using the same "default" JVM (upgraded to Java 11 --> 25)
• -release target is still Java 11 (as before), ensuring compile time and bootclasspath compatibility.
• run all unit, integration and maven release tests against all of Java 11/17/21/25 to ensure runtime compatibility

This should allow us to

• update build-time plugins to later versions while maintaining confidence on a target Java version
• better support/replicate issues on newer Java versions rather than only running with the minimum

Additional detail

In order to do this and ensure it is as safe as possible this change as a side effect:

Dev Experience

• everything will work as before when running from CLI or IDE - for convenience, tests and compile will run with the same JVM as Maven
• Maven is not enforcing running/compiling with a fixed JDK right now; only GitHub Actions controls that
• running tests with specific JDK versions via Maven toolchains requires opt-in with -Dtoolchain.jdk.test.version (and -Dtoolchain.jdk.test.home for maven integration tests, unfortunately) which activates a Maven profile
• fixes warnings from both Mockito and ODC's own code when running tests on newer JVM versions

GitHub Actions

• runs tests in a matrix in parallel
  • for simplicity, each run compiles the code itself rather than consuming artifacts. This could be changed.
  • only the "default" JDK version archives its compiled results/deploys snapshot
• switches to using setup-java to manage primary maven cache rather than doing manually
• further aligns build jobs between PR/main/release

Dependencies

• consolidates nullness annotations on org.jspecify:jspecify similar to other projects (rather than jetbrains annotations)
• upgrades ancient org.json library to supported variant rather than stale google android fork
• cleans up exclusions and dependency clashes for transitives that we don't need
  • removes unused mockserver dependency
  • correctly removes transitive bouncycastle dependency from packager-rpm as originally intended
  • removes compile-only dependencies from guava
  • maven plugin project
    • fixes mockito version clashes on maven project from the resolver BOM
    • aligns junit version being used
    • upgrades test groovy dependency to current
    • upgrades one test dependency to ensure it works on modern JVMs

Related issues

N/A

Have test cases been added to cover the new functionality?

yes

• validated that all surefire/failsafe tests are running with the chosen JVM
• validated that the maven plugin tests are running with the configured JVM
• validated builds aren't taking significantly longer to run
• validated the GitHub workflow runs ok on main (see this run)
• diffed the ant and cli build archives to ensure any differences in dependencies are expected
• sanity checked maven site generation
• sanity checked with the gradle plugin and its tests

[Copilot]

Pull request overview

Updates Dependency-Check’s build and CI configuration to run Maven/compilation on a newer default JDK while expanding test coverage across multiple JDK versions, alongside related dependency and annotation cleanups.

Changes:

• Switches CI workflows to build/test in a JDK matrix (11/17/21/25) and updates caching/setup-java usage.
• Migrates nullness annotations from JetBrains to JSpecify and aligns VisibleForTesting usage to Guava.
• Updates/cleans build dependencies and Maven configuration (plugins, exclusions, test setup, toolchains profile).

Reviewed changes

Copilot reviewed 42 out of 42 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
utils/src/test/java/org/owasp/dependencycheck/utils/XmlUtilsTest.java	Swap JetBrains nullness annotation to JSpecify in tests.
utils/src/main/java/org/owasp/dependencycheck/utils/XmlUtils.java	Replace JetBrains annotations with JSpecify + Guava VisibleForTesting.
utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java	Migrate nullness annotations to JSpecify across settings APIs.
utils/src/main/java/org/owasp/dependencycheck/utils/FileUtils.java	Replace nullness annotations with JSpecify and adjust method annotations.
utils/src/main/java/org/owasp/dependencycheck/utils/Downloader.java	Replace nullness annotations with JSpecify on downloader APIs.
utils/pom.xml	Remove unused test deps/profile and add Guava for new annotation usage.
test-docker.sh	Use exec:exec goal (plugin version controlled in parent) to read project version.
shell-docker.sh	Use exec:exec goal (plugin version controlled in parent) to read project version.
publish-docker.sh	Use exec:exec goal (plugin version controlled in parent) to read project version.
build-docker.sh	Use exec:exec goal (plugin version controlled in parent) to read project version.
pom.xml	Central build changes: plugin/dependency alignment, toolchains profile, CI/test JVM args, and dependency updates.
maven/src/it/690-threadsafety/first/pom.xml	Bump Spring Boot patch version used in IT fixture.
maven/src/it/690-threadsafety/first-a/pom.xml	Bump Spring Boot patch version used in IT fixture.
maven/src/it/1751-use-child-repositories/postbuild.groovy	Update Groovy XmlSlurper import for newer Groovy.
maven/pom.xml	Simplify dependency management and configure invoker ITs to use configured Java home.
core/src/main/java/org/owasp/dependencycheck/xml/XmlInputStream.java	Replace JetBrains @NotNull with JSpecify @NonNull.
core/src/main/java/org/owasp/dependencycheck/utils/Filter.java	Remove unused JetBrains annotation import.
core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java	Replace JetBrains annotations with JSpecify on public methods.
core/src/main/java/org/owasp/dependencycheck/dependency/naming/PurlIdentifier.java	Replace JetBrains @NotNull with JSpecify @NonNull.
core/src/main/java/org/owasp/dependencycheck/dependency/naming/GenericIdentifier.java	Replace JetBrains @NotNull with JSpecify @NonNull.
core/src/main/java/org/owasp/dependencycheck/dependency/naming/CpeIdentifier.java	Replace JetBrains @NotNull with JSpecify @NonNull.
core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java	Replace JetBrains @NotNull with JSpecify @NonNull.
core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java	Replace JetBrains @NotNull with JSpecify @NonNull and adjust javadoc reference.
core/src/main/java/org/owasp/dependencycheck/dependency/Reference.java	Replace JetBrains @NotNull with JSpecify @NonNull.
core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java	Replace JetBrains @NotNull with JSpecify @NonNull.
core/src/main/java/org/owasp/dependencycheck/data/update/NvdApiDataSource.java	Replace JetBrains @NotNull with JSpecify @NonNull in helper methods.
core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NodeAuditSearch.java	Remove explicit JSONException catch/import after JSON library adjustment.
core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusV3Search.java	Replace JetBrains @Nullable with JSpecify @Nullable.
core/src/main/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzer.java	Adjust JSON parsing of advisory ID field to tolerate non-string types.
core/src/main/java/org/owasp/dependencycheck/analyzer/PnpmAuditAnalyzer.java	Replace JetBrains @NotNull with JSpecify @NonNull.
core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java	Replace JetBrains VisibleForTesting with Guava equivalent.
core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java	Replace JetBrains nullness annotations with JSpecify.
core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java	Replace JetBrains nullness annotation with JSpecify and clean imports.
core/src/main/java/org/owasp/dependencycheck/Engine.java	Replace JetBrains nullness annotations with JSpecify across engine APIs.
core/pom.xml	Adjust test-jar configuration and update JSON dependency usage; add JCL-over-SLF4J.
cli/pom.xml	Reuse centralized runtime JVM args and clean dependency exclusions.
ant/pom.xml	Align core test-jar dependency reference to tests classifier.
archetype/src/main/resources/archetype-resources/pom.xml	Use ${junit.version} property instead of hardcoded JUnit versions.
.github/workflows/release.yml	Run release build with default JDK 25 and modernize caching/setup-java usage.
.github/workflows/purge-cache.yml	Update cache steps and add setup-java (now expects default JDK env var).
.github/workflows/pull_requests.yml	Split into matrix jobs and run unit/integration tests against 11/17/21/25.
.github/workflows/build.yml	Run main-branch snapshot build in a JDK test matrix with updated caching/setup-java.

Comments suppressed due to low confidence (1)

pom.xml:936

• In <reporting>, versions-maven-plugin no longer specifies an explicit <version>. Maven does not consistently apply build/pluginManagement to reporting plugins, so this can lead to the site using whatever version comes from the super POM (hurting reproducibility and possibly breaking on newer JDKs). Recommend setting <version>${versions-maven-plugin.version}</version> in the reporting plugin entry as well.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 42 out of 42 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 42 out of 42 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

maven/src/it/1751-use-child-repositories/postbuild.groovy:23

• This script now imports groovy.xml.XmlSlurper. Ensure the Maven Invoker Plugin has the corresponding Groovy XML module on its classpath (often org.apache.groovy:groovy-xml), otherwise this IT can fail at execution time with a missing-class error.

import groovy.xml.XmlSlurper

String report = new File(basedir, "target/dependency-check-report.xml").text;

def analysis = new XmlSlurper().parseText(report);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chadlwilson]

Sorry for the noise here. Despite running it a few times on my fork, copilot found new things here for some reason, which I addressed. 😅

I am done for now, pending feedback 🙏