From fe04acad1f152d7fac0536823f8112d890a6b78f Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <piotr.github@karwasz.org>
Date: Mon, 10 Mar 2025 15:14:08 +0100
Subject: [PATCH 1/4] Bump build requirement to JDK 17

This change:

- Bumps the build requirement for the project to JDK 17.
- Adds a `java8-tests` profile that runs tests using JRE 8. The profile activates if a Maven Toolchains configuration file is present, i.e., the user knows about Maven Toolchains. Toolchains are automatically configured by `actions/setup-java`.
- Bumps the version of Error Prone to a version compatible with JDK 17 (i.e., latest).
- Bumps the version of Maven Surefire to a version that supports the `jdkToolchain` property.
- Locks the version of the remaining plugins to the currently used versions.
---
 .mvn/jvm.config |  10 +++
 README.md       |   6 ++
 pom.xml         | 186 +++++++++++++++++++++++++++++++++++++++---------
 3 files changed, 169 insertions(+), 33 deletions(-)
 create mode 100644 .mvn/jvm.config

diff --git a/.mvn/jvm.config b/.mvn/jvm.config
new file mode 100644
index 0000000..504456f
--- /dev/null
+++ b/.mvn/jvm.config
@@ -0,0 +1,10 @@
+--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
+--add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
+--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED
+--add-exports=jdk.compiler/com.sun.tools.javac.model=ALL-UNNAMED
+--add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
+--add-exports=jdk.compiler/com.sun.tools.javac.processing=ALL-UNNAMED
+--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
+--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
+--add-opens=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED
+--add-opens=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED
diff --git a/README.md b/README.md
index 80e0169..47e00a9 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,13 @@
 
 This project implements a purl parser and class for Java.
 
+## Requirements
+
+- The library has a **runtime** requirement of JRE 8 or newer.
+- To **build** the library from source, you need JDK 17 or newer.
+
 ## Compiling
+
 ```bash
 mvn clean install
 ````
diff --git a/pom.xml b/pom.xml
index d1e6d30..e2e3aa4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -37,21 +37,39 @@
 
     <properties>
         <!-- Maven Build Properties -->
-        <maven.compiler.source>1.8</maven.compiler.source>
-        <maven.compiler.target>1.8</maven.compiler.target>
+        <maven.compiler.release>8</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <maven.javadoc.failOnError>false</maven.javadoc.failOnError>
 
+        <!-- Build requirements -->
+        <!--
+          ~ Minimum JDK version required to build the library:
+          ~ Maven plugins MUST be compatible with this version.
+          -->
+        <min.jdk.version>17</min.jdk.version>
+        <!--
+          ~ Upper bound for the JDK version in an official release:
+          ~ Builds MUST use a JDK version between `min.jdk.version` (inclusive) and `max.jdk.version` (exclusive)
+          ~ to be reproducible.
+          -->
+        <max.jdk.version>18</max.jdk.version>
+
         <!-- Maven Plugin Versions -->
+        <maven.clean.plugin.version>2.5</maven.clean.plugin.version>
         <maven.compiler.plugin.version>3.11.0</maven.compiler.plugin.version>
+        <maven.deploy.plugin.version>2.7</maven.deploy.plugin.version>
+        <maven.enforcer.plugin.version>3.4.1</maven.enforcer.plugin.version>
+        <maven.install.plugin.version>2.4</maven.install.plugin.version>
         <maven.jar.plugin.version>3.3.0</maven.jar.plugin.version>
         <maven.javadoc.plugin.version>3.6.3</maven.javadoc.plugin.version>
         <maven.release.plugin.version>3.0.1</maven.release.plugin.version>
+        <maven.resources.plugin.version>2.6</maven.resources.plugin.version>
+        <maven.site.plugin.version>3.3</maven.site.plugin.version>
         <maven.source.plugin.version>3.3.0</maven.source.plugin.version>
+        <maven.surefire.plugin.version>3.5.2</maven.surefire.plugin.version>
         <!-- Maven build plugins for quality checks -->
-        <plexus.compiler.javac.errorprone.version>2.8.5</plexus.compiler.javac.errorprone.version>
-        <error.prone.core.version>2.3.2</error.prone.core.version>
+        <error.prone.core.version>2.36.0</error.prone.core.version>
         <jacoco.maven.plugin.version>0.8.11</jacoco.maven.plugin.version>
         <spotbugs.maven.plugin.version>4.8.3.1</spotbugs.maven.plugin.version>
         <com.github.spotbugs.version>4.8.3</com.github.spotbugs.version>
@@ -116,6 +134,31 @@
     <build>
         <pluginManagement>
             <plugins>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-clean-plugin</artifactId>
+                    <version>${maven.clean.plugin.version}</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-compiler-plugin</artifactId>
+                    <version>${maven.compiler.plugin.version}</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-deploy-plugin</artifactId>
+                    <version>${maven.deploy.plugin.version}</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-enforcer-plugin</artifactId>
+                    <version>${maven.enforcer.plugin.version}</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-install-plugin</artifactId>
+                    <version>${maven.install.plugin.version}</version>
+                </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
@@ -128,33 +171,77 @@
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-compiler-plugin</artifactId>
-                    <version>${maven.compiler.plugin.version}</version>
-                    <configuration>
-                        <compilerId>javac-with-errorprone</compilerId>
-                        <forceJavacCompilerUse>true</forceJavacCompilerUse>
-                        <showDeprecation>true</showDeprecation>
-                        <compilerArgs>
-                            <arg>-Xlint</arg>
-                        </compilerArgs>
-                    </configuration>
-                    <dependencies>
-                        <dependency>
-                            <groupId>org.codehaus.plexus</groupId>
-                            <artifactId>plexus-compiler-javac-errorprone</artifactId>
-                            <version>${plexus.compiler.javac.errorprone.version}</version>
-                        </dependency>
-                        <!-- override plexus-compiler-javac-errorprone's dependency on Error Prone with the latest version -->
-                        <dependency>
-                            <groupId>com.google.errorprone</groupId>
-                            <artifactId>error_prone_core</artifactId>
-                            <version>${error.prone.core.version}</version>
-                        </dependency>
-                    </dependencies>
+                    <artifactId>maven-resources-plugin</artifactId>
+                    <version>${maven.resources.plugin.version}</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-site-plugin</artifactId>
+                    <version>${maven.site.plugin.version}</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-surefire-plugin</artifactId>
+                    <version>${maven.surefire.plugin.version}</version>
                 </plugin>
             </plugins>
         </pluginManagement>
         <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>enforce-build-environment</id>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <requireJavaVersion>
+                                    <display>true</display>
+                                    <version>[${min.jdk.version},)</version>
+                                    <message>To build this library you need JDK ${min.jdk.version} or higher.</message>
+                                </requireJavaVersion>
+                                <requirePluginVersions/>
+                            </rules>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <release>${maven.compiler.release}</release>
+                    <showDeprecation>true</showDeprecation>
+                    <compilerArgs>
+                        <arg>-Xlint:all</arg>
+                        <!-- Error Prone plugin -->
+                        <arg>-XDcompilePolicy=simple</arg>
+                        <arg>--should-stop=ifError=FLOW</arg>
+                        <arg>-Xplugin:ErrorProne</arg>
+                        <!-- No annotation processors for now -->
+                        <arg>-proc:none</arg>
+                    </compilerArgs>
+                    <!--
+                      ~ Due to the changes to annotation processor policy in JDK 23, all annotation processors
+                      ~ should be mentioned explicitly.
+                      ~ To add an annotation processor, add it to `annotationProcessors` below and remove
+                      ~ `-proc:none` above.
+                      ~
+                      ~ See: https://inside.java/2024/06/18/quality-heads-up/
+                      -->
+                    <annotationProcessors/>
+                    <annotationProcessorPaths>
+                        <path>
+                            <groupId>com.google.errorprone</groupId>
+                            <artifactId>error_prone_core</artifactId>
+                            <version>${error.prone.core.version}</version>
+                        </path>
+                    </annotationProcessorPaths>
+                </configuration>
+            </plugin>
             <plugin>
                 <groupId>com.github.spotbugs</groupId>
                 <artifactId>spotbugs-maven-plugin</artifactId>
@@ -250,6 +337,41 @@
     </build>
 
     <profiles>
+
+        <!--
+          ~ Profile to run tests using JRE 8.
+          ~
+          ~ It activates if a toolchains configuration file is present.
+          ~ See: https://maven.apache.org/guides/mini/guide-using-toolchains.html
+          -->
+        <profile>
+            <id>java8-tests</id>
+            <activation>
+                <file>
+                    <exists>${user.home}/.m2/toolchains.xml</exists>
+                </file>
+            </activation>
+
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <id>default-test</id>
+                                <configuration>
+                                    <jdkToolchain>
+                                        <version>[1.8,9)</version>
+                                    </jdkToolchain>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+
         <profile>
             <id>release</id>
             <activation>
@@ -260,17 +382,15 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-enforcer-plugin</artifactId>
-                        <version>3.4.1</version>
                         <executions>
                             <execution>
-                                <id>enforce-java</id>
-                                <goals>
-                                    <goal>enforce</goal>
-                                </goals>
+                                <id>enforce-build-environment</id>
                                 <configuration>
                                     <rules>
                                         <requireJavaVersion>
-                                            <version>1.8.0</version>
+                                            <display>true</display>
+                                            <version>[${min.jdk.version},${max.jdk.version})</version>
+                                            <message>To release this library you need JDK ${min.jdk.version}.</message>
                                         </requireJavaVersion>
                                     </rules>
                                 </configuration>

From 5dd8b8fcdc11ec5e1a2fe179a94aef9eec20f061 Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <piotr.github@karwasz.org>
Date: Tue, 11 Mar 2025 11:02:01 +0100
Subject: [PATCH 2/4] Update JDKs used by CI

---
 .github/workflows/maven.yml | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index a4f8f2a..839ae75 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -2,21 +2,36 @@ name: Maven CI
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   build:
     strategy:
       matrix:
         os: [ ubuntu-latest ]
-        java-version: [ 8 ]
+        java-version: [ 17 ]
         distro: [ 'zulu', 'temurin' ]
     runs-on: ${{ matrix.os }}
 
     steps:
-    - uses: actions/checkout@v4.1.1
-    - name: Set up JDK ${{ matrix.java-version }}
+
+    - name: Checkout repository
+      uses: actions/checkout@v4.1.1
+
+    - name: Set up JDK 8 and ${{ matrix.java-version }}
       uses: actions/setup-java@v4
       with:
         distribution: ${{ matrix.distro }}
-        java-version: ${{ matrix.java-version }}
+        # We install two JDKs:
+        # * The first one is used by tests through Maven Toolchains.
+        # * The second one is used by Maven itself to perform the build.
+        #
+        # WARNING: The order matters.
+        #          The last version specified will be assigned to JAVA_HOME.
+        java-version: |
+          8
+          ${{ matrix.java-version }}
+
     - name: Build with Maven
-      run: mvn package --file pom.xml
+      shell: bash
+      run: mvn verify

From 91d8d047e954bb7111d77007016ad4a5ef48e36c Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <piotr.github@karwasz.org>
Date: Tue, 11 Mar 2025 11:22:48 +0100
Subject: [PATCH 3/4] Add `.java-version` file

---
 .java-version | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .java-version

diff --git a/.java-version b/.java-version
new file mode 100644
index 0000000..8e2afd3
--- /dev/null
+++ b/.java-version
@@ -0,0 +1 @@
+17
\ No newline at end of file

From da461439c37e610491c418117155a832af6bfc74 Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <piotr.github@karwasz.org>
Date: Tue, 11 Mar 2025 15:26:58 +0100
Subject: [PATCH 4/4] Add EOL

---
 .java-version | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.java-version b/.java-version
index 8e2afd3..98d9bcb 100644
--- a/.java-version
+++ b/.java-version
@@ -1 +1 @@
-17
\ No newline at end of file
+17