Allow builds with java 25 or java 11

Author: svanteschubert

pom.xml

@@ -39,10 +39,14 @@
     </developers>
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <version.jacoco>0.8.5</version.jacoco>
-        <version.lombok>1.18.12</version.lombok>
+        <!-- JaCoCo 0.8.14+ required for Java 25 (class file major version 69); 0.8.5 fails with IllegalClassFormatException when instrumenting JDK classes -->
+        <version.jacoco>0.8.14</version.jacoco>
+        <!-- Lombok 1.18.40+ adds official JDK 25 support; older versions do not run the annotation processor on Java 25 -->
+        <version.lombok>1.18.40</version.lombok>
         <version.saxon-he>9.9.1-7</version.saxon-he>
         <version.slf4j>1.7.25</version.slf4j>
+        <!-- Set to true to skip formatter:validate (e.g. -DskipFormatterValidation=true) when formatting is not yet applied or in CI -->
+        <skipFormatterValidation>false</skipFormatterValidation>
     </properties>
     <repositories>
         <repository>
@@ -89,10 +93,11 @@
             <optional>true</optional>
         </dependency>
 
+        <!-- 3.18.0+ fixes CVE-2025-48924 (uncontrolled recursion in ClassUtils.getClass on long inputs); 3.10 had no remediation in older scanners -->
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.10</version>
+            <version>3.18.0</version>
         </dependency>
         <dependency>
             <groupId>org.glassfish.jaxb</groupId>
@@ -112,10 +117,11 @@
             <version>4.13</version>
             <scope>test</scope>
         </dependency>
+        <!-- 2.17.0+ fixes CVE-2024-47554 (XML DoS in XmlStreamReader) and directory traversal in FileNameUtils.normalize; 2.6 was vulnerable -->
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
-            <version>2.6</version>
+            <version>2.17.0</version>
         </dependency>
         <dependency>
             <groupId>io.rest-assured</groupId>
@@ -199,6 +205,14 @@
                     <source>1.8</source>
                     <target>1.8</target>
                     <encoding>UTF-8</encoding>
+                    <!-- Explicit processor path ensures Lombok runs on JDK 25; without it the compiler may not invoke the processor and getters/setters/log are missing -->
+                    <annotationProcessorPaths>
+                        <path>
+                            <groupId>org.projectlombok</groupId>
+                            <artifactId>lombok</artifactId>
+                            <version>${version.lombok}</version>
+                        </path>
+                    </annotationProcessorPaths>
                 </configuration>
             </plugin>
 
@@ -292,11 +306,24 @@
                 </executions>
             </plugin>
 
-            <!-- Generate model classes -->
+            <!-- Generate model classes from XSD. Plugin default pulls JAXB 2.3.0 which uses sun.misc.Unsafe.defineClass, removed in Java 21+; overrides below fix generate goal on modern JDKs -->
             <plugin>
                 <groupId>org.jvnet.jaxb2.maven2</groupId>
                 <artifactId>maven-jaxb2-plugin</artifactId>
                 <version>0.14.0</version>
+                <dependencies>
+                    <!-- Override plugin classpath: JAXB 2.3.9 / 2.3.0.1 work on Java 17–25; without this, generate fails with NoSuchMethodException: sun.misc.Unsafe.defineClass -->
+                    <dependency>
+                        <groupId>org.glassfish.jaxb</groupId>
+                        <artifactId>jaxb-runtime</artifactId>
+                        <version>2.3.9</version>
+                    </dependency>
+                    <dependency>
+                        <groupId>org.glassfish.jaxb</groupId>
+                        <artifactId>jaxb-core</artifactId>
+                        <version>2.3.0.1</version>
+                    </dependency>
+                </dependencies>
                 <executions>
                     <execution>
                         <goals>
@@ -322,7 +349,7 @@
                 </configuration>
             </plugin>
 
-            <!-- Integrate code coverage -->
+            <!-- Code coverage. Version must be 0.8.14+ on Java 25 (see version.jacoco property comment). -->
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
@@ -515,6 +542,10 @@
                         <goals>
                             <goal>validate</goal>
                         </goals>
+                        <configuration>
+                            <!-- Skip when skipFormatterValidation=true (see property); avoids build failure if sources are not yet formatted -->
+                            <skip>${skipFormatterValidation}</skip>
+                        </configuration>
                     </execution>
                 </executions>
                 <configuration>

src/main/java/de/kosit/validationtool/impl/input/SourceInput.java

@@ -94,7 +94,12 @@ private boolean isConsumed() throws IOException {
                 return (ss.getInputStream() != null && ss.getInputStream().available() == 0)
                         || (ss.getReader() != null && !ss.getReader().ready());
             } catch (final IOException e) {
-                log.error("Error checking consumed state", e);
+                // Stream/reader closed is an expected outcome when consumed; avoid ERROR log
+                if (e.getMessage() == null || !e.getMessage().toLowerCase().contains("closed")) {
+                    log.error("Error checking consumed state", e);
+                } else {
+                    log.debug("Stream/reader closed when checking consumed state", e);
+                }
                 return true;
             }
         }