pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>ai.spice</groupId>
    <artifactId>spiceai</artifactId>
    <packaging>jar</packaging>
    <version>0.8.1</version>
    <name>Java Spice SDK</name>
    <url>https://github.com/spiceai/spice-java/</url>
    <description>Spice provides a unified SQL query interface and portable runtime to locally materialize, accelerate, and query datasets from any database, data warehouse, or data lake.</description>
    <licenses>
        <license>
            <name>Apache License, Version 2.0</name>
            <url>http://www.apache.org/licenses/LICENSE-2.0</url>
        </license>
    </licenses>
    <scm>
        <url>https://github.com/spiceai/spice-java.git</url>
        <connection>https://github.com/spiceai/spice-java.git</connection>
        <developerConnection>https://github.com/spiceai/spice-java.git</developerConnection>
    </scm>
    <developers>
        <developer>
            <id>spiceai</id>
            <name>Spice AI</name>
            <email>hey@spice.ai</email>
            <organization>Spice AI, Inc.</organization>
            <organizationUrl>https://www.spice.ai</organizationUrl>
        </developer>
    </developers>
    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
        <!-- Netty 4.1.x line: grpc-netty 1.79.0 is built and tested against Netty 4.1.
             Do NOT bump to the 4.2.x line (netty-all 4.2 previously forced an unsupported
             gRPC/Netty combination onto the classpath). -->
        <netty.version>4.1.137.Final</netty.version>
        <grpc.version>1.79.0</grpc.version>
        <!-- Placeholder for JDK-version-specific JVM flags (e.g. sun.misc.Unsafe access).
             Set via -DextraArgLine="..." on the Maven command line. -->
        <extraArgLine></extraArgLine>
        <!-- Default for surefire's @{argLine}: normally set by JaCoCo's
             prepare-agent; this empty default keeps test runs working when
             JaCoCo is skipped (-Djacoco.skip=true, e.g. benchmarks). -->
        <argLine></argLine>
        <!-- The last published release, which the japicmp API-compatibility
             gate compares against. Bump when releasing; the publish workflow
             fails if this still equals the version being released. -->
        <japicmp.oldVersion>0.8.0</japicmp.oldVersion>
    </properties>
    <dependencyManagement>
        <dependencies>
            <!-- Align every Netty module on a single CVE-patched 4.1.x version supported
                 by gRPC, without pulling the entire netty-all aggregate onto the classpath. -->
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-bom</artifactId>
                <version>${netty.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- Keep all io.grpc modules converged on the version the SDK is tested with. -->
            <dependency>
                <groupId>io.grpc</groupId>
                <artifactId>grpc-bom</artifactId>
                <version>${grpc.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.apache.arrow</groupId>
            <artifactId>flight-sql</artifactId>
            <version>19.0.0</version>
            <exclusions>
                <!-- flight-core 19 inherits Arrow 19's netty-bom 4.2.9.Final for
                     handler/buffer/transport (and handler 4.2 pulls codec-base).
                     Maven does not apply this SDK's dependencyManagement BOM to
                     consumers, so those 4.2 modules would otherwise sit next to
                     4.1.x from netty-transport-native-epoll and crash TLS with
                     NoClassDefFoundError: io.netty.util.LeakPresenceDetector.
                     Re-added below at ${netty.version} as direct dependencies. -->
                <exclusion>
                    <groupId>io.netty</groupId>
                    <artifactId>netty-handler</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>io.netty</groupId>
                    <artifactId>netty-buffer</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>io.netty</groupId>
                    <artifactId>netty-transport</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>io.netty</groupId>
                    <artifactId>netty-codec-base</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>com.google.code.gson</groupId>
            <artifactId>gson</artifactId>
            <version>2.13.2</version>
        </dependency>
        <dependency>
            <groupId>com.github.rholder</groupId>
            <artifactId>guava-retrying</artifactId>
            <version>2.0.0</version>
        </dependency>
        <!-- PEM certificate/key parsing for mTLS (previously an undeclared
             transitive dependency via the removed ADBC driver). -->
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk18on</artifactId>
            <version>1.85</version>
        </dependency>
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcpkix-jdk18on</artifactId>
            <version>1.84</version>
        </dependency>
        <!-- Pin the Netty modules the Flight/gRPC stack needs as *direct*
             dependencies. flight-core 19 declares handler/buffer/transport
             (resolved via Arrow's netty-bom 4.2.9.Final); grpc-netty 1.79.0
             declares codec-http2/handler-proxy at 4.1.130.Final. Direct pins
             at ${netty.version} are published in this POM and win Maven
             nearest-wins mediation for consumers, who do not inherit our
             netty-bom import. Stay on 4.1.x: grpc-netty 1.79 is built against
             4.1, and Arrow Flight 19 works on that line (the modules it
             actually uses are the 4.1-compatible buffer/handler/transport
             APIs). Do NOT move these to 4.2. -->
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-common</artifactId>
            <version>${netty.version}</version>
        </dependency>
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-buffer</artifactId>
            <version>${netty.version}</version>
        </dependency>
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-transport</artifactId>
            <version>${netty.version}</version>
        </dependency>
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-handler</artifactId>
            <version>${netty.version}</version>
        </dependency>
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-codec</artifactId>
            <version>${netty.version}</version>
        </dependency>
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-codec-http</artifactId>
            <version>${netty.version}</version>
        </dependency>
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-codec-http2</artifactId>
            <version>${netty.version}</version>
        </dependency>
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-handler-proxy</artifactId>
            <version>${netty.version}</version>
        </dependency>
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-transport-native-unix-common</artifactId>
            <version>${netty.version}</version>
        </dependency>
        <!-- Native epoll transport for Linux: lets gRPC/Netty use epoll instead of NIO
             for lower-latency, lower-allocation socket I/O on Linux servers. -->
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-transport-native-epoll</artifactId>
            <version>${netty.version}</version>
            <classifier>linux-x86_64</classifier>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-transport-native-epoll</artifactId>
            <version>${netty.version}</version>
            <classifier>linux-aarch_64</classifier>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>2.0.17</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-simple</artifactId>
            <version>2.0.17</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.13.2</version>
            <scope>test</scope>
        </dependency>
        <!-- HikariCP interop verification: users who need JDBC pooling connect to
             Spice through the Arrow Flight SQL JDBC driver; these tests prove the
             combination works against the same Netty/gRPC stack this SDK ships. -->
        <dependency>
            <groupId>com.zaxxer</groupId>
            <artifactId>HikariCP</artifactId>
            <version>5.1.0</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.arrow</groupId>
            <artifactId>flight-sql-jdbc-core</artifactId>
            <version>19.0.0</version>
            <scope>test</scope>
        </dependency>
    </dependencies>
    <build>
        <plugins>
            <!-- https://arrow.apache.org/docs/java/install.html#java-compatibility -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.5.5</version>
                <configuration>
                    <!-- @{argLine} is set by JaCoCo's prepare-agent goal.
                         Arrow memory + Netty require reflective access to internal JDK APIs:
                         java.nio: Arrow memory-core (DirectByteBuffer access)
                         jdk.internal.misc: Netty PlatformDependent (Unsafe for off-heap buffers)
                         ${extraArgLine} is set by CI for JDK 23+ (sun.misc.Unsafe access flag). -->
                    <argLine>@{argLine} --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens=java.base/jdk.internal.misc=ALL-UNNAMED ${extraArgLine}</argLine>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <version>3.4.0</version>
                <executions>
                    <execution>
                        <id>attach-sources</id>
                        <goals>
                            <goal>jar-no-fork</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>3.12.0</version>
                <executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-gpg-plugin</artifactId>
                <version>3.2.8</version>
                <executions>
                    <execution>
                        <id>sign-artifacts</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>sign</goal>
                        </goals>
                        <configuration>
                            <keyname>${env.GPG_KEYNAME}</keyname>
                            <passphrase>${env.GPG_PASSPHRASE}</passphrase>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <!-- learn more about Publishing By Using the Maven Plugin at https://central.sonatype.org/publish/publish-portal-maven/ -->
            <plugin>
                <groupId>org.sonatype.central</groupId>
                <artifactId>central-publishing-maven-plugin</artifactId>
                <version>0.12.0</version>
                <extensions>true</extensions>
                <configuration>
                    <publishingServerId>central</publishingServerId>
                    <!-- <autoPublish>true</autoPublish>
                    <waitUntil>published</waitUntil> -->
                </configuration>
            </plugin>
            <!-- P0: Static bug detection — null derefs, concurrency, resource leaks -->
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>4.9.8.2</version>
                <configuration>
                    <excludeFilterFile>spotbugs-exclude.xml</excludeFilterFile>
                </configuration>
            </plugin>
            <!-- P0: CVE scanning for transitive dependencies (Netty, gRPC, Arrow) -->
            <plugin>
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <version>12.2.0</version>
                <configuration>
                    <failBuildOnCVSS>7</failBuildOnCVSS>
                    <suppressionFile>owasp-suppressions.xml</suppressionFile>
                    <!-- Don't fail the build when the NVD API is unavailable (429, timeouts).
                         The scan will proceed with cached/local data instead. -->
                    <failOnError>false</failOnError>
                    <!-- With a warm cache (persisted in CI), skip the slow NVD
                         refresh entirely for a day instead of re-syncing every run. -->
                    <nvdValidForHours>24</nvdValidForHours>
                </configuration>
            </plugin>
            <!-- P0: API compatibility gate — fail the build on any binary- or
                 source-incompatible change to the public API vs the last release.
                 Bump oldVersion as part of each release. -->
            <plugin>
                <groupId>com.github.siom79.japicmp</groupId>
                <artifactId>japicmp-maven-plugin</artifactId>
                <version>0.23.1</version>
                <configuration>
                    <oldVersion>
                        <dependency>
                            <groupId>ai.spice</groupId>
                            <artifactId>spiceai</artifactId>
                            <version>${japicmp.oldVersion}</version>
                        </dependency>
                    </oldVersion>
                    <parameter>
                        <onlyModified>true</onlyModified>
                        <breakBuildOnBinaryIncompatibleModifications>true</breakBuildOnBinaryIncompatibleModifications>
                        <breakBuildOnSourceIncompatibleModifications>true</breakBuildOnSourceIncompatibleModifications>
                        <!-- Examples ship in the jar but are not a compatibility surface. -->
                        <excludes>
                            <exclude>ai.spice.example</exclude>
                        </excludes>
                        <!-- v0.6.0 internals referenced ADBC, which 0.7.0 removed
                             from the classpath; those types were never public API. -->
                        <ignoreMissingClassesByRegularExpressions>
                            <ignoreMissingClassesByRegularExpression>org\.apache\.arrow\.adbc\..*</ignoreMissingClassesByRegularExpression>
                        </ignoreMissingClassesByRegularExpressions>
                    </parameter>
                </configuration>
            </plugin>
            <!-- P1: Test coverage reporting -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>0.8.14</version>
                <executions>
                    <execution>
                        <id>prepare-agent</id>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>test</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <!-- P2: Build hygiene — enforce Maven/JDK versions, dependency convergence -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.6.2</version>
                <executions>
                    <execution>
                        <id>enforce</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requireMavenVersion>
                                    <version>[3.6.0,)</version>
                                </requireMavenVersion>
                                <requireJavaVersion>
                                    <version>[11,)</version>
                                </requireJavaVersion>
                                <banDuplicatePomDependencyVersions/>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <!-- P3: Code style consistency (Google Java Style) -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>3.6.0</version>
                <configuration>
                    <configLocation>google_checks.xml</configLocation>
                    <consoleOutput>true</consoleOutput>
                    <violationSeverity>warning</violationSeverity>
                    <failOnViolation>false</failOnViolation>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>