From 9060d4ba1832f9248d6a0887e7cd5b6eb0c1a3e7 Mon Sep 17 00:00:00 2001
From: svanteschubert <svante.schubert@gmail.com>
Date: Tue, 17 Feb 2026 17:55:41 +0100
Subject: [PATCH] Allow builds with java 25 or java 11

---
 pom.xml                                       | 23 ++++++++++++++++---
 .../impl/input/SourceInput.java               |  7 +++++-
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index 8a3e450..71cefe3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -41,7 +41,8 @@
         <version.assertj>3.27.7</version.assertj>
         <version.commons-io>2.21.0</version.commons-io>
         <version.commons-lang>3.20.0</version.commons-lang>
-        <version.jacoco>0.8.13</version.jacoco>
+        <!-- JaCoCo 0.8.14+ required for Java 25 (class file major version 69) -->
+        <version.jacoco>0.8.14</version.jacoco>
         <version.jaxb-api>4.0.4</version.jaxb-api>
         <version.jaxb-impl>4.0.6</version.jaxb-impl>
         <version.lombok>1.18.42</version.lombok>
@@ -52,6 +53,8 @@
         <version.saxon-he>12.9</version.saxon-he>
         <version.slf4j>2.0.17</version.slf4j>
         <version.jaxb-maven-plugin>4.0.11</version.jaxb-maven-plugin>
+        <!-- Set to true to skip formatter:validate (e.g. -DskipFormatterValidation=true) when formatting is not yet applied or in CI -->
+        <skipFormatterValidation>false</skipFormatterValidation>
     </properties>
 
     <repositories>
@@ -110,6 +113,7 @@
             <optional>true</optional>
         </dependency>
 
+        <!-- 3.18.0+ fixes CVE-2025-48924 (uncontrolled recursion in ClassUtils.getClass on long inputs); 3.10 had no remediation in older scanners -->
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
@@ -138,6 +142,7 @@
             <version>4.13.2</version>
             <scope>test</scope>
         </dependency>
+        <!-- 2.17.0+ fixes CVE-2024-47554 (XML DoS in XmlStreamReader) and directory traversal in FileNameUtils.normalize; 2.6 was vulnerable -->
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
@@ -296,6 +301,14 @@
                          See: https://inside.java/2024/06/18/quality-heads-up/ 
                     -->
                     <proc>full</proc>
+                    <!-- Explicit processor path ensures Lombok runs on JDK 25; without it the compiler may not invoke the processor and getters/setters/log are missing -->
+                    <annotationProcessorPaths>
+                        <path>
+                            <groupId>org.projectlombok</groupId>
+                            <artifactId>lombok</artifactId>
+                            <version>${version.lombok}</version>
+                        </path>
+                    </annotationProcessorPaths>
                 </configuration>
             </plugin>
 
@@ -383,7 +396,7 @@
                 </executions>
             </plugin>
 
-            <!-- Generate model classes -->
+            <!-- Generate model classes from XSD. Plugin default pulls JAXB 2.3.0 which uses sun.misc.Unsafe.defineClass, removed in Java 21+; overrides below fix generate goal on modern JDKs -->
             <plugin>
                 <groupId>org.jvnet.jaxb</groupId>
                 <artifactId>jaxb-maven-plugin</artifactId>
@@ -413,7 +426,7 @@
                 </configuration>
             </plugin>
 
-            <!-- Integrate code coverage -->
+            <!-- Code coverage. Version must be 0.8.14+ on Java 25 (see version.jacoco property comment). -->
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
@@ -618,6 +631,10 @@
                         <goals>
                             <goal>validate</goal>
                         </goals>
+                        <configuration>
+                            <!-- Skip when skipFormatterValidation=true (see property); avoids build failure if sources are not yet formatted -->
+                            <skip>${skipFormatterValidation}</skip>
+                        </configuration>
                     </execution>
                 </executions>
                 <configuration>
diff --git a/src/main/java/de/kosit/validationtool/impl/input/SourceInput.java b/src/main/java/de/kosit/validationtool/impl/input/SourceInput.java
index 60c926e..aed8cc5 100644
--- a/src/main/java/de/kosit/validationtool/impl/input/SourceInput.java
+++ b/src/main/java/de/kosit/validationtool/impl/input/SourceInput.java
@@ -110,7 +110,12 @@ public class SourceInput extends AbstractInput {
                 return (ss.getInputStream() != null && ss.getInputStream().available() == 0)
                         || (ss.getReader() != null && !ss.getReader().ready());
             } catch (final IOException e) {
-                log.error("Error checking consumed state", e);
+                // Stream/reader closed is an expected outcome when consumed; avoid ERROR log
+                if (e.getMessage() == null || !e.getMessage().toLowerCase().contains("closed")) {
+                    log.error("Error checking consumed state", e);
+                } else {
+                    log.debug("Stream/reader closed when checking consumed state", e);
+                }
                 return true;
             }
         }