diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..59b311c3 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,15 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates + +version: 2 +updates: + - package-ecosystem: "maven" + directory: "/dependabot" + schedule: + interval: "weekly" + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4665c66a..b431bb93 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -42,6 +42,10 @@ jobs: uses: DeLaGuardo/setup-clojure@master with: lein: latest + - name: Setup Babashka + run: bash < <(curl -s https://raw.githubusercontent.com/babashka/babashka/master/install) + - name: Check dependabot is in sync with project.clj + run: ./scripts/check-dependabot - name: Run tests run: lein do clean, all test, all check deploy: diff --git a/.gitignore b/.gitignore index ebba8050..92b16451 100644 --- a/.gitignore +++ b/.gitignore @@ -1,8 +1,8 @@ /target /classes /checkouts -pom.xml -pom.xml.asc +/pom.xml +/pom.xml.asc *.jar *.class /.lein-* diff --git a/dependabot/dependency-tree.txt b/dependabot/dependency-tree.txt new file mode 100644 index 00000000..9841c91a --- /dev/null +++ b/dependabot/dependency-tree.txt @@ -0,0 +1,60 @@ +metosin:compojure-api:jar:2.0.0-alpha34-SNAPSHOT ++- prismatic:schema:jar:1.1.12:compile ++- prismatic:plumbing:jar:0.5.5:compile +| \- de.kotka:lazymap:jar:3.1.0:compile ++- ikitommi:linked:jar:1.3.1-alpha1:compile ++- metosin:muuntaja:jar:0.6.6:compile +| +- metosin:jsonista:jar:0.2.5:compile +| | \- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.10.0:compile +| \- com.cognitect:transit-clj:jar:0.8.319:compile +| \- com.cognitect:transit-java:jar:0.8.337:compile +| +- org.msgpack:msgpack:jar:0.6.12:compile +| | +- com.googlecode.json-simple:json-simple:jar:1.1.1:compile +| | \- org.javassist:javassist:jar:3.18.1-GA:compile +| \- javax.xml.bind:jaxb-api:jar:2.3.0:compile ++- com.fasterxml.jackson.datatype:jackson-datatype-joda:jar:2.10.1:compile +| +- com.fasterxml.jackson.core:jackson-annotations:jar:2.10.1:compile +| +- com.fasterxml.jackson.core:jackson-core:jar:2.10.1:compile +| \- com.fasterxml.jackson.core:jackson-databind:jar:2.10.1:compile ++- ring:ring-core:jar:1.8.0:compile +| +- ring:ring-codec:jar:1.1.2:compile +| | \- commons-codec:commons-codec:jar:1.11:compile +| +- commons-io:commons-io:jar:2.6:compile +| +- commons-fileupload:commons-fileupload:jar:1.4:compile +| +- crypto-random:crypto-random:jar:1.2.0:compile +| \- crypto-equality:crypto-equality:jar:1.0.0:compile ++- compojure:compojure:jar:1.6.1:compile +| +- org.clojure:tools.macro:jar:0.1.5:compile +| +- clout:clout:jar:2.2.1:compile +| | \- instaparse:instaparse:jar:1.4.8:compile +| \- medley:medley:jar:1.0.0:compile ++- metosin:spec-tools:jar:0.10.6:compile +| \- org.clojure:spec.alpha:jar:0.3.218:compile ++- metosin:ring-http-response:jar:0.9.1:compile +| \- potemkin:potemkin:jar:0.4.5:compile +| \- clj-tuple:clj-tuple:jar:0.2.2:compile ++- metosin:ring-swagger-ui:jar:3.24.3:compile ++- metosin:ring-swagger:jar:1.0.0:compile +| +- cheshire:cheshire:jar:5.8.1:compile +| | +- com.fasterxml.jackson.dataformat:jackson-dataformat-smile:jar:2.9.6:compile +| | +- com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:jar:2.9.6:compile +| | \- tigris:tigris:jar:0.1.1:compile +| +- metosin:schema-tools:jar:0.11.0:compile +| +- metosin:scjsv:jar:0.5.0:compile +| | \- com.github.java-json-tools:json-schema-validator:jar:2.2.10:compile +| | +- com.github.java-json-tools:json-schema-core:jar:1.2.10:compile +| | | +- com.github.java-json-tools:jackson-coreutils:jar:1.9:compile +| | | | +- com.google.guava:guava:jar:16.0.1:compile +| | | | \- com.github.fge:msg-simple:jar:1.1:compile +| | | | \- com.github.fge:btf:jar:1.2:compile +| | | +- com.github.fge:uri-template:jar:0.9:compile +| | | \- org.mozilla:rhino:jar:1.7.7.1:compile +| | +- javax.mail:mailapi:jar:1.4.3:compile +| | | \- javax.activation:activation:jar:1.1:compile +| | +- com.googlecode.libphonenumber:libphonenumber:jar:8.0.0:compile +| | +- com.google.code.findbugs:jsr305:jar:3.0.1:compile +| | \- net.sf.jopt-simple:jopt-simple:jar:5.0.3:compile +| \- org.tobereplaced:lettercase:jar:1.0.0:compile ++- clj-time:clj-time:jar:0.15.2:compile ++- joda-time:joda-time:jar:2.10.5:compile +\- riddley:riddley:jar:0.2.0:compile diff --git a/dependabot/pom.xml b/dependabot/pom.xml new file mode 100644 index 00000000..a51e501a --- /dev/null +++ b/dependabot/pom.xml @@ -0,0 +1,217 @@ + + 4.0.0 + metosin + compojure-api + jar + 2.0.0-alpha34-SNAPSHOT + compojure-api + Compojure Api + + + + Eclipse Public License + http://www.eclipse.org/legal/epl-v10.html + repo + same as Clojure + + + + + src + test + + + resources + + + + + resources + + + target + target/classes + + + + + central + https://repo1.maven.org/maven2/ + + false + + + true + + + + clojars + https://repo.clojars.org/ + + true + + + true + + + + + + + + + prismatic + schema + 1.1.12 + + + linked + frankiesardo + + + + + prismatic + plumbing + 0.5.5 + + + linked + frankiesardo + + + + + ikitommi + linked + 1.3.1-alpha1 + + + linked + frankiesardo + + + + + metosin + muuntaja + 0.6.6 + + + linked + frankiesardo + + + + + com.fasterxml.jackson.datatype + jackson-datatype-joda + 2.10.1 + + + linked + frankiesardo + + + + + ring + ring-core + 1.8.0 + + + linked + frankiesardo + + + + + compojure + compojure + 1.6.1 + + + linked + frankiesardo + + + + + metosin + spec-tools + 0.10.6 + + + linked + frankiesardo + + + + + metosin + ring-http-response + 0.9.1 + + + linked + frankiesardo + + + + + metosin + ring-swagger-ui + 3.24.3 + + + linked + frankiesardo + + + + + metosin + ring-swagger + 1.0.0 + + + linked + frankiesardo + + + + + clj-time + clj-time + 0.15.2 + + + linked + frankiesardo + + + + + joda-time + joda-time + 2.10.5 + + + linked + frankiesardo + + + + + riddley + riddley + 0.2.0 + + + linked + frankiesardo + + + + + \ No newline at end of file diff --git a/dependabot/verbose-dependency-tree.txt b/dependabot/verbose-dependency-tree.txt new file mode 100644 index 00000000..70b5f315 --- /dev/null +++ b/dependabot/verbose-dependency-tree.txt @@ -0,0 +1,97 @@ +metosin:compojure-api:jar:2.0.0-alpha34-SNAPSHOT ++- prismatic:schema:jar:1.1.12:compile ++- prismatic:plumbing:jar:0.5.5:compile +| +- (prismatic:schema:jar:1.1.7:compile - omitted for conflict with 1.1.12) +| \- de.kotka:lazymap:jar:3.1.0:compile ++- ikitommi:linked:jar:1.3.1-alpha1:compile ++- metosin:muuntaja:jar:0.6.6:compile +| +- metosin:jsonista:jar:0.2.5:compile +| | +- (com.fasterxml.jackson.core:jackson-databind:jar:2.10.0:compile - omitted for conflict with 2.10.1) +| | \- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.10.0:compile +| | +- (com.fasterxml.jackson.core:jackson-annotations:jar:2.10.0:compile - omitted for conflict with 2.10.1) +| | +- (com.fasterxml.jackson.core:jackson-core:jar:2.10.0:compile - omitted for conflict with 2.10.1) +| | \- (com.fasterxml.jackson.core:jackson-databind:jar:2.10.0:compile - omitted for conflict with 2.10.1) +| \- com.cognitect:transit-clj:jar:0.8.319:compile +| \- com.cognitect:transit-java:jar:0.8.337:compile +| +- (com.fasterxml.jackson.core:jackson-core:jar:2.8.7:compile - omitted for conflict with 2.10.1) +| +- org.msgpack:msgpack:jar:0.6.12:compile +| | +- com.googlecode.json-simple:json-simple:jar:1.1.1:compile +| | \- org.javassist:javassist:jar:3.18.1-GA:compile +| +- (commons-codec:commons-codec:jar:1.10:compile - omitted for conflict with 1.11) +| \- javax.xml.bind:jaxb-api:jar:2.3.0:compile ++- com.fasterxml.jackson.datatype:jackson-datatype-joda:jar:2.10.1:compile +| +- com.fasterxml.jackson.core:jackson-annotations:jar:2.10.1:compile +| +- com.fasterxml.jackson.core:jackson-core:jar:2.10.1:compile +| +- com.fasterxml.jackson.core:jackson-databind:jar:2.10.1:compile +| | +- (com.fasterxml.jackson.core:jackson-annotations:jar:2.10.1:compile - omitted for duplicate) +| | \- (com.fasterxml.jackson.core:jackson-core:jar:2.10.1:compile - omitted for duplicate) +| \- (joda-time:joda-time:jar:2.9.9:compile - omitted for conflict with 2.10.5) ++- ring:ring-core:jar:1.8.0:compile +| +- ring:ring-codec:jar:1.1.2:compile +| | \- commons-codec:commons-codec:jar:1.11:compile +| +- commons-io:commons-io:jar:2.6:compile +| +- commons-fileupload:commons-fileupload:jar:1.4:compile +| | \- (commons-io:commons-io:jar:2.2:compile - omitted for conflict with 2.6) +| +- crypto-random:crypto-random:jar:1.2.0:compile +| | \- (commons-codec:commons-codec:jar:1.6:compile - omitted for conflict with 1.11) +| \- crypto-equality:crypto-equality:jar:1.0.0:compile ++- compojure:compojure:jar:1.6.1:compile +| +- org.clojure:tools.macro:jar:0.1.5:compile +| +- clout:clout:jar:2.2.1:compile +| | \- instaparse:instaparse:jar:1.4.8:compile +| +- medley:medley:jar:1.0.0:compile +| +- (ring:ring-core:jar:1.6.3:compile - omitted for conflict with 1.8.0) +| \- (ring:ring-codec:jar:1.1.0:compile - omitted for conflict with 1.1.2) ++- metosin:spec-tools:jar:0.10.6:compile +| \- org.clojure:spec.alpha:jar:0.3.218:compile ++- metosin:ring-http-response:jar:0.9.1:compile +| +- (ring:ring-core:jar:1.7.1:compile - omitted for conflict with 1.8.0) +| \- potemkin:potemkin:jar:0.4.5:compile +| +- clj-tuple:clj-tuple:jar:0.2.2:compile +| \- (riddley:riddley:jar:0.1.12:compile - omitted for conflict with 0.2.0) ++- metosin:ring-swagger-ui:jar:3.24.3:compile ++- metosin:ring-swagger:jar:1.0.0:compile +| +- cheshire:cheshire:jar:5.8.1:compile +| | +- (com.fasterxml.jackson.core:jackson-core:jar:2.9.6:compile - omitted for conflict with 2.10.1) +| | +- com.fasterxml.jackson.dataformat:jackson-dataformat-smile:jar:2.9.6:compile +| | | \- (com.fasterxml.jackson.core:jackson-core:jar:2.9.6:compile - omitted for conflict with 2.10.1) +| | +- com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:jar:2.9.6:compile +| | | \- (com.fasterxml.jackson.core:jackson-core:jar:2.9.6:compile - omitted for conflict with 2.10.1) +| | \- tigris:tigris:jar:0.1.1:compile +| +- (metosin:ring-http-response:jar:0.9.1:compile - omitted for duplicate) +| +- (ring:ring-core:jar:1.7.1:compile - omitted for conflict with 1.8.0) +| +- metosin:schema-tools:jar:0.11.0:compile +| | \- (prismatic:schema:jar:1.1.9:compile - omitted for conflict with 1.1.12) +| +- (prismatic:schema:jar:1.1.10:compile - omitted for conflict with 1.1.12) +| +- (prismatic:plumbing:jar:0.5.5:compile - omitted for duplicate) +| +- metosin:scjsv:jar:0.5.0:compile +| | +- (cheshire:cheshire:jar:5.8.1:compile - omitted for duplicate) +| | \- com.github.java-json-tools:json-schema-validator:jar:2.2.10:compile +| | +- com.github.java-json-tools:json-schema-core:jar:1.2.10:compile +| | | +- com.github.java-json-tools:jackson-coreutils:jar:1.9:compile +| | | | +- (com.fasterxml.jackson.core:jackson-databind:jar:2.2.3:compile - omitted for conflict with 2.10.1) +| | | | +- com.google.guava:guava:jar:16.0.1:compile +| | | | +- com.github.fge:msg-simple:jar:1.1:compile +| | | | | +- com.github.fge:btf:jar:1.2:compile +| | | | | | \- (com.google.code.findbugs:jsr305:jar:2.0.1:compile - omitted for conflict with 3.0.1) +| | | | | \- (com.google.code.findbugs:jsr305:jar:2.0.1:compile - omitted for conflict with 3.0.1) +| | | | \- (com.google.code.findbugs:jsr305:jar:2.0.1:compile - omitted for conflict with 3.0.1) +| | | +- com.github.fge:uri-template:jar:0.9:compile +| | | | +- (com.github.fge:msg-simple:jar:1.1:compile - omitted for duplicate) +| | | | +- (com.google.guava:guava:jar:16.0.1:compile - omitted for duplicate) +| | | | \- (com.google.code.findbugs:jsr305:jar:2.0.1:compile - omitted for conflict with 3.0.1) +| | | +- org.mozilla:rhino:jar:1.7.7.1:compile +| | | \- (com.google.code.findbugs:jsr305:jar:3.0.1:compile - omitted for duplicate) +| | +- javax.mail:mailapi:jar:1.4.3:compile +| | | \- javax.activation:activation:jar:1.1:compile +| | +- (joda-time:joda-time:jar:2.9.7:compile - omitted for conflict with 2.10.5) +| | +- com.googlecode.libphonenumber:libphonenumber:jar:8.0.0:compile +| | +- com.google.code.findbugs:jsr305:jar:3.0.1:compile +| | \- net.sf.jopt-simple:jopt-simple:jar:5.0.3:compile +| +- (clj-time:clj-time:jar:0.15.1:compile - omitted for conflict with 0.15.2) +| +- org.tobereplaced:lettercase:jar:1.0.0:compile +| \- (potemkin:potemkin:jar:0.4.5:compile - omitted for duplicate) ++- clj-time:clj-time:jar:0.15.2:compile +| \- (joda-time:joda-time:jar:2.10:compile - omitted for conflict with 2.10.5) ++- joda-time:joda-time:jar:2.10.5:compile +\- riddley:riddley:jar:0.2.0:compile diff --git a/project.clj b/project.clj index e08a7716..866c9d42 100644 --- a/project.clj +++ b/project.clj @@ -5,6 +5,7 @@ :url "http://www.eclipse.org/legal/epl-v10.html" :distribution :repo :comments "same as Clojure"} + :exclusions [frankiesardo/linked] :dependencies [[prismatic/schema "1.1.12"] [prismatic/plumbing "0.5.5"] [ikitommi/linked "1.3.1-alpha1"] ;; waiting for the original diff --git a/scripts/check-dependabot b/scripts/check-dependabot new file mode 100755 index 00000000..f1e4d057 --- /dev/null +++ b/scripts/check-dependabot @@ -0,0 +1,16 @@ +#!/bin/bash +# Check that project.clj is in sync with the committed dependabot pom.xml. + +set -e + +./scripts/sync-dependabot +set +e +if git diff --ignore-all-space --exit-code dependabot/pom.xml dependabot/dependency-tree.txt ; then + echo 'project.clj and dependabot/pom.xml are in sync.' + exit 0 +else + echo + echo 'project.clj and dependabot/pom.xml are out of sync! Please run ./scripts/sync-dependabot locally and commit the results.' + echo 'If this is a PR from dependabot, you must manually update the version in project.clj' + exit 1 +fi diff --git a/scripts/sync-dependabot b/scripts/sync-dependabot new file mode 100755 index 00000000..5acb5ab9 --- /dev/null +++ b/scripts/sync-dependabot @@ -0,0 +1,14 @@ +#!/bin/bash + +set -xe + +SHA=$(git rev-parse HEAD) + +lein with-profile -dev pom +mkdir -p dependabot +mv pom.xml dependabot +# lein pom uses the origin git remote to add metadata. remove for reproducibility. +bb '(spit "dependabot/pom.xml" (-> "dependabot/pom.xml" slurp xml/parse-str (update :content (partial remove #(some-> % :tag name #{"scm" "url"}))) xml/emit-str))' +cd dependabot +mvn --no-transfer-progress dependency:tree -Dexcludes=org.clojure:clojure -DoutputFile=dependency-tree.txt +mvn --no-transfer-progress dependency:tree -Dverbose -Dexcludes=org.clojure:clojure -DoutputFile=verbose-dependency-tree.txt