Report did not show as part of mvn site

[karianna]

Ran ./mvnw clean install site on my project with the plugin configured in build and reporting sections. No report was generated

[jimbethancourt]

Hi Martijn,
Thanks so much for your feedback. The report is generated in target/site/refactor-first-report.html - I realize now that I should be more clear in the Readme indicating where the report is generated.

Report generation is currently bound to the mvn site lifecycle phase, but it's not currently integrated as a report in the list of site reports.

Unfortunately I had to remove report generation from the Maven Report generation process due to CVE-2020-13936 as detailed in #15 - large organizations with good security hygiene don't allow anything with a CVSS score of greater than 8.0 through their security gates (with good reason!), and that CVE has a vulnerability score of 8.8 and a trivial workaround isn't available that I'm aware of. Unfortunately this is largely out of my control since the version of Velocity is heavily integrated with Maven. I tried to work around it before, but ran into multiple dead-ends. I believe the dependency-check plugin is able to work around it, but not without a significant amount of work.

Would you happen to be aware of a more expedient workaround? It's possible that this issue may be resolved as part of Maven 4

On a scale of 1 (not valuable) - 5 (extremely valuable), how valuable would you find having the RefactorFirst report integrated into a Maven 3.x site generated report?

Thanks,
Jim

[karianna]

@jimbethancourt Is that CVE not fixed in the latest Maven 3.9.3 with latest plugins specified? I think it's important in terms of discoverablity in CI/CD platforms but as a dev I can get around it.

[jimbethancourt]

It looks like newer versions of Doxia Site Renderer have been released in the 1.x stream - https://central.sonatype.com/artifact/org.apache.maven.doxia/doxia-site-renderer/1.11.1/versions

I'll investigate soon and see if the CVE is removed in the most recent release.

[jimbethancourt]

Hi @karianna! I'm done coding this up and need to update the Readme.md file. I also need to merge in PR #21 and update JGit and test, but it should be ready soon. I'm keeping an eye on PMD as well for Java 21 support, but this feature is going to happen 🙂

[jimbethancourt]

Fixed in release 0.5.0-M1