Prepare release

.github/workflows/build.yml

@@ -31,6 +31,7 @@ jobs:
     - uses: actions/checkout@v6
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - uses: actions/setup-java@v5
       with:
@@ -96,8 +97,31 @@ jobs:
           product/build/jpackage-checksums/*
         if-no-files-found: error
 
-  build:
-    needs: matrix-build
+
+  ossindex:
     runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@v5
+      with:
+        distribution: temurin
+        java-version: 25
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v6
+    - name: Ossindex
+      run: ./gradlew ossIndexAudit --no-parallel --warning-mode all --info
+      env:
+        ORG_GRADLE_PROJECT_ossIndexUsername: ${{ secrets.OSSINDEX_USERNAME }}
+        ORG_GRADLE_PROJECT_ossIndexToken: ${{ secrets.OSSINDEX_TOKEN }}
+
+  build:
+    permissions:
+      contents: read
+    runs-on: ubuntu-slim
+    needs:
+    - matrix-build
+    - ossindex
     steps:
       - run: echo "Build successful"

.github/workflows/codeql-analysis.yml

@@ -36,6 +36,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         distribution: 'temurin'

.github/workflows/dependency-submission.yml

@@ -14,6 +14,8 @@ jobs:
     steps:
     - name: Checkout sources
       uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: Setup Java
       uses: actions/setup-java@v5
       with:

.github/workflows/release.yml

@@ -25,6 +25,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Fail if not running on main branch
         if: ${{ github.ref != 'refs/heads/main' }}
@@ -79,6 +81,8 @@ jobs:
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: true
       - name: Set up Java
         uses: actions/setup-java@v5
         with:
@@ -99,8 +103,8 @@ jobs:
         if: ${{ ! inputs.skip-maven-central }}
         run: ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository --info --warning-mode all
         env:
-            ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.OSSRH_USERNAME }}
-            ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.OSSRH_PASSWORD }}
+            ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.MAVEN_CENTRAL_PORTAL_USERNAME }}
+            ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.MAVEN_CENTRAL_PORTAL_TOKEN }}
             ORG_GRADLE_PROJECT_signingKey: ${{ secrets.OSSRH_GPG_SECRET_KEY }}
             ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
 

CHANGELOG.md

@@ -4,10 +4,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.10.0] - unreleased
+## [1.11.0] - unreleased
+
+## [1.10.0] - 2026-05-25
 
 See [Release](https://github.com/itsallcode/white-rabbit/releases/tag/v1.10.0) / [Milestone](https://github.com/itsallcode/white-rabbit/milestone/12?closed=1)
 
+### Breaking Changes
+
 This release requires Java 25.
 
 ## [1.9.0] - 2024-09-08

build.gradle

@@ -1,17 +1,17 @@
 plugins {
     id 'eclipse'
-    id "org.sonarqube" version "7.2.3.7755"
+    id "org.sonarqube" version "7.3.0.8198"
     id "org.jetbrains.gradle.plugin.idea-ext" version "1.4.1"
-    id "io.codearte.nexus-staging" version "0.30.0"
     id 'com.gradleup.shadow' version '9.4.1' apply false
     id "com.moowork.node" version "1.3.1" apply false
-    id "com.github.ben-manes.versions" version "0.53.0"
+    id "com.github.ben-manes.versions" version "0.54.0"
     id "org.panteleyev.jpackageplugin" version "2.0.1" apply false
     id "org.gradle.crypto.checksum" version "1.4.0" apply false
     id "io.github.gradle-nexus.publish-plugin" version "2.0.0"
+    id 'org.sonatype.gradle.plugins.scan' version '3.1.5'
 }
 
-version = "1.9.0"
+version = "1.10.0"
 group = "org.itsallcode.whiterabbit"
 
 def javaVersion = project.hasProperty('javaVersion') ? project.getProperty('javaVersion') : 25
@@ -79,12 +79,6 @@ def getOptionalProperty(String name) {
     return null
 }
 
-nexusStaging {
-    packageGroup = "org.itsallcode"
-    username = getOptionalProperty("ossrhUsername")
-    password = getOptionalProperty("ossrhPassword")
-}
-
 sonarqube {
     properties {
         property "sonar.host.url", "https://sonarcloud.io"
@@ -109,7 +103,18 @@ nexusPublishing {
     packageGroup = project.group
     repositories {
         sonatype {
-            stagingProfileId = "546ea6ce74787e"
+            nexusUrl = uri("https://ossrh-staging-api.central.sonatype.com/service/local/")
         }
     }
 }
+
+ossIndexAudit {
+  if(project.hasProperty("ossIndexUsername") && project.hasProperty("ossIndexToken")) {
+    username = findProperty("ossIndexUsername")
+    password = findProperty("ossIndexToken")
+  }
+  allConfigurations = false
+  useCache = true
+  excludeVulnerabilityIds = []
+  printBanner = false
+}

docs/developer_guide.md

@@ -62,6 +62,21 @@ Run a single test:
 ./gradlew dependencyUpdates --no-parallel
 ```
 
+### Check for Vulnerable Dependencies
+
+Configure Sonatype Guide credentials in `~/.gradle/gradle.properties`:
+
+```properties
+ossIndexUsername = email@example.com
+ossIndexToken = sonatype_pat_abc123
+```
+
+Then run
+
+```sh
+./gradlew ossIndexAudit --no-parallel --info
+```
+
 ### <a name="build_native_package"></a>Build Native Packages
 
 Precondition for Windows: Install the [WiX Toolset](https://wixtoolset.org) and add it to the `PATH`.

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,9 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

jfxui/build.gradle

@@ -97,4 +97,5 @@ task run(type: JavaExec, group: 'run') {
     mainClass = project.mainClass
     workingDir = rootProject.projectDir
     classpath = filterCurrentJavaFxRuntimeClasspath(sourceSets.main.runtimeClasspath)
+    jvmArguments = ['--enable-native-access=ALL-UNNAMED']
 }

product/build.gradle

@@ -29,7 +29,9 @@ def filterCurrentJavaFxRuntimeClasspath = { classpath ->
 
 dependencies {
     runtimeOnly project(':jfxui')
-    runtimeOnly project(':plugins').subprojects
+    rootProject.project(':plugins').subprojects.each { pluginProject ->
+        runtimeOnly project(pluginProject.path)
+    }
 }
 
 shadowJar {
@@ -69,13 +71,15 @@ task runProduct(type: JavaExec, dependsOn: [shadowJar], group: 'run') {
     classpath = shadowJar.outputs.files
     mainClass = project.mainClass
     workingDir = rootProject.projectDir
+    jvmArguments = ['--enable-native-access=ALL-UNNAMED']
 }
 
 task runWithPlugins(type: JavaExec, group: 'run') {
     group = "run"
     mainClass = project.mainClass
     workingDir = rootProject.projectDir
     classpath = filterCurrentJavaFxRuntimeClasspath(sourceSets.main.runtimeClasspath)
+    jvmArguments = ['--enable-native-access=ALL-UNNAMED']
 }
 
 task copyJPackageDependencies(type: Copy, dependsOn: ["jar"]) {

settings.gradle

@@ -20,15 +20,15 @@ dependencyResolutionManagement {
     }
     versionCatalogs {
         libs {
-            version('junitJupiter', '6.0.3')
+            version('junitJupiter', '6.1.0')
             version('mockito', '5.23.0')
-            version('log4j', '2.25.4')
-            version('javafx', '27-ea+12')
+            version('log4j', '2.26.0')
+            version('javafx', '27-ea+17')
 
             library('junitParams', 'org.junit.jupiter', 'junit-jupiter-params').versionRef('junitJupiter')
             library('assertj', 'org.assertj:assertj-core:3.27.7')
             library('junitPioneer', 'org.junit-pioneer:junit-pioneer:2.3.0')
-            library('equalsverifier', 'nl.jqno.equalsverifier:equalsverifier:4.4.2')
+            library('equalsverifier', 'nl.jqno.equalsverifier:equalsverifier:4.5')
             library('tostringverifier', 'com.jparams:to-string-verifier:1.4.8')
             library('hamcrest', 'org.hamcrest:hamcrest:3.0')
             library('mockito', 'org.mockito', 'mockito-core').versionRef('mockito')
@@ -48,7 +48,7 @@ dependencyResolutionManagement {
             library('log4j.jul', 'org.apache.logging.log4j', 'log4j-jul').versionRef('log4j')
             library('log4j.slf4j', 'org.apache.logging.log4j', 'log4j-slf4j-impl').versionRef('log4j')
 
-            library('holidaycalculator', 'org.itsallcode:holiday-calculator:0.2.1')
+            library('holidaycalculator', 'org.itsallcode:holiday-calculator:0.2.2')
         }
     }
 }