From 092c81c3d43e1829e94cdbd534d1c7d91330eecb Mon Sep 17 00:00:00 2001
From: XDEV Renovate Bot <renovate@xdev-software.de>
Date: Fri, 28 Mar 2025 04:12:26 +0000
Subject: [PATCH 01/10] Update vaadin.version to v24.7.1

---
 template-placeholder-demo/pom.xml | 2 +-
 template-placeholder/pom.xml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/template-placeholder-demo/pom.xml b/template-placeholder-demo/pom.xml
index ec69355..17c5c7e 100644
--- a/template-placeholder-demo/pom.xml
+++ b/template-placeholder-demo/pom.xml
@@ -29,7 +29,7 @@
 		<mainClass>software.xdev.vaadin.Application</mainClass>
 
 		<!-- Dependency-Versions -->
-		<vaadin.version>24.7.0</vaadin.version>
+		<vaadin.version>24.7.1</vaadin.version>
 
 		<org.springframework.boot.version>3.4.4</org.springframework.boot.version>
 	</properties>
diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml
index c136635..22accc4 100644
--- a/template-placeholder/pom.xml
+++ b/template-placeholder/pom.xml
@@ -49,7 +49,7 @@
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 
 		<!-- Dependency-Versions -->
-		<vaadin.version>24.7.0</vaadin.version>
+		<vaadin.version>24.7.1</vaadin.version>
 	</properties>
 
 	<dependencyManagement>

From 5ced1cc41f894e26af310f1722dcd94e68af5b9e Mon Sep 17 00:00:00 2001
From: XDEV Renovate Bot <renovate@xdev-software.de>
Date: Sat, 29 Mar 2025 04:13:09 +0000
Subject: [PATCH 02/10] Update net.sourceforge.pmd to v7.12.0

---
 pom.xml                      | 4 ++--
 template-placeholder/pom.xml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index f41e09d..07c70ba 100644
--- a/pom.xml
+++ b/pom.xml
@@ -82,12 +82,12 @@
 							<dependency>
 								<groupId>net.sourceforge.pmd</groupId>
 								<artifactId>pmd-core</artifactId>
-								<version>7.11.0</version>
+								<version>7.12.0</version>
 							</dependency>
 							<dependency>
 								<groupId>net.sourceforge.pmd</groupId>
 								<artifactId>pmd-java</artifactId>
-								<version>7.11.0</version>
+								<version>7.12.0</version>
 							</dependency>
 						</dependencies>
 					</plugin>
diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml
index db20004..47dd4d8 100644
--- a/template-placeholder/pom.xml
+++ b/template-placeholder/pom.xml
@@ -284,12 +284,12 @@
 							<dependency>
 								<groupId>net.sourceforge.pmd</groupId>
 								<artifactId>pmd-core</artifactId>
-								<version>7.11.0</version>
+								<version>7.12.0</version>
 							</dependency>
 							<dependency>
 								<groupId>net.sourceforge.pmd</groupId>
 								<artifactId>pmd-java</artifactId>
-								<version>7.11.0</version>
+								<version>7.12.0</version>
 							</dependency>
 						</dependencies>
 					</plugin>

From 49db248d25fd4a3106ddaaf092c86a205d357c4c Mon Sep 17 00:00:00 2001
From: XDEV Renovate Bot <renovate@xdev-software.de>
Date: Mon, 31 Mar 2025 04:15:29 +0000
Subject: [PATCH 03/10] Update dependency com.puppycrawl.tools:checkstyle to
 v10.22.0

---
 pom.xml                      | 2 +-
 template-placeholder/pom.xml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index f41e09d..eb66486 100644
--- a/pom.xml
+++ b/pom.xml
@@ -45,7 +45,7 @@
 							<dependency>
 								<groupId>com.puppycrawl.tools</groupId>
 								<artifactId>checkstyle</artifactId>
-								<version>10.21.4</version>
+								<version>10.22.0</version>
 							</dependency>
 						</dependencies>
 						<configuration>
diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml
index db20004..014b608 100644
--- a/template-placeholder/pom.xml
+++ b/template-placeholder/pom.xml
@@ -247,7 +247,7 @@
 							<dependency>
 								<groupId>com.puppycrawl.tools</groupId>
 								<artifactId>checkstyle</artifactId>
-								<version>10.21.4</version>
+								<version>10.22.0</version>
 							</dependency>
 						</dependencies>
 						<configuration>

From 4eef9ec75c98fcddb0845dfe527b5ae6615db1c3 Mon Sep 17 00:00:00 2001
From: AB <a.bierler@xdev-software.de>
Date: Mon, 31 Mar 2025 08:37:19 +0200
Subject: [PATCH 04/10] Improve Code Analysis

See https://github.com/xdev-software/java-template/issues/13
---
 .config/checkstyle/checkstyle.xml | 13 +++++++++-
 .config/pmd/ruleset.xml           | 43 ++++++++++++++++++++++++++++---
 2 files changed, 51 insertions(+), 5 deletions(-)

diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml
index a0d7f17..43b5290 100644
--- a/.config/checkstyle/checkstyle.xml
+++ b/.config/checkstyle/checkstyle.xml
@@ -52,6 +52,7 @@
 	<module name="TreeWalker">
 		<!-- Checks - sorted alphabetically -->
 		<module name="ArrayTypeStyle"/>
+		<module name="AvoidDoubleBraceInitialization"/>
 		<module name="AvoidStarImport"/>
 		<module name="ConstantName"/>
 		<module name="DefaultComesLast"/>
@@ -68,6 +69,11 @@
 		<module name="FinalParameters"/>
 		<module name="GenericWhitespace"/>
 		<module name="HideUtilityClassConstructor"/>
+		<module name="IllegalCatch">
+			<!-- https://docs.pmd-code.org/pmd-doc-7.11.0/pmd_rules_java_errorprone.html#avoidcatchingnpe -->
+			<!-- https://docs.pmd-code.org/pmd-doc-7.11.0/pmd_rules_java_errorprone.html#avoidcatchingthrowable -->
+			<property name="illegalClassNames" value="Error,Throwable,NullPointerException,java.lang.Error,java.lang.Throwable,java.lang.NullPointerException"/>
+		</module>
 		<module name="IllegalImport"/>
 		<module name="InterfaceIsType"/>
 		<module name="JavadocStyle">
@@ -93,7 +99,6 @@
 		<module name="MethodParamPad"/>
 		<module name="MissingDeprecated"/>
 		<module name="MissingOverride"/>
-		<module name="MissingSwitchDefault"/>
 		<module name="ModifierOrder"/>
 		<module name="NeedBraces"/>
 		<module name="NoClone"/>
@@ -122,7 +127,13 @@
 		</module>
 		<module name="TypecastParenPad"/>
 		<module name="TypeName"/>
+		<module name="UnnecessaryParentheses"/>
+		<module name="UnnecessarySemicolonAfterOuterTypeDeclaration"/>
+		<module name="UnnecessarySemicolonAfterTypeMemberDeclaration"/>
+		<module name="UnnecessarySemicolonInEnumeration"/>
+		<module name="UnnecessarySemicolonInTryWithResources"/>
 		<module name="UnusedImports"/>
+		<module name="UnusedLocalVariable"/>
 		<module name="UpperEll"/>
 		<module name="VisibilityModifier">
 			<property name="packageAllowed" value="true"/>
diff --git a/.config/pmd/ruleset.xml b/.config/pmd/ruleset.xml
index 7a03f17..88a7b5a 100644
--- a/.config/pmd/ruleset.xml
+++ b/.config/pmd/ruleset.xml
@@ -10,16 +10,38 @@
 
 	<!-- Only rules that don't overlap with CheckStyle! -->
 
+	<rule ref="category/java/bestpractices.xml/AvoidPrintStackTrace"/>
+	<rule ref="category/java/bestpractices.xml/AvoidStringBufferField"/>
 	<rule ref="category/java/bestpractices.xml/AvoidUsingHardCodedIP"/>
+	<rule ref="category/java/bestpractices.xml/ConstantsInInterface"/>
+	<rule ref="category/java/bestpractices.xml/ExhaustiveSwitchHasDefault"/>
+	<rule ref="category/java/bestpractices.xml/LiteralsFirstInComparisons"/>
+	<!-- CheckStyle can't handle this switch behavior -> delegated to PMD -->
+	<rule ref="category/java/bestpractices.xml/NonExhaustiveSwitch"/>
+	<rule ref="category/java/bestpractices.xml/OneDeclarationPerLine">
+		<properties>
+			<property name="strictMode" value="true"/>
+		</properties>
+	</rule>
 	<rule ref="category/java/bestpractices.xml/PreserveStackTrace"/>
+	<rule ref="category/java/bestpractices.xml/SimplifiableTestAssertion"/>
+	<rule ref="category/java/bestpractices.xml/SystemPrintln"/>
+	<rule ref="category/java/bestpractices.xml/UnusedAssignment"/>
+	<rule ref="category/java/bestpractices.xml/UnusedFormalParameter"/>
+	<rule ref="category/java/bestpractices.xml/UnusedPrivateField"/>
+	<rule ref="category/java/bestpractices.xml/UnusedPrivateMethod"/>
 	<rule ref="category/java/bestpractices.xml/UseCollectionIsEmpty"/>
+	<rule ref="category/java/bestpractices.xml/UseEnumCollections"/>
 	<rule ref="category/java/bestpractices.xml/UseStandardCharsets"/>
+	<rule ref="category/java/bestpractices.xml/UseTryWithResources"/>
 
 	<!-- Native code is platform dependent; Loading external native libs might pose a security threat -->
 	<rule ref="category/java/codestyle.xml/AvoidUsingNativeCode"/>
 	<rule ref="category/java/codestyle.xml/IdenticalCatchBranches"/>
+	<rule ref="category/java/codestyle.xml/LambdaCanBeMethodReference"/>
 	<rule ref="category/java/codestyle.xml/NoPackage"/>
 	<rule ref="category/java/codestyle.xml/PrematureDeclaration"/>
+	<rule ref="category/java/codestyle.xml/UnnecessarySemicolon"/>
 
 	<rule ref="category/java/design.xml">
 		<!-- Sometimes abstract classes have just fields -->
@@ -76,9 +98,6 @@
 
 		<!-- Limit too low -->
 		<exclude name="UseObjectForClearerAPI"/>
-
-		<!-- Handled by checkstyle -->
-		<exclude name="UseUtilityClass"/>
 	</rule>
 
 	<rule ref="category/java/design.xml/AvoidDeeplyNestedIfStmts">
@@ -114,17 +133,33 @@
 		</properties>
 	</rule>
 
+	<rule ref="category/java/errorprone.xml/AssignmentToNonFinalStatic"/>
+	<rule ref="category/java/errorprone.xml/AvoidDecimalLiteralsInBigDecimalConstructor"/>
+	<rule ref="category/java/errorprone.xml/AvoidMultipleUnaryOperators"/>
 	<rule ref="category/java/errorprone.xml/AvoidUsingOctalValues"/>
 	<rule ref="category/java/errorprone.xml/BrokenNullCheck"/>
 	<rule ref="category/java/errorprone.xml/ComparisonWithNaN"/>
 	<rule ref="category/java/errorprone.xml/DoNotCallGarbageCollectionExplicitly"/>
 	<rule ref="category/java/errorprone.xml/DontImportSun"/>
+	<rule ref="category/java/errorprone.xml/DontUseFloatTypeForLoopIndices"/>
+	<rule ref="category/java/errorprone.xml/EqualsNull"/>
+	<rule ref="category/java/errorprone.xml/IdempotentOperations"/>
+	<rule ref="category/java/errorprone.xml/ImplicitSwitchFallThrough"/>
+	<rule ref="category/java/errorprone.xml/InstantiationToGetClass"/>
+	<rule ref="category/java/errorprone.xml/InvalidLogMessageFormat"/>
+	<rule ref="category/java/errorprone.xml/JumbledIncrementer"/>
 	<rule ref="category/java/errorprone.xml/MisplacedNullCheck"/>
+	<rule ref="category/java/errorprone.xml/MoreThanOneLogger"/>
+	<rule ref="category/java/errorprone.xml/NonStaticInitializer"/>
+	<rule ref="category/java/errorprone.xml/ReturnFromFinallyBlock"/>
+	<rule ref="category/java/errorprone.xml/SingletonClassReturningNewInstance"/>
+	<rule ref="category/java/errorprone.xml/UnconditionalIfStatement"/>
 	<rule ref="category/java/errorprone.xml/UnnecessaryCaseChange"/>
+	<rule ref="category/java/errorprone.xml/UselessOperationOnImmutable"/>
 
 
 	<rule ref="category/java/multithreading.xml">
-		<!-- Just bloats code -->
+		<!-- Just bloats code; improved in JEP-491/Java 24+ -->
 		<exclude name="AvoidSynchronizedAtMethodLevel"/>
 
 		<!-- NOPE -->

From 68cca2be8fb75982634cca45edd03e54a96a84d9 Mon Sep 17 00:00:00 2001
From: AB <a.bierler@xdev-software.de>
Date: Mon, 31 Mar 2025 08:40:11 +0200
Subject: [PATCH 05/10] Check for usage of native Vaadin HTML

Fixes https://github.com/xdev-software/vaadin-addon-template/issues/284
---
 .config/pmd/ruleset.xml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.config/pmd/ruleset.xml b/.config/pmd/ruleset.xml
index 88a7b5a..d51fbb5 100644
--- a/.config/pmd/ruleset.xml
+++ b/.config/pmd/ruleset.xml
@@ -194,4 +194,25 @@
 	</rule>
 
 	<rule ref="category/java/security.xml"/>
+
+	<rule name="VaadinNativeHTMLUnsafe"
+		language="java"
+		message="Unescaped native HTML is unsafe and will result in XSS vulnerabilities"
+		class="net.sourceforge.pmd.lang.rule.xpath.XPathRule" >
+		<description>
+			Do not used native HTML! Use Vaadin layouts and components to create required structure.
+			If you are 100% sure that you escaped the value properly and you have no better options you can suppress this.
+		</description>
+		<priority>2</priority>
+		<properties>
+			<property name="xpath">
+				<value>
+<![CDATA[
+//ConstructorCall[pmd-java:typeIs('com.vaadin.flow.component.Html')] |
+//MethodCall[@MethodName='setAttribute' and //ImportDeclaration[starts-with(@PackageName,'com.vaadin')]]/ArgumentList/StringLiteral[1][contains(lower-case(@Image),'html')]
+]]>
+				</value>
+			</property>
+		</properties>
+	</rule>
 </ruleset>

From 4112981e55f3c4ca0837bc0bcac0db7ee5bd961c Mon Sep 17 00:00:00 2001
From: AB <a.bierler@xdev-software.de>
Date: Mon, 31 Mar 2025 10:45:23 +0200
Subject: [PATCH 06/10] Update Application.java

---
 .../src/main/java/software/xdev/vaadin/Application.java          | 1 +
 1 file changed, 1 insertion(+)

diff --git a/template-placeholder-demo/src/main/java/software/xdev/vaadin/Application.java b/template-placeholder-demo/src/main/java/software/xdev/vaadin/Application.java
index f5a4d96..32833af 100644
--- a/template-placeholder-demo/src/main/java/software/xdev/vaadin/Application.java
+++ b/template-placeholder-demo/src/main/java/software/xdev/vaadin/Application.java
@@ -9,6 +9,7 @@
 import com.vaadin.flow.spring.annotation.EnableVaadin;
 
 
+@SuppressWarnings({"checkstyle:HideUtilityClassConstructor", "PMD.UseUtilityClass"})
 @SpringBootApplication
 @EnableVaadin
 @Push

From e5152dc2243ec5b88ef9d45e6a836ebf10c9aece Mon Sep 17 00:00:00 2001
From: XDEV Renovate Bot <renovate@xdev-software.de>
Date: Tue, 1 Apr 2025 04:11:14 +0000
Subject: [PATCH 07/10] Update lycheeverse/lychee-action digest to 1d97d84

---
 .github/workflows/broken-links.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml
index 2b1188e..ade0346 100644
--- a/.github/workflows/broken-links.yml
+++ b/.github/workflows/broken-links.yml
@@ -18,7 +18,7 @@ jobs:
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@f613c4a64e50d792e0b31ec34bbcbba12263c6a6 # v2
+        uses: lycheeverse/lychee-action@1d97d84f0bc547f7b25f4c2170d87d810dc2fb2c # v2
         with:
           fail: false # Don't fail on broken links, create an issue instead
 

From 4ff7c848a6a29ba54bb1982f5237e16ac325d298 Mon Sep 17 00:00:00 2001
From: XDEV Renovate Bot <renovate@xdev-software.de>
Date: Thu, 3 Apr 2025 04:13:57 +0000
Subject: [PATCH 08/10] Update dependency com.puppycrawl.tools:checkstyle to
 v10.23.0

---
 pom.xml                      | 2 +-
 template-placeholder/pom.xml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index c46fefe0..6d58c9d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -45,7 +45,7 @@
 							<dependency>
 								<groupId>com.puppycrawl.tools</groupId>
 								<artifactId>checkstyle</artifactId>
-								<version>10.22.0</version>
+								<version>10.23.0</version>
 							</dependency>
 						</dependencies>
 						<configuration>
diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml
index 5dcf34d..71700cc 100644
--- a/template-placeholder/pom.xml
+++ b/template-placeholder/pom.xml
@@ -247,7 +247,7 @@
 							<dependency>
 								<groupId>com.puppycrawl.tools</groupId>
 								<artifactId>checkstyle</artifactId>
-								<version>10.22.0</version>
+								<version>10.23.0</version>
 							</dependency>
 						</dependencies>
 						<configuration>

From acc4965b79e18120abc09d018bf503da4b8b781c Mon Sep 17 00:00:00 2001
From: XDEV Renovate Bot <renovate@xdev-software.de>
Date: Wed, 16 Apr 2025 04:12:32 +0000
Subject: [PATCH 09/10] Update vaadin.version to v24.7.2

---
 template-placeholder-demo/pom.xml | 2 +-
 template-placeholder/pom.xml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/template-placeholder-demo/pom.xml b/template-placeholder-demo/pom.xml
index 17c5c7e..b8ec8ab 100644
--- a/template-placeholder-demo/pom.xml
+++ b/template-placeholder-demo/pom.xml
@@ -29,7 +29,7 @@
 		<mainClass>software.xdev.vaadin.Application</mainClass>
 
 		<!-- Dependency-Versions -->
-		<vaadin.version>24.7.1</vaadin.version>
+		<vaadin.version>24.7.2</vaadin.version>
 
 		<org.springframework.boot.version>3.4.4</org.springframework.boot.version>
 	</properties>
diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml
index 7c8d56e..7f8fac3 100644
--- a/template-placeholder/pom.xml
+++ b/template-placeholder/pom.xml
@@ -49,7 +49,7 @@
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 
 		<!-- Dependency-Versions -->
-		<vaadin.version>24.7.1</vaadin.version>
+		<vaadin.version>24.7.2</vaadin.version>
 	</properties>
 
 	<dependencyManagement>

From 9f5cab50cee12ff7b938c164170d8d064f07be5a Mon Sep 17 00:00:00 2001
From: AB <a.bierler@xdev-software.de>
Date: Tue, 22 Apr 2025 08:39:58 +0200
Subject: [PATCH 10/10] Enforce IDEA plugins

---
 .idea/externalDependencies.xml | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 .idea/externalDependencies.xml

diff --git a/.idea/externalDependencies.xml b/.idea/externalDependencies.xml
new file mode 100644
index 0000000..78be5b8
--- /dev/null
+++ b/.idea/externalDependencies.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ExternalDependencies">
+    <plugin id="CheckStyle-IDEA" />
+    <plugin id="software.xdev.saveactions" />
+  </component>
+</project>
\ No newline at end of file