You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by we...@apache.org on 2022/06/09 13:06:02 UTC

[myfaces-tobago] branch TOBAGO-1999_Select2 updated: cherrypicking changes from 2.x:

This is an automated email from the ASF dual-hosted git repository.

weber pushed a commit to branch TOBAGO-1999_Select2
in repository https://gitbox.apache.org/repos/asf/myfaces-tobago.git


The following commit(s) were added to refs/heads/TOBAGO-1999_Select2 by this push:
     new 70bc9769d6 cherrypicking changes from 2.x:
70bc9769d6 is described below

commit 70bc9769d6cca0974f3de7b2308a65b7446acbcf
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Fri Apr 8 17:19:59 2022 +0000

    cherrypicking changes from 2.x:
---
 .github/workflows/tobago-ci.yml                    | 59 ++++++++++++++++++
 README.md                                          | 29 +++++++++
 pom.xml                                            | 35 ++++++-----
 readme.txt                                         | 17 ------
 tobago-assembly/src/main/resources/NOTICE.txt      |  2 +-
 tobago-core/pom.xml                                |  6 +-
 .../tobago/internal/config/TobagoConfigMerger.java |  2 +-
 .../tobago/internal/config/TobagoConfigParser.java |  4 ++
 .../internal/taglib/component/package-info.java    |  2 +-
 .../internal/taglib/extension/package-info.java    |  2 +-
 .../myfaces/tobago/sanitizer/JsoupSanitizer.java   | 40 ++++++------
 tobago-example/pom.xml                             | 25 ++++++--
 .../tobago-example-addressbook-cdi/pom.xml         |  2 +-
 .../src/main/resources/NOTICE.txt                  |  2 +-
 tobago-example/tobago-example-demo/pom.xml         | 65 +++++++++++++++++++-
 .../src/main/webapp/WEB-INF/tobago-config.xml      |  2 +-
 .../internal/taglib/sandbox/package-info.java      |  2 +-
 .../tobago/renderkit/html/JsonUtilsUnitTest.java   |  7 ++-
 tobago-tool/tobago-theme-plugin/pom.xml            | 60 ++++++++----------
 .../tobago/maven/plugin/AbstractThemeMojo.java     | 19 +++---
 .../tobago/maven/plugin/IndexThemeMojo.java        | 35 ++++-------
 .../tobago/maven/plugin/UnPackThemeMojo.java       | 71 ++++++++--------------
 .../src/main/resources/META-INF/NOTICE.txt         |  2 +-
 tobago-tool/tobago-tool-apt/pom.xml                |  2 +-
 24 files changed, 307 insertions(+), 185 deletions(-)

diff --git a/.github/workflows/tobago-ci.yml b/.github/workflows/tobago-ci.yml
new file mode 100644
index 0000000000..2148c6031f
--- /dev/null
+++ b/.github/workflows/tobago-ci.yml
@@ -0,0 +1,59 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+name: Tobago CI
+
+on:
+  push:
+    branches: [ tobago-2.x ]
+  pull_request:
+    branches: [ tobago-2.x ]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
+      - name: Set up JDK 1.8
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'zulu'
+          java-version: '8'
+      - name: Cache Maven packages
+        uses: actions/cache@v3
+        with:
+          path: ~/.m2
+          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+          restore-keys: ${{ runner.os }}-m2
+      - name: Build with Maven
+        run: |
+          if ! mvn -B checkstyle:check apache-rat:check animal-sniffer:check dependency-check:check -Pgenerate-assembly -Pfrontend package -Dformats=XML -f pom.xml; then
+            find . \( -path '*/target/surefire-reports/*.xml' -o -path '*/target/failsafe-reports/*.xml' -o -path '*/target/rat.txt' -o -path '*/target/checkstyle-result.xml' -o -path '*/target/dependency-check-report.xml' \) | zip -q reports.zip -@
+            exit 1
+          fi
+      - name: Reports
+        uses: actions/upload-artifact@v3
+        if: failure()
+        with:
+          name: reports
+          retention-days: 14
+          path: reports.zip
+          if-no-files-found: ignore
diff --git a/README.md b/README.md
new file mode 100644
index 0000000000..1b8d696696
--- /dev/null
+++ b/README.md
@@ -0,0 +1,29 @@
+# Building
+
+You need Maven 3 and Java 8 or higher to build Tobago 2.
+
+In the main directory you can use
+
+```
+mvn install
+```
+
+to run the "install" target on all sub-modules.
+
+# Demo
+
+Go to the demo example directory:
+
+```
+cd tobago-example/tobago-example-demo
+```
+
+Run with Java 8, JSF 2.0, CDI 1 and Jetty 9:
+```
+mvn jetty:run
+```
+
+Run with Java 11, JSF 2.3, CDI 2 and Jetty 10:
+```
+mvn jetty:run -Djsf=myfaces-2.3
+```
diff --git a/pom.xml b/pom.xml
index 80e273a1e4..27b3e119ef 100644
--- a/pom.xml
+++ b/pom.xml
@@ -38,7 +38,7 @@
     <myfaces20.version>2.0.25</myfaces20.version>
     <myfaces21.version>2.1.18</myfaces21.version>
     <myfaces22.version>2.2.14</myfaces22.version>
-    <myfaces23.version>2.3.9</myfaces23.version>
+    <myfaces23.version>2.3.10</myfaces23.version>
     <mojarra20.version>2.0.11-04</mojarra20.version>
     <mojarra21.version>2.1.29-11</mojarra21.version>
     <mojarra22.version>2.2.20</mojarra22.version>
@@ -49,16 +49,16 @@
     <commons-lang.version>2.6</commons-lang.version>
     <commons-logging.version>1.2</commons-logging.version>
     <commons-collection.version>3.2.2</commons-collection.version>
-    <maven.compile.source>1.5</maven.compile.source>
-    <maven.compile.target>1.5</maven.compile.target>
+    <maven.compile.source>1.7</maven.compile.source>
+    <maven.compile.target>1.7</maven.compile.target>
     <maven.compile.encoding>UTF-8</maven.compile.encoding>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <jsf.target>2.0</jsf.target>
-    <required.maven.version>3.3.1</required.maven.version>
+    <required.maven.version>3.8.1</required.maven.version>
     <maven-checkstyle-plugin.version>3.1.2</maven-checkstyle-plugin.version>
     <checkstyle.version>9.3</checkstyle.version>
-    <!-- XXX use 16, if released -->
-    <checkstyle-rules.version>16</checkstyle-rules.version>
+    <!-- XXX use 17, if released -->
+    <checkstyle-rules.version>17-SNAPSHOT</checkstyle-rules.version>
     <tobago.basedir>${project.basedir}</tobago.basedir>
   </properties>
 
@@ -289,7 +289,7 @@
         <!-- jsoup HTML parser library -->
         <groupId>org.jsoup</groupId>
         <artifactId>jsoup</artifactId>
-        <version>1.14.3</version>
+        <version>1.15.1</version>
       </dependency>
       <dependency>
         <groupId>net.sourceforge.maven-taglib</groupId>
@@ -427,7 +427,6 @@
             <configuration>
               <rules>
                 <requireMavenVersion>
-                  <!-- 3.3.1 is only required for a release, for a normal build 2.2.1 should be okay -->
                   <version>${required.maven.version}</version>
                 </requireMavenVersion>
                 <requirePluginVersions>
@@ -441,7 +440,7 @@
                 </requirePluginVersions>
                 <requireJavaVersion>
                   <message>Tobago must be compiled with Java 8</message>
-                  <version>[1.8.0-100,1.8.0-999]</version>
+                  <version>[1.8.0-100,17.99.999]</version>
                 </requireJavaVersion>
               </rules>
             </configuration>
@@ -506,7 +505,7 @@
         <configuration>
           <signature>
             <groupId>org.codehaus.mojo.signature</groupId>
-            <artifactId>java15</artifactId>
+            <artifactId>java17</artifactId>
             <version>1.0</version>
           </signature>
         </configuration>
@@ -552,7 +551,7 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-pmd-plugin</artifactId>
-          <version>3.16.0</version>
+          <version>3.17.0</version>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>
@@ -682,7 +681,7 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-clean-plugin</artifactId>
-          <version>3.1.0</version>
+          <version>3.2.0</version>
         </plugin>
         <plugin>
           <artifactId>maven-source-plugin</artifactId>
@@ -708,7 +707,7 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-scm-plugin</artifactId>
-          <version>1.12.2</version>
+          <version>1.13.0</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
@@ -759,6 +758,9 @@
 
               <!-- jetty key store for testing -->
               <exclude>**/jettykeystore</exclude>
+
+              <!-- readme -->
+              <exclude>**/README.md</exclude>
             </excludes>
           </configuration>
         </plugin>
@@ -786,12 +788,12 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-site-plugin</artifactId>
-          <version>3.11.0</version>
+          <version>3.12.0</version>
         </plugin>
         <plugin>
           <groupId>org.owasp</groupId>
           <artifactId>dependency-check-maven</artifactId>
-          <version>7.0.1</version>
+          <version>7.1.0</version>
           <configuration>
             <failBuildOnCVSS>0</failBuildOnCVSS>
             <suppressionFile>tobago/dependency-check-suppression-for-tobago-2.x.xml</suppressionFile>
@@ -858,9 +860,6 @@
              </properties>
            </profile>
        -->
-      <properties>
-        <required.maven.version>3.3.1</required.maven.version>
-      </properties>
       <build>
         <plugins>
           <plugin>
diff --git a/readme.txt b/readme.txt
deleted file mode 100644
index 7afb4d3d06..0000000000
--- a/readme.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-Building
---------
-You need Maven 3 (at least 3.0.4) Java 8 to build Tobago 2.
-
-In the main directory you can use
-
-  mvn install
-
-to run the install target on all sub projects. This will
-put all necessary artifacts into your local repository.
-
-Demo
-----
-
-In the directory tobago-example/tobago-example-demo
-
-mvn jetty:run
diff --git a/tobago-assembly/src/main/resources/NOTICE.txt b/tobago-assembly/src/main/resources/NOTICE.txt
index b3b952af74..fcce3d2558 100644
--- a/tobago-assembly/src/main/resources/NOTICE.txt
+++ b/tobago-assembly/src/main/resources/NOTICE.txt
@@ -1,5 +1,5 @@
 Apache Tobago
-Copyright 2005-2021 The Apache Software Foundation
+Copyright 2005-2022 The Apache Software Foundation
 
 This product includes software developed by
 The Apache Software Foundation (http://www.apache.org/).
diff --git a/tobago-core/pom.xml b/tobago-core/pom.xml
index 01917fcf39..7b9f617d49 100644
--- a/tobago-core/pom.xml
+++ b/tobago-core/pom.xml
@@ -179,7 +179,7 @@
     <dependency>
       <groupId>org.codehaus.plexus</groupId>
       <artifactId>plexus-utils</artifactId>
-      <version>3.4.1</version>
+      <version>3.4.2</version>
     </dependency>
     <!--dependency>
       <groupId>com.google.caliper</groupId>
@@ -218,8 +218,8 @@
                 <phase>generate-sources</phase>
                 <configuration>
                   <!-- https://issues.apache.org/jira/browse/MCOMPILER-168 -->
-                  <source>1.6</source>
-                  <target>1.6</target>
+                  <source>1.7</source>
+                  <target>1.7</target>
                   <proc>only</proc>
                   <useIncrementalCompilation>false</useIncrementalCompilation><!-- see MCOMPILER-209 and MCOMPILER-235 -->
                   <!-- source output directory -->
diff --git a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigMerger.java b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigMerger.java
index f1adecac1f..cfd413e7e3 100644
--- a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigMerger.java
+++ b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigMerger.java
@@ -47,7 +47,7 @@ public class TobagoConfigMerger {
     // default sanitizer
     String sanitizerClass = JsoupSanitizer.class.getName();
     Properties sanitizerProperties = new Properties();
-    sanitizerProperties.setProperty("whitelist", "relaxed");
+    sanitizerProperties.setProperty("safelist", "relaxed");
 
     for (final TobagoConfigFragment fragment : list) {
 
diff --git a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParser.java b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParser.java
index ea2d56b041..f3aa031ab4 100644
--- a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParser.java
+++ b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParser.java
@@ -393,6 +393,10 @@ public class TobagoConfigParser extends TobagoConfigEntityResolver {
       case SANITIZER:
         if (properties != null) {
           tobagoConfig.setSanitizerProperties(properties);
+          if (properties.get("whitelist") != null) {
+            LOG.warn("<sanitizer><properties><entry key=\"whitelist\"> is deprecated:"
+              + " use <sanitizer><properties><entry key=\"safelist\"> instead.");
+          }
         }
         properties = null;
         break;
diff --git a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/taglib/component/package-info.java b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/taglib/component/package-info.java
index 6698e6e264..b925569b98 100644
--- a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/taglib/component/package-info.java
+++ b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/taglib/component/package-info.java
@@ -19,7 +19,7 @@
 
 /**
  * <b>Tobago Framework Component Tag Library 2.4.5 -
- * (C) Copyright 2005-2021 The Apache Software Foundation</b>
+ * (C) Copyright 2005-2022 The Apache Software Foundation</b>
  */
 @org.apache.myfaces.tobago.apt.annotation.Taglib(
     shortName = "tc",
diff --git a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/taglib/extension/package-info.java b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/taglib/extension/package-info.java
index 48188aded0..472dc3447b 100644
--- a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/taglib/extension/package-info.java
+++ b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/taglib/extension/package-info.java
@@ -19,7 +19,7 @@
 
 /**
  * <b>Tobago Framework Extension Tag Library 2.4.5 -
- * (C) Copyright 2005-2021 The Apache Software Foundation</b>
+ * (C) Copyright 2005-2022 The Apache Software Foundation</b>
  */
 @org.apache.myfaces.tobago.apt.annotation.Taglib(
     shortName = "tx",
diff --git a/tobago-core/src/main/java/org/apache/myfaces/tobago/sanitizer/JsoupSanitizer.java b/tobago-core/src/main/java/org/apache/myfaces/tobago/sanitizer/JsoupSanitizer.java
index 0112a233e6..cf8a07f5cc 100644
--- a/tobago-core/src/main/java/org/apache/myfaces/tobago/sanitizer/JsoupSanitizer.java
+++ b/tobago-core/src/main/java/org/apache/myfaces/tobago/sanitizer/JsoupSanitizer.java
@@ -20,7 +20,7 @@
 package org.apache.myfaces.tobago.sanitizer;
 
 import org.jsoup.Jsoup;
-import org.jsoup.safety.Whitelist;
+import org.jsoup.safety.Safelist;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -34,14 +34,14 @@ public class JsoupSanitizer implements Sanitizer {
 
   private static final Logger LOG = LoggerFactory.getLogger(JsoupSanitizer.class);
 
-  private Whitelist whitelist;
-  private String whitelistName;
+  private Safelist safelist;
+  private String safelistName;
 
   private boolean unmodifiable = false;
 
   public String sanitize(final String html) {
 
-    final String safe = Jsoup.clean(html, whitelist);
+    final String safe = Jsoup.clean(html, safelist);
     if (LOG.isDebugEnabled()) {
       LOG.debug("Sanitized: " + safe);
     }
@@ -57,20 +57,23 @@ public class JsoupSanitizer implements Sanitizer {
     while (enumeration.hasMoreElements()) {
       String key = enumeration.nextElement();
       if ("whitelist".equals(key)) {
-        whitelistName = configuration.getProperty(key);
-        if ("basic".equals(whitelistName)) {
-          whitelist = Whitelist.basic();
-        } else if ("basicWithImages".equals(whitelistName)) {
-          whitelist = Whitelist.basicWithImages();
-        } else if ("none".equals(whitelistName)) {
-          whitelist = Whitelist.none();
-        } else if ("relaxed".equals(whitelistName)) {
-          whitelist = Whitelist.relaxed();
-        } else if ("simpleText".equals(whitelistName)) {
-          whitelist = Whitelist.simpleText();
+        key = "safelist";
+      }
+      if ("safelist".equals(key)) {
+        safelistName = configuration.getProperty(key);
+        if ("basic".equals(safelistName)) {
+          safelist = Safelist.basic();
+        } else if ("basicWithImages".equals(safelistName)) {
+          safelist = Safelist.basicWithImages();
+        } else if ("none".equals(safelistName)) {
+          safelist = Safelist.none();
+        } else if ("relaxed".equals(safelistName)) {
+          safelist = Safelist.relaxed();
+        } else if ("simpleText".equals(safelistName)) {
+          safelist = Safelist.simpleText();
         } else {
           throw new RuntimeException(
-              "Unknown configuration value for 'whitelist' in tobago-config.xml found! value='" + whitelistName + "'");
+            "Unknown configuration value for 'safelist' in tobago-config.xml found! value='" + safelistName + "'");
         }
       } else {
         throw new RuntimeException("Unknown configuration key in tobago-config.xml found! key='" + key + "'");
@@ -78,7 +81,7 @@ public class JsoupSanitizer implements Sanitizer {
     }
 
     if (LOG.isInfoEnabled()) {
-      LOG.warn("Using whitelist '" + whitelistName + "' for sanitizing!");
+      LOG.warn("Using safelist '" + safelistName + "' for sanitizing!");
     }
   }
 
@@ -90,7 +93,6 @@ public class JsoupSanitizer implements Sanitizer {
 
   @Override
   public String toString() {
-    return getClass().getSimpleName() + " whitelist='" + whitelistName + "'";
+    return getClass().getSimpleName() + " safelist='" + safelistName + "'";
   }
-
 }
diff --git a/tobago-example/pom.xml b/tobago-example/pom.xml
index ed827ddcdc..e4526319d9 100644
--- a/tobago-example/pom.xml
+++ b/tobago-example/pom.xml
@@ -26,8 +26,16 @@
   <name>Tobago Examples</name>
   <artifactId>tobago-example</artifactId>
 
+  <properties>
+    <tobago.basedir>${project.basedir}/..</tobago.basedir>
+    <jetty.version>9.4.46.v20220331</jetty.version>
+  </properties>
+
   <modules>
-    <module>tobago-example-addressbook</module>
+    <!--disable tobago-example-addressbook because of
+    CVE-2022-22968(5.3), CVE-2022-22965(9.8), CVE-2016-1000027(9.8),
+    CVE-2022-22968(5.3), CVE-2022-22965(9.8), CVE-2016-1000027(9.8)
+    <module>tobago-example-addressbook</module>-->
     <module>tobago-example-addressbook-cdi</module>
     <module>tobago-example-blank</module>
     <module>tobago-example-data</module>
@@ -89,10 +97,17 @@
         <plugin>
           <groupId>org.eclipse.jetty</groupId>
           <artifactId>jetty-maven-plugin</artifactId>
-          <version>9.4.45.v20220203</version>
+          <version>${jetty.version}</version>
           <configuration>
             <scanIntervalSeconds>5</scanIntervalSeconds>
           </configuration>
+          <dependencies>
+            <dependency> <!-- add JAXB to run the demo with Java 11 and higher -->
+              <groupId>javax.xml.bind</groupId>
+              <artifactId>jaxb-api</artifactId>
+              <version>2.3.1</version>
+            </dependency>
+          </dependencies>
         </plugin>
       </plugins>
     </pluginManagement>
@@ -275,6 +290,9 @@
           <value>myfaces-2.3</value>
         </property>
       </activation>
+      <properties>
+        <jetty.version>10.0.9</jetty.version>
+      </properties>
       <dependencies>
         <dependency>
           <groupId>org.apache.myfaces.core</groupId>
@@ -457,7 +475,4 @@
 -->
 
   </profiles>
-  <properties>
-    <tobago.basedir>${project.basedir}/..</tobago.basedir>
-  </properties>
 </project>
diff --git a/tobago-example/tobago-example-addressbook-cdi/pom.xml b/tobago-example/tobago-example-addressbook-cdi/pom.xml
index dd9bfde200..b63a23fee5 100644
--- a/tobago-example/tobago-example-addressbook-cdi/pom.xml
+++ b/tobago-example/tobago-example-addressbook-cdi/pom.xml
@@ -30,7 +30,7 @@
   <properties>
     <openjpa.version>1.2.3</openjpa.version>
     <openwebbeans.version>1.2.8</openwebbeans.version>
-    <deltaspike.version>1.9.5</deltaspike.version>
+    <deltaspike.version>1.9.6</deltaspike.version>
     <tobago.basedir>${project.basedir}/../..</tobago.basedir>
   </properties>
   <build>
diff --git a/tobago-example/tobago-example-assembly/src/main/resources/NOTICE.txt b/tobago-example/tobago-example-assembly/src/main/resources/NOTICE.txt
index b3b952af74..fcce3d2558 100644
--- a/tobago-example/tobago-example-assembly/src/main/resources/NOTICE.txt
+++ b/tobago-example/tobago-example-assembly/src/main/resources/NOTICE.txt
@@ -1,5 +1,5 @@
 Apache Tobago
-Copyright 2005-2021 The Apache Software Foundation
+Copyright 2005-2022 The Apache Software Foundation
 
 This product includes software developed by
 The Apache Software Foundation (http://www.apache.org/).
diff --git a/tobago-example/tobago-example-demo/pom.xml b/tobago-example/tobago-example-demo/pom.xml
index 2a6eaa1270..98cf928acc 100644
--- a/tobago-example/tobago-example-demo/pom.xml
+++ b/tobago-example/tobago-example-demo/pom.xml
@@ -29,7 +29,7 @@
 
   <properties>
     <openwebbeans.version>1.2.8</openwebbeans.version>
-    <deltaspike.version>1.9.5</deltaspike.version>
+    <deltaspike.version>1.9.6</deltaspike.version>
     <tobago.basedir>${project.basedir}/../..</tobago.basedir>
   </properties>
   <build>
@@ -407,6 +407,69 @@
       </dependencies>
     </profile>
 
+    <profile>
+      <id>myfaces-2.3</id>
+      <activation>
+        <property>
+          <name>jsf</name>
+          <value>myfaces-2.3</value>
+        </property>
+      </activation>
+
+      <properties>
+        <openwebbeans.version>2.0.27</openwebbeans.version>
+      </properties>
+
+      <dependencies>
+
+        <!-- Specs -->
+        <dependency>
+          <groupId>org.apache.geronimo.specs</groupId>
+          <artifactId>geronimo-jcdi_2.0_spec</artifactId>
+          <version>1.3</version>
+        </dependency>
+        <dependency>
+          <groupId>org.apache.geronimo.specs</groupId>
+          <artifactId>geronimo-atinject_1.0_spec</artifactId>
+          <version>1.2</version>
+        </dependency>
+        <dependency>
+          <groupId>org.apache.geronimo.specs</groupId>
+          <artifactId>geronimo-validation_1.1_spec</artifactId>
+          <version>1.0</version>
+        </dependency>
+        <dependency>
+          <groupId>org.apache.geronimo.specs</groupId>
+          <artifactId>geronimo-interceptor_1.2_spec</artifactId>
+          <version>1.2</version>
+        </dependency>
+
+        <!-- OWB -->
+        <dependency>
+          <groupId>org.apache.openwebbeans</groupId>
+          <artifactId>openwebbeans-jsf</artifactId>
+          <version>${openwebbeans.version}</version>
+        </dependency>
+        <dependency>
+          <groupId>org.apache.openwebbeans</groupId>
+          <artifactId>openwebbeans-web</artifactId>
+          <version>${openwebbeans.version}</version>
+        </dependency>
+        <dependency>
+          <groupId>org.apache.openwebbeans</groupId>
+          <artifactId>openwebbeans-resource</artifactId>
+          <version>${openwebbeans.version}</version>
+        </dependency>
+
+        <!-- for JSF 2.0 and Bean Validation (JSR-303)  -->
+        <dependency>
+          <groupId>javax.el</groupId>
+          <artifactId>javax.el-api</artifactId>
+        </dependency>
+
+      </dependencies>
+    </profile>
+
     <profile>
       <id>mojarra-2.0</id>
       <activation>
diff --git a/tobago-example/tobago-example-demo/src/main/webapp/WEB-INF/tobago-config.xml b/tobago-example/tobago-example-demo/src/main/webapp/WEB-INF/tobago-config.xml
index e5aa0e84c7..9c810e2117 100644
--- a/tobago-example/tobago-example-demo/src/main/webapp/WEB-INF/tobago-config.xml
+++ b/tobago-example/tobago-example-demo/src/main/webapp/WEB-INF/tobago-config.xml
@@ -55,7 +55,7 @@
       &lt;!&ndash;
        Use one of: basic, basicWithImages, relaxed, simpleText or none
        &ndash;&gt;
-      <entry key="whitelist">relaxed</entry>
+      <entry key="safelist">relaxed</entry>
     </properties>
   </sanitizer>
 -->
diff --git a/tobago-extension/tobago-sandbox/src/main/java/org/apache/myfaces/tobago/internal/taglib/sandbox/package-info.java b/tobago-extension/tobago-sandbox/src/main/java/org/apache/myfaces/tobago/internal/taglib/sandbox/package-info.java
index 5d7245acc1..3df6f402bc 100644
--- a/tobago-extension/tobago-sandbox/src/main/java/org/apache/myfaces/tobago/internal/taglib/sandbox/package-info.java
+++ b/tobago-extension/tobago-sandbox/src/main/java/org/apache/myfaces/tobago/internal/taglib/sandbox/package-info.java
@@ -19,7 +19,7 @@
 
 /**
  * <b>Tobago Framework Sandbox Tag Library 2.4.5 -
- * (C) Copyright 2002-2021 The Apache Software Foundation</b>
+ * (C) Copyright 2002-2022 The Apache Software Foundation</b>
  *
  * <b>Warning: The sandbox tag library contains unstable components.
  * Everything is subject to change without prior notice.</b>
diff --git a/tobago-theme/tobago-theme-standard/src/test/java/org/apache/myfaces/tobago/renderkit/html/JsonUtilsUnitTest.java b/tobago-theme/tobago-theme-standard/src/test/java/org/apache/myfaces/tobago/renderkit/html/JsonUtilsUnitTest.java
index 7368797298..0081dac8cb 100644
--- a/tobago-theme/tobago-theme-standard/src/test/java/org/apache/myfaces/tobago/renderkit/html/JsonUtilsUnitTest.java
+++ b/tobago-theme/tobago-theme-standard/src/test/java/org/apache/myfaces/tobago/renderkit/html/JsonUtilsUnitTest.java
@@ -110,14 +110,17 @@ public class JsonUtilsUnitTest extends AbstractTobagoTestBase {
   public void monthNames() {
     final DateTimeI18n dateTimeI18n = DateTimeI18n.valueOf(Locale.GERMANY);
     final String marchShort = dateTimeI18n.getMonthNamesShort()[2]; // different with JDK 1.8.0_51 and 1.8.0_60
+    final String dayNames = dateTimeI18n.getDayNamesMin()[0].contains(".")
+      ? "'So.','Mo.','Di.','Mi.','Do.','Fr.','Sa.'"
+      : "'So','Mo','Di','Mi','Do','Fr','Sa'";
     final String expected
         = ("{'monthNames':['Januar','Februar','März','April','Mai','Juni',"
         + "'Juli','August','September','Oktober','November','Dezember'],"
         + "'monthNamesShort':['Jan','Feb','"
         + marchShort + "','Apr','Mai','Jun','Jul','Aug','Sep','Okt','Nov','Dez'],"
         + "'dayNames':['Sonntag','Montag','Dienstag','Mittwoch','Donnerstag','Freitag','Samstag'],"
-        + "'dayNamesShort':['So','Mo','Di','Mi','Do','Fr','Sa'],"
-        + "'dayNamesMin':['So','Mo','Di','Mi','Do','Fr','Sa'],"
+        + "'dayNamesShort':["+ dayNames +"],"
+        + "'dayNamesMin':["+ dayNames +"],"
         + "'firstDay':1}").replaceAll("'", "\"");
 
     Assert.assertEquals(expected, JsonUtils.encode(dateTimeI18n));
diff --git a/tobago-tool/tobago-theme-plugin/pom.xml b/tobago-tool/tobago-theme-plugin/pom.xml
index f95254243c..9845f41456 100644
--- a/tobago-tool/tobago-theme-plugin/pom.xml
+++ b/tobago-tool/tobago-theme-plugin/pom.xml
@@ -24,31 +24,29 @@
   </parent>
   <artifactId>tobago-theme-plugin</artifactId>
   <packaging>maven-plugin</packaging>
-  <name>Tobago Maven2 Theme Plugin</name>
+  <name>Tobago Maven Theme Plugin</name>
 
-  <!--scm>
-    <connection>scm:svn:http://svn.apache.org/repos/asf/myfaces/myfaces-build-tools/trunk/maven2-plugins/tobago-theme-plugin</connection>
-    <developerConnection>scm:svn:https://svn.apache.org/repos/asf/myfaces/myfaces-build-tools/trunk/maven2-plugins/tobago-theme-plugin</developerConnection>
-    <url>http://svn.apache.org/viewvc/myfaces/myfaces-build-tools/trunk/maven2-plugins/tobago-theme-plugin</url>
-  </scm-->
+  <properties>
+    <maven.version>3.8.5</maven.version>
+  </properties>
 
   <dependencies>
     <dependency>
       <groupId>org.apache.maven</groupId>
       <artifactId>maven-plugin-api</artifactId>
-      <version>${mavenVersion}</version>
+      <version>${maven.version}</version>
       <scope>provided</scope>
     </dependency>
     <dependency>
-      <groupId>org.apache.maven</groupId>
-      <artifactId>maven-project</artifactId>
-      <version>${mavenVersion}</version>
+      <groupId>org.apache.maven.plugin-tools</groupId>
+      <artifactId>maven-plugin-annotations</artifactId>
+      <version>3.6.4</version>
       <scope>provided</scope>
     </dependency>
     <dependency>
-    <groupId>org.apache.maven</groupId>
+      <groupId>org.apache.maven</groupId>
       <artifactId>maven-model</artifactId>
-      <version>${mavenVersion}</version>
+      <version>${maven.version}</version>
       <scope>provided</scope>
     </dependency>
     <dependency>
@@ -59,18 +57,18 @@
     <dependency>
       <groupId>org.codehaus.plexus</groupId>
       <artifactId>plexus-utils</artifactId>
-      <version>3.4.1</version>
+      <version>3.4.2</version>
     </dependency>
     <dependency>
       <groupId>org.apache.maven</groupId>
       <artifactId>maven-artifact</artifactId>
-      <version>${mavenVersion}</version>
+      <version>${maven.version}</version>
       <scope>provided</scope>
     </dependency>
     <dependency>
       <groupId>org.codehaus.plexus</groupId>
       <artifactId>plexus-compiler-api</artifactId>
-      <version>2.11.1</version>
+      <version>2.12.0</version>
     </dependency>
     <dependency>
       <groupId>org.apache.commons</groupId>
@@ -78,6 +76,7 @@
       <version>1.21</version>
     </dependency>
   </dependencies>
+
   <dependencyManagement>
     <dependencies>
       <!-- maven-core is a dependency of maven-archiver (set explicitly, because of
@@ -97,25 +96,18 @@
       </dependency>
     </dependencies>
   </dependencyManagement>
+
   <build>
-    <pluginManagement>
-      <plugins>
-        <plugin>
-          <artifactId>maven-compiler-plugin</artifactId>
-          <configuration>
-            <source>1.5</source>
-            <target>1.5</target>
-          </configuration>
-        </plugin>
-        <plugin>
-          <groupId>org.apache.maven.plugins</groupId>
-          <artifactId>maven-plugin-plugin</artifactId>
-          <version>3.6.4</version>
-        </plugin>
-      </plugins>
-    </pluginManagement>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+          <source>7</source>
+          <target>7</target>
+        </configuration>
+      </plugin>
+    </plugins>
   </build>
-  <properties>
-     <mavenVersion>2.2.1</mavenVersion>
-  </properties>
+
 </project>
diff --git a/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/AbstractThemeMojo.java b/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/AbstractThemeMojo.java
index 11f6c6eda6..87b076e372 100644
--- a/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/AbstractThemeMojo.java
+++ b/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/AbstractThemeMojo.java
@@ -20,29 +20,28 @@
 package org.apache.myfaces.tobago.maven.plugin;
 
 import org.apache.maven.plugin.AbstractMojo;
+import org.apache.maven.plugins.annotations.Parameter;
 import org.apache.maven.project.MavenProject;
 import org.codehaus.plexus.util.DirectoryScanner;
 
 import java.io.File;
 
 public abstract class AbstractThemeMojo extends AbstractMojo {
+
   /**
-   * The maven project.
-   *
-   * @parameter expression="${project}"
-   * @required
-   * @readonly
+   * The Maven project.
    */
+  @Parameter(defaultValue = "${project}", readonly = true, required = true)
   private MavenProject project;
 
   private static final String[] INCLUDES = new String[]{
-      "**"
+    "**"
   };
   private static final String[] EXCLUDES = new String[]{
-      "META-INF/**/*",
-      "**/*.properties",
-      "**/*.xml",
-      "**/*.class"
+    "META-INF/**/*",
+    "**/*.properties",
+    "**/*.xml",
+    "**/*.class"
   };
 
   public MavenProject getProject() {
diff --git a/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/IndexThemeMojo.java b/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/IndexThemeMojo.java
index c2ba65ee33..2e3af59de2 100644
--- a/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/IndexThemeMojo.java
+++ b/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/IndexThemeMojo.java
@@ -19,46 +19,41 @@
 
 package org.apache.myfaces.tobago.maven.plugin;
 
-import org.apache.maven.plugin.MojoExecutionException;
-import org.apache.maven.plugin.MojoFailureException;
+import org.apache.maven.plugins.annotations.LifecyclePhase;
+import org.apache.maven.plugins.annotations.Mojo;
+import org.apache.maven.plugins.annotations.Parameter;
 import org.codehaus.plexus.util.DirectoryScanner;
 import org.codehaus.plexus.util.FileUtils;
-import org.codehaus.plexus.util.IOUtil;
 
 import java.io.BufferedWriter;
 import java.io.File;
 import java.io.IOException;
 import java.io.StringWriter;
 
-/**
- * @goal index
- * @phase prepare-package
- */
+@Mojo(name = "index", defaultPhase = LifecyclePhase.PREPARE_PACKAGE)
 public class IndexThemeMojo extends AbstractThemeMojo {
 
   private static final char FILE_SEPARATOR = System.getProperty("file.separator").charAt(0);
   private static final boolean FILE_SEPARATOR_IS_SLASH = FILE_SEPARATOR == '/';
 
   private static final String[] EXCLUDES = new String[]{
-      "META-INF/**/*",
-      "**/*.class"
+    "META-INF/**/*",
+    "**/*.class"
   };
 
   /**
    * Directory containing the resource files that should be listed into the tobago-resources.properties.
-   *
-   * @parameter default-value="${project.build.outputDirectory}"
-   * @required
    */
+  @Parameter(defaultValue = "${project.build.outputDirectory}", required = true)
   private File outputDirectory;
 
   /**
-   * @parameter default-value="${project.build.outputDirectory}/META-INF/tobago-resource-index.txt"
-   * @required
+   * Index file.
    */
+  @Parameter(defaultValue = "${project.build.outputDirectory}/META-INF/tobago-resource-index.txt", required = true)
   private File tobagoResourcesFile;
 
-  public void execute() throws MojoExecutionException, MojoFailureException {
+  public void execute() {
     if ("pom".equalsIgnoreCase(getProject().getPackaging())) {
       getLog().info("Not creating " + tobagoResourcesFile.getName() + " as the project is a pom package");
       return;
@@ -93,10 +88,8 @@ public class IndexThemeMojo extends AbstractThemeMojo {
           getLog().error("Error creating directory " + metaInf.getName());
         }
       }
-      BufferedWriter bufferedWriter = null;
-      try {
-        final StringWriter stringWriter = new StringWriter();
-        bufferedWriter = new BufferedWriter(stringWriter);
+      final StringWriter stringWriter = new StringWriter();
+      try (BufferedWriter bufferedWriter = new BufferedWriter(stringWriter)) {
         for (final String file : fileNames) {
           bufferedWriter.append('/');
           if (FILE_SEPARATOR_IS_SLASH) {
@@ -110,8 +103,6 @@ public class IndexThemeMojo extends AbstractThemeMojo {
         FileUtils.fileWrite(tobagoResourcesFile, "utf-8", stringWriter.toString());
       } catch (final IOException e) {
         getLog().error("Error creating resource file " + tobagoResourcesFile.getName(), e);
-      } finally {
-        IOUtil.close(bufferedWriter);
       }
     } else {
       getLog().info("Skipping create resource file " + tobagoResourcesFile.getName());
@@ -127,7 +118,7 @@ public class IndexThemeMojo extends AbstractThemeMojo {
   }
 
   private static class StaleCheckDirectoryScanner extends DirectoryScanner {
-    private long lastModified;
+    private final long lastModified;
     private boolean isUp2date = true;
 
     private StaleCheckDirectoryScanner(final long lastModified) {
diff --git a/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/UnPackThemeMojo.java b/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/UnPackThemeMojo.java
index cfe538df31..e31fbbc1a6 100644
--- a/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/UnPackThemeMojo.java
+++ b/tobago-tool/tobago-theme-plugin/src/main/java/org/apache/myfaces/tobago/maven/plugin/UnPackThemeMojo.java
@@ -21,6 +21,11 @@ package org.apache.myfaces.tobago.maven.plugin;
 
 import org.apache.maven.artifact.DependencyResolutionRequiredException;
 import org.apache.maven.plugin.MojoExecutionException;
+import org.apache.maven.plugins.annotations.Component;
+import org.apache.maven.plugins.annotations.LifecyclePhase;
+import org.apache.maven.plugins.annotations.Mojo;
+import org.apache.maven.plugins.annotations.Parameter;
+import org.apache.maven.plugins.annotations.ResolutionScope;
 import org.codehaus.plexus.archiver.ArchiverException;
 import org.codehaus.plexus.archiver.UnArchiver;
 import org.codehaus.plexus.archiver.manager.ArchiverManager;
@@ -45,92 +50,72 @@ import java.util.Properties;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
 
-/**
- * @goal resources
- * @phase process-resources
- * @requiresDependencyResolution runtime
- */
+@Mojo(
+  name = "resources",
+  defaultPhase = LifecyclePhase.PROCESS_RESOURCES,
+  requiresDependencyResolution = ResolutionScope.RUNTIME)
 public class UnPackThemeMojo extends AbstractThemeMojo {
+
   /**
    * To look up Archiver/UnArchiver implementations
-   *
-   * @parameter expression="${component.org.codehaus.plexus.archiver.manager.ArchiverManager}"
-   * @required
    */
+  @Component
   private ArchiverManager archiverManager;
 
   /**
    * Directory to unpack JARs into if needed
-   *
-   * @parameter expression="${project.build.directory}/theme/work"
-   * @required
    */
+  @Parameter(defaultValue = "${project.build.directory}/theme/work", required = true)
   private File workDirectory;
 
   /**
    * The directory where the webapp is built.
-   *
-   * @parameter expression="${project.build.directory}/${project.build.finalName}"
-   * @required
    */
+  @Parameter(defaultValue = "${project.build.directory}/${project.build.finalName}", required = true)
   private File webappDirectory;
 
   /**
    * Don't use the versioned information of the themes..
-   *
-   * @parameter
    */
+  @Parameter
   private boolean ignoreVersioned;
 
 
   private String getThemeDescriptor(final File jarFile) throws MojoExecutionException {
-    ZipFile zip = null;
-    try {
-      zip = new ZipFile(jarFile);
-      final Enumeration files = zip.entries();
+    try (ZipFile zip = new ZipFile(jarFile)) {
+      final Enumeration<? extends ZipEntry> files = zip.entries();
       while (files.hasMoreElements()) {
-        final ZipEntry nextEntry = (ZipEntry) files.nextElement();
+        final ZipEntry nextEntry = files.nextElement();
         if (nextEntry == null || nextEntry.isDirectory()) {
           continue;
         }
         final String name = nextEntry.getName();
         if (name.equals("META-INF/tobago-theme.xml") || name.equals("META-INF/tobago-config.xml")) {
-          XmlStreamReader xsr = null;
-          try {
+          try (XmlStreamReader xsr = ReaderFactory.newXmlReader(zip.getInputStream(nextEntry))) {
             final StringWriter stringWriter = new StringWriter();
-            xsr = ReaderFactory.newXmlReader(zip.getInputStream(nextEntry));
             IOUtil.copy(xsr, stringWriter);
             return stringWriter.toString();
-          } finally {
-            IOUtil.close(xsr);
           }
         }
       }
     } catch (final IOException e) {
       throw new MojoExecutionException("Error find ThemeDescriptor in " + jarFile, e);
-    } finally {
-      if (zip != null) {
-        try {
-          zip.close();
-        } catch (final IOException e) {
-          // ignore
-        }
-      }
     }
+    // ignore
     return null;
   }
 
   public void execute() throws MojoExecutionException {
     try {
-      final Iterator artifacts =  getProject().getRuntimeClasspathElements().iterator();
+      final Iterator<String> artifacts = getProject().getRuntimeClasspathElements().iterator();
       if (!workDirectory.exists()) {
         workDirectory.mkdirs();
       }
       while (artifacts.hasNext()) {
 
-        final String artifact = (String) artifacts.next();
+        final String artifact = artifacts.next();
         if (getLog().isDebugEnabled()) {
-          getLog().debug("Testing jar "+ artifact);
+          getLog().debug("Testing jar " + artifact);
         }
 
         final File file = new File(artifact);
@@ -169,19 +154,17 @@ public class UnPackThemeMojo extends AbstractThemeMojo {
                           version = properties.getProperty("Implementation-Version");
                           if (version == null) {
                             getLog().error("No Implementation-Version found in Manifest-File for theme: '"
-                                + name + "'.");
+                              + name + "'.");
                           }
                         }
                       }
                     }
                   }
-                } catch (final IOException e) {
-                  getLog().error(e);
-                } catch (final XmlPullParserException e) {
+                } catch (final IOException | XmlPullParserException e) {
                   getLog().error(e);
                 }
                 if (getLog().isDebugEnabled()) {
-                  getLog().debug("Expanding theme: "+ name);
+                  getLog().debug("Expanding theme: " + name);
                   getLog().debug("Version: " + version);
                   getLog().debug("ResourcePath: " + resourcePath);
                 }
@@ -190,7 +173,7 @@ public class UnPackThemeMojo extends AbstractThemeMojo {
                   final File fromFile = new File(tempLocation, fileName);
                   String toFileName = fileName;
                   if (resourcePath != null && version != null && toFileName.startsWith(resourcePath)
-                      && !fileName.endsWith("blank.html")) {
+                    && !fileName.endsWith("blank.html")) {
                     toFileName = resourcePath + "/" + version + "/" + toFileName.substring(resourcePath.length() + 1);
                   }
                   if (getLog().isDebugEnabled()) {
@@ -216,7 +199,7 @@ public class UnPackThemeMojo extends AbstractThemeMojo {
   }
 
   private void unpack(final File file, final File location)
-      throws MojoExecutionException, NoSuchArchiverException {
+    throws MojoExecutionException, NoSuchArchiverException {
     final String archiveExt = FileUtils.getExtension(file.getAbsolutePath()).toLowerCase(Locale.ENGLISH);
     try {
       final UnArchiver unArchiver = archiverManager.getUnArchiver(archiveExt);
diff --git a/tobago-tool/tobago-theme-plugin/src/main/resources/META-INF/NOTICE.txt b/tobago-tool/tobago-theme-plugin/src/main/resources/META-INF/NOTICE.txt
index ececb8f5ee..3d5464667f 100644
--- a/tobago-tool/tobago-theme-plugin/src/main/resources/META-INF/NOTICE.txt
+++ b/tobago-tool/tobago-theme-plugin/src/main/resources/META-INF/NOTICE.txt
@@ -1,5 +1,5 @@
 Apache Tobago
-Copyright 2005-2021 The Apache Software Foundation
+Copyright 2005-2022 The Apache Software Foundation
 
 This product includes software developed by
 The Apache Software Foundation (http://www.apache.org/).
diff --git a/tobago-tool/tobago-tool-apt/pom.xml b/tobago-tool/tobago-tool-apt/pom.xml
index 210979a36e..76d2efcfc9 100644
--- a/tobago-tool/tobago-tool-apt/pom.xml
+++ b/tobago-tool/tobago-tool-apt/pom.xml
@@ -81,7 +81,7 @@
     <dependency>
       <groupId>org.codehaus.plexus</groupId>
       <artifactId>plexus-utils</artifactId>
-      <version>3.4.1</version>
+      <version>3.4.2</version>
     </dependency>
     <dependency>
       <groupId>org.antlr</groupId>