[WP11] Build config & dependency hygiene: unpinned plugins, no Maven update lane, EOL Boot line, jar build-info pollution

[shihyuho]

此內容由 AI 產生（specification-mapper 全庫審查 2026-07-16．執行圖）。

Work package WP11 · findings: DEP-03, DEP-01, DEP-04, COR-03 · worst severity: medium · effort: M

From the 2026-07-16 whole-codebase review of branch jakarta (snapshot 7de4a33; modules mapper/ + starter/). Every finding below is CONFIRMED by independent adversarial verification. File:line coordinates are from the snapshot and may have drifted.

Findings

DEP-03 — spring-boot-maven-plugin and native-maven-plugin have no pinned version, currently resolving to Boot 4.1.0 against the 3.5.15 BOM (dependencies, medium)

• File: mapper/pom.xml:83

DEP-01 — No automated update lane for any Maven dependency or plugin except spring-boot.version (dependencies, medium)

• File: .github/dependabot.yml:5
• Evidence: dependabot covers github-actions only; the gpg plugin is ~5 years stale, confirming the gap.

DEP-04 — Spring Boot 3.5.x baseline is at/past OSS end-of-support and the auto-bump lane is capped at ~3.x (dependencies, medium)

• File: pom.xml:63
• Note: this carries a strategic Boot-4 decision the maintainer owns (see Plan step 4).

COR-03 — Library jar ships META-INF/build-info.properties, hijacking consumers' BuildProperties / /actuator/info (correctness, medium)

• File: mapper/pom.xml:87
• Evidence: the build-info goal generates build metadata into the published jar; a consumer app then resolves the library's build-info instead of its own for /actuator/info.

Plan

1. DEP-03: pin spring-boot-maven-plugin and native-maven-plugin to ${spring-boot.version} (via pluginManagement), so the build tooling tracks the same Boot line as the BOM instead of floating to 4.x.
2. COR-03: remove the build-info execution from mapper/pom.xml (nothing in the library reads it), so the published jar stops carrying build-info.properties.
3. DEP-01: add a package-ecosystem: maven entry to .github/dependabot.yml covering the root and both module POMs, so plugins/dependencies get an update lane.
4. DEP-04 (bounded decision noted, not blocking steps 1–3): the maintainer decides the Boot-line strategy — stay on a supported 3.x line, or move to Boot 4 — and the auto-bump cap (~3.x) is updated to match. This package delivers steps 1–3 regardless; step 4 is a one-line follow-up once the strategy is set.

Acceptance criteria

• mvn help:effective-pom shows the two plugins pinned to the Boot line, not 4.x.
• The built library jar no longer contains META-INF/build-info.properties.
• dependabot.yml has a maven ecosystem entry.
• Regression: make test green.