spring-cloud-starter-config maven version - spring-boot

Is it safe to use below version ?
I see below message in maven repo
Vulnerabilities from dependencies: CVE-2020-36518
<!-- https://mvnrepository.com/artifact/org.springframework.cloud/spring-cloud-starter-config -->
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-config</artifactId>
<version>3.1.1</version>
</dependency>

Related

Upgraded spring boot from 2.1.9 to 2.2.0 , now getting exception while starting

I upgraded spring boot from 2.1.9 to 2.2.0 now I am facing some exception while starting the application
java : openjdk11
spring-boot: v2.2.0.RELEASE
I tried by deleting the jar from this below location and did mvn clean install, still no luck.
.m2/repository/org/springframework/boot/spring-boot-actuator/2.2.0.RELEASE/spring-boot-actuator-2.2.0.RELEASE.jar
error :
***************************
APPLICATION FAILED TO START
***************************
Description:
An attempt was made to call a method that does not exist. The attempt was made from the following location:
org.springframework.cloud.client.discovery.health.DiscoveryCompositeHealthIndicator.<init>(DiscoveryCompositeHealthIndicator.java:41)
The following method did not exist:
org.springframework.boot.actuate.health.CompositeHealthIndicator.<init>(Lorg/springframework/boot/actuate/health/HealthAggregator;)V
The method's class, org.springframework.boot.actuate.health.CompositeHealthIndicator, is available from the following locations:
jar:file:/C:/Users/regosa/.m2/repository/org/springframework/boot/spring-boot-actuator/2.2.0.RELEASE/spring-boot-actuator-2.2.0.RELEASE.jar!/org/springframework/boot/actuate/health/CompositeHealthIndicator.class
It was loaded from the following location:
file:/C:/Users/regosa/.m2/repository/org/springframework/boot/spring-boot-actuator/2.2.0.RELEASE/spring-boot-actuator-2.2.0.RELEASE.jar
Action:
Correct the classpath of your application so that it contains a single, compatible version of org.springframework.boot.actuate.health.CompositeHealthIndicator
Pom.xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.xxxxx.business.workflow</groupId>
<artifactId>xxxxx-component-workflow-starter</artifactId>
<version>0.0.1-SNAPSHOT</version>
<packaging>jar</packaging>
<name>xxxxx-component-workflow-starter</name>
<description>xxxxx-component-workflow-starter</description>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.2.0.RELEASE</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<java.version>11</java.version>
<jaxb-runtime.version>2.4.0-b180830.0438</jaxb-runtime.version>
<spring-cloud.version>Greenwich.M1</spring-cloud.version>
<zeebe-version>0.20.1</zeebe-version>
<google-guava.version>27.0.1-jre</google-guava.version>
<xxxxx.version>1.0</xxxxx.version>
<swagger.version>2.9.2</swagger.version>
<jjwt.version>0.9.1</jjwt.version>
<json.version>20180813</json.version>
<slf4j-api.version>1.7.25</slf4j-api.version>
<mysql.version>8.0.11</mysql.version>
<mongo-java-driver.version>3.10.1</mongo-java-driver.version>
<commons-io.version>2.6</commons-io.version>
<commons-lang.version>2.6</commons-lang.version>
<commons-pool2.version>2.5.0</commons-pool2.version>
<redis.version>3.1.0</redis.version>
<velocity.version>1.7</velocity.version>
<velocity-tools.version>2.0</velocity-tools.version>
<logstash-logback-encoder.version>5.3</logstash-logback-encoder.version>
<httpclient.version>4.5.6</httpclient.version>
<jaxb-runtime.version>2.4.0-b180830.0438</jaxb-runtime.version>
<env>local</env>
</properties>
<dependencies>
<!-- Start: Spring Libraries -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-config</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-rest</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-mail</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.kafka</groupId>
<artifactId>spring-kafka</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-sleuth</artifactId>
</dependency>
<!-- End: Spring Libraries -->
<!-- Adding JAXB Runtime since it is not shipped with JDK 9+ -->
<dependency>
<groupId>org.glassfish.jaxb</groupId>
<artifactId>jaxb-runtime</artifactId>
<version>${jaxb-runtime.version}</version>
</dependency>
<!-- Start: xxxxx Libraries -->
<dependency>
<groupId>com.xxxxx</groupId>
<artifactId>xxxxx-entity</artifactId>
<version>${xxxxx.version}</version>
</dependency>
<dependency>
<groupId>com.xxxxx</groupId>
<artifactId>xxxxx-redis</artifactId>
<version>${xxxxx.version}</version>
</dependency>
<dependency>
<groupId>com.xxxxx</groupId>
<artifactId>xxxxx-mongo</artifactId>
<version>${xxxxx.version}</version>
</dependency>
<dependency>
<groupId>com.xxxxx</groupId>
<artifactId>xxxxx-util</artifactId>
<version>${xxxxx.version}</version>
</dependency>
<dependency>
<groupId>com.xxxxx.model</groupId>
<artifactId>xxxxx-model</artifactId>
<version>${xxxxx.version}</version>
</dependency>
<dependency>
<groupId>com.xxxxx.service</groupId>
<artifactId>xxxxx-common-service</artifactId>
<version>${xxxxx.version}</version>
</dependency>
<dependency>
<groupId>com.xxxxx.service</groupId>
<artifactId>xxxxx-common-messaging</artifactId>
<version>${xxxxx.version}</version>
</dependency>
<dependency>
<groupId>com.xxxxx.service</groupId>
<artifactId>xxxxx-common-security</artifactId>
<version>${xxxxx.version}</version>
</dependency>
<!-- End: xxxxx Libraries -->
<!-- Adding Zeebe client as part of the Spring Startup -->
<dependency>
<groupId>io.zeebe</groupId>
<artifactId>zeebe-client-java</artifactId>
<version>${zeebe-version}</version>
</dependency>
<!-- https://mvnrepository.com/artifact/com.google.guava/guava -->
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>${google-guava.version}</version>
</dependency>
<!-- Logstash Log Encoder -->
<dependency>
<groupId>net.logstash.logback</groupId>
<artifactId>logstash-logback-encoder</artifactId>
<version>${logstash-logback-encoder.version}</version>
</dependency>
<!-- https://mvnrepository.com/artifact/mysql/mysql-connector-java -->
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<version>${mysql.version}</version>
</dependency>
<!-- https://mvnrepository.com/artifact/org.mongodb/mongo-java-driver -->
<dependency>
<groupId>org.mongodb</groupId>
<artifactId>mongo-java-driver</artifactId>
<version>${mongo-java-driver.version}</version>
</dependency>
<!-- https://mvnrepository.com/artifact/commons-io/commons-io -->
<dependency>
<groupId>commons-io</groupId>
<artifactId>commons-io</artifactId>
<version>${commons-io.version}</version>
</dependency>
<!-- https://mvnrepository.com/artifact/commons-lang/commons-lang -->
<dependency>
<groupId>commons-lang</groupId>
<artifactId>commons-lang</artifactId>
<version>${commons-lang.version}</version>
</dependency>
<!-- https://mvnrepository.com/artifact/org.apache.commons/commons-pool2 -->
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-pool2</artifactId>
<version>${commons-pool2.version}</version>
</dependency>
<!-- https://mvnrepository.com/artifact/redis.clients/jedis -->
<dependency>
<groupId>redis.clients</groupId>
<artifactId>jedis</artifactId>
<version>${redis.version}</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
<version>${httpclient.version}</version>
</dependency>
<!-- Start: Swagger Libraries -->
<!-- https://mvnrepository.com/artifact/io.springfox/springfox-swagger2 -->
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-swagger2</artifactId>
<version>${swagger.version}</version>
</dependency>
<!-- https://mvnrepository.com/artifact/io.springfox/springfox-swagger-ui -->
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-swagger-ui</artifactId>
<version>${swagger.version}</version>
</dependency>
<!-- End: Swagger Libraries -->
<!-- Start: Spring Boot and Security Test Libraries -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<!-- End: Spring Boot and Security Test Libraries -->
</dependencies>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-dependencies</artifactId>
<version>${spring-cloud.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<build>
<finalName>xxxxx-component-workflow-starter</finalName>
<filters>
<filter>${env}-build.properties</filter>
</filters>
<resources>
<resource>
<filtering>true</filtering>
<directory>${project.basedir}/src/main/resources</directory>
</resource>
</resources>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.7.0</version>
<configuration>
<release>${java.version}</release>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<configuration>
<archive>
<manifestEntries>
<Automatic-Module-Name>com.xxxxx.business.workflow.component.starter</Automatic-Module-Name>
</manifestEntries>
</archive>
</configuration>
</plugin>
</plugins>
</build>
<repositories>
<repository>
<id>spring-milestones</id>
<name>Spring Milestones</name>
<url>https://repo.spring.io/milestone</url>
<snapshots>
<enabled>false</enabled>
</snapshots>
</repository>
</repositories>
</project>
New exception :
***************************
APPLICATION FAILED TO START
***************************
Description:
An attempt was made to call a method that does not exist. The attempt was made from the following location:
org.springframework.data.rest.core.support.UnwrappingRepositoryInvokerFactory.<init>(UnwrappingRepositoryInvokerFactory.java:57)
The following method did not exist:
org.springframework.plugin.core.PluginRegistry.of(Ljava/util/List;)Lorg/springframework/plugin/core/PluginRegistry;
The method's class, org.springframework.plugin.core.PluginRegistry, is available from the following locations:
jar:file:/C:/Users/regosa/.m2/repository/org/springframework/plugin/spring-plugin-core/1.2.0.RELEASE/spring-plugin-core-1.2.0.RELEASE.jar!/org/springframework/plugin/core/PluginRegistry.class
It was loaded from the following location:
file:/C:/Users/regosa/.m2/repository/org/springframework/plugin/spring-plugin-core/1.2.0.RELEASE/spring-plugin-core-1.2.0.RELEASE.jar
Action:
Correct the classpath of your application so that it contains a single, compatible version of org.springframework.plugin.core.PluginRegistry
***************************
APPLICATION FAILED TO START
***************************
Description:
An attempt was made to call a method that does not exist. The attempt was made from the following location:
springfox.documentation.spring.web.plugins.DocumentationPluginsManager.createContextBuilder(DocumentationPluginsManager.java:152)
The following method did not exist:
org.springframework.plugin.core.PluginRegistry.getPluginFor(Ljava/lang/Object;Lorg/springframework/plugin/core/Plugin;)Lorg/springframework/plugin/core/Plugin;
The method's class, org.springframework.plugin.core.PluginRegistry, is available from the following locations:
jar:file:/C:/Users/regosa/.m2/repository/org/springframework/plugin/spring-plugin-core/2.0.0.RELEASE/spring-plugin-core-2.0.0.RELEASE.jar!/org/springframework/plugin/core/PluginRegistry.class
It was loaded from the following location:
file:/C:/Users/regosa/.m2/repository/org/springframework/plugin/spring-plugin-core/2.0.0.RELEASE/spring-plugin-core-2.0.0.RELEASE.jar
Action:
Correct the classpath of your application so that it contains a single, compatible version of org.springframework.plugin.core.PluginRegistry
How to resolve this issue?
In short, issue is due to spring cloud and spring boot version incompatibility, spring boot 2.2.X requires Hoxton release train instead of Greenwich. See below for more info.
This issue is due to spring-cloud.version incompatibility. As per spring cloud documentation link(https://spring.io/projects/spring-cloud), below is the spring boot compatibility:
Release train Spring Boot compatibility
Release Train Boot Version
Hoxton 2.2.x
Greenwich 2.1.x
So if you are updating spring boot to 2.2.x then update to Hoxton release train for spring cloud as well i.e Hoxton.RC1(https://spring.io/blog/2019/10/25/spring-cloud-hoxton-rc1-released)
P.S: As per spring cloud Milestone page Hoxton.RELEASE in due on Nov 18, 2019 (https://github.com/spring-cloud/spring-cloud-release/milestones)
Actually springfox ist not compatible with Spring-Boot 2.2.0. It seems that springfox is dead at all.
Instead you can use: SpringDoc OpenApi
This seems to be a known issue: https://github.com/spring-cloud/spring-cloud-netflix/issues/3410
If you use Spring Cloud dependencies in your Spring Boot application make sure you have the correct Spring Cloud version on classpath! Only Spring Cloud's "Hoxton" (https://spring.io/blog/2019/08/19/spring-cloud-hoxton-m2-released) release train currently support Spring Boot 2.2.
Update your springfox-swagger version. I have upgraded springfox 2.9.2 running with boot 2.2.2
SpringFox needs version 1.2.0 version but Spring Boot 2.2.2 itself does not pull this in.So you somehow got spring-plugin-core-1.2.0.RELEASE in your classpath.Then it will work fine
As user10871691 and P3arl have already noted, the spring-plugin-core dependency is resolved with the wrong version 1.2.0.RELEASE. In order to force usage of the correct 2.0.0.RELEASE, you have to
EITHER exclude the wrong transitive dependency and specify the correct one,
OR pin (!) that dependency version in your pom.xml. This is done in the <dependenciesManagement> block, not in the <dependencies> block.
Example for Springfox 3.0.0 using version pinning in the <dependenciesManagement> block:
<spring-plugin-core.version>2.0.0.RELEASE</spring-plugin-core.version>
<springfox.version>3.0.0</springfox.version>
...
<dependencyManagement>
<dependencies>
<!-- Fix wrong resolved `spring-plugin-core` dependency version for springfox -->
<dependency>
<groupId>org.springframework.plugin</groupId>
<artifactId>spring-plugin-core</artifactId>
<version>${spring-plugin-core.version}</version>
</dependency>
<!-- API Documentation -->
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-boot-starter</artifactId>
<version>${springfox.version}</version>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<!-- API Documentation -->
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-boot-starter</artifactId>
</dependency>
</dependencies>
<springBootVersion>2.2.4.RELEASE</springBootVersion>
Supported Cloud version. Hoxton.M2
<dependencies>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-dependencies</artifactId>
<version>Hoxton.M2</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-config</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
</dependency>
...
</dependencies>
It's strange. The spring-plugin-core version should be 2.0.0, not 1.2.0. Let's upgrade it:
<!-- https://mvnrepository.com/artifact/org.springframework.plugin/spring-plugin-core -->
<dependency>
<groupId>org.springframework.plugin</groupId>
<artifactId>spring-plugin-core</artifactId>
<version>2.0.0.RELEASE</version>
</dependency>
I was also facing the same issue and after adding the updated plugin-core dependency. It is resolved now.
<dependency>
<groupId>org.springframework.plugin</groupId>
<artifactId>spring-plugin-core</artifactId>
<version>2.0.0.RELEASE</version>
</dependency>
If spring-plugin-core-1.2.0.RELEASE is not working in your project then another approach is that to use springfox-swagger with 3.0.0-SNAPSHOT version. For this version it has different repository.
Repository url : http://oss.jfrog.org/artifactory/oss-snapshot-local/
It will use #EnableSwagger2WebMvc annotation instead of #EnableSwagger2.
I upgraded to Springfox Swagger2 to 3.0.0 version and spring plugin code to 2.0.0.RELEASE version. It worked for me.
Spring Boot Version - 2.3.9.RELEASE
<dependency>
<groupId>org.springframework.plugin</groupId>
<artifactId>spring-plugin-core</artifactId>
<version>2.0.0.RELEASE</version>
</dependency>
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-swagger2</artifactId>
<version>3.0.0</version>
</dependency>
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-swagger-ui</artifactId>
<version>3.0.0</version>
</dependency>

How to stop Maven from downloading all historical versions of aws-java-sdk?

I am using Maven to download aws-java-sdk dependency for version 1.11.23, though in Maven repository I find all historical versions till most recent ones; i.e. aws-java-sdk-sqs downloaded versions (1.9.0 to 1.11.642) any idea why is that and how can I limit to only the version specified for aws-java-sdk artifact?
This "dependency loop" is a problem with some older versions of aws-lambda-java-events, which is probably a dependency of your dependency.
Try updating or your dependencies to the latest, or overriding aws-lambda-java-events to at least 2.2.7:
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-lambda-java-events</artifactId>
<version>2.2.7</version>
</dependency>
For me, After specifying the BOM of AWS SDK in the dependencyManagement section & the version I would like to use, The historical downloads were stopped. Below are my dependencies.
<dependencyManagement>
<dependencies>
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-bom</artifactId>
<version>1.10.6</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-s3</artifactId>
</dependency>
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-dynamodb</artifactId>
</dependency>
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-lambda-java-core</artifactId>
<version>1.0.0</version>
</dependency>
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-lambda-java-events</artifactId>
<version>1.0.0</version>
</dependency>
</dependencies>
I created a project (with Maven 3.5.4) with just:
<project ... >
....
<dependencies>
<dependency>
<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk</artifactId>
<version>1.11.23</version>
</dependency>
</dependencies>
</project>
All of ~/.m2/repository/com/amazonaws/* (as declared in aws-java-sdks POM) contain just the sub-directory /1.11.23.
UPDATE
To exclude dependencies of your dependencies see Introduction to the Dependency Mechanism, Transitive Dependencies:
Excluded dependencies - If project X depends on project Y, and project Y depends on project Z, the owner of project X can explicitly exclude project Z as a dependency, using the "exclusion" element.

How to override version of libraries included automatically under spring-boot-starter

I have spring-boot-starter in my POM and versions are automatically resolved by Camden dependency management system.
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-dependencies</artifactId>
<version>Camden.SR6</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<!-- Spring Boot -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter</artifactId>
</dependency>
</dependencies>
This gives me version 1.4.3.RELEASE of spring-boot-starter.
One of the jars spring boot starter includes automatically in the maven dependencies is logback-classic: 1.1.18
ch.qos.logback_logback-core version 1.1.8 has a vulnerability because of which I want to switch over to logback version 1.2
This vulnerability is explained in the link below
https://nvd.nist.gov/vuln/detail/CVE-2017-5929
Now, is there a way to override the logback version to 1.2 from what spring-boot-starter automatically resolves it to so that I am not exposed to this vulnerability ?
Based on your pom file, you can achieve this by excluding the dependency of 1.1.8 first then add the dependency of 1.2.0.
For example:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter</artifactId>
<exclusions>
<exclusion>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>1.2.0</version>
</dependency>
add properties tag in pom like this
<properties>
<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>
<start-class>org.roshan.Application</start-class>
<hibernate.version>5.2.10.Final</hibernate.version>
<liquibase.version>3.5.3</liquibase.version>
<liquibase-hibernate5.version>3.6.0</liquibase-hibernate5.version>
<httpcore.version>4.4.5</httpcore.version>
<httpclient.version>4.5.3</httpclient.version>
<docker-maven-plugin.version>0.4.13</docker-maven-plugin.version>
</properties>

Why Missing artifact?

This is part of the pom
<dependency>
<groupId>io.swagger</groupId>
<artifactId>swagger-models</artifactId>
<version>1.0.1</version>
</dependency>
<dependency>
<groupId>com.mangofactory</groupId>
<artifactId>swagger-springmvc</artifactId>
<version>1.0.2</version>
</dependency>
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-swagger-ui</artifactId>
<version>2.3.1</version>
</dependency>
An it is creating some files in the local repository but not the jar
those are the files created for swagger-models
m2e-lastUpdated.properties
swagger-models-1.0.1.jar.lastUpdated
swagger-models-1.0.1.pom.lastUpdated
swagger-models-1.0.1-sources.jar.lastUpdated
There is no swagger-models version 1.x. the io.swagger / swagger-models artifact was introduced in 1.5.0--you should be using 1.5.7

How can I build a Gradle plugin with Maven

It's possible to build a Gradle plugin with Maven. Which dependencies are needed?
Yes, it's possible. We do so with Spring Boot's Gradle plugin using these dependencies:
<dependency>
<groupId>org.codehaus.groovy</groupId>
<artifactId>groovy</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.gradle</groupId>
<artifactId>gradle-core</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.gradle</groupId>
<artifactId>gradle-base-services</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.gradle</groupId>
<artifactId>gradle-base-services-groovy</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.gradle</groupId>
<artifactId>gradle-plugins</artifactId>
<scope>provided</scope>
</dependency>
Groovy's in Maven Central, but the Gradle dependencies are in their own repo: http://repo.gradle.org/gradle/libs-releases-local

Resources