Update repo URL

Setting it before the npx command does

.github/actions/ssh/action.yml

@@ -0,0 +1,42 @@
+name: SSH setup
+description: Set up the SSH agent
+
+inputs:
+  config:
+    description: The SSH configuration
+    required: true
+  key:
+    description: The private SSH key
+    required: true
+  known-hosts:
+    description: The list of known hosts
+    required: true
+
+runs:
+  using: composite
+
+  steps:
+    - name: Configure SSH
+      shell: sh
+      env:
+        CONFIG: ${{ inputs.config }}
+        KNOWN_HOSTS: ${{ inputs.known-hosts }}
+      run: |
+        mkdir -p ~/.ssh
+        echo "${CONFIG}" > ~/.ssh/config
+        echo "${KNOWN_HOSTS}" > ~/.ssh/known_hosts
+
+    - name: Start SSH agent
+      shell: bash
+      env:
+        SOCKET: /tmp/ssh-agent.sock
+      run: |
+        echo "SSH_AUTH_SOCK=${SOCKET}" >> $GITHUB_ENV
+        ssh-agent -a ${SOCKET} > /dev/null
+
+    - name: Add SSH key
+      shell: bash
+      env:
+        KEY: ${{ inputs.key }}
+      run: |
+        ssh-add - <<< "${KEY}"

.github/workflows/build.yml

@@ -0,0 +1,22 @@
+name: Build
+
+on:
+  push:
+    paths:
+      - .github/workflows/build.yml
+      - build.gradle
+      - settings.gradle
+      - src/**
+      - launcher/build.gradle
+      - launcher/src/**
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: antville
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compile with Gradle
+        run: ./gradlew :compileJava

.github/workflows/deploy.yml

@@ -0,0 +1,15 @@
+name: Deploy (Production)
+
+on: workflow_dispatch
+
+jobs:
+  deploy:
+    runs-on: antville
+
+    environment:
+      name: antville.org
+      url: https://antville.org
+
+    steps:
+      - name: Copy files to production server
+        run: ssh staging-server deploy-helma

.github/workflows/release.yml

@@ -0,0 +1,59 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    tags: '2*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: antville
+
+    env:
+      GH_TOKEN: ${{ secrets.GH_TOKEN }}
+      LC_TIME: en_US.UTF-8
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create release notes
+        id: create_release_notes
+        run: |
+          release_notes=$(npx git-cliff@latest --latest)
+          # Write the release notes as a heredoc to the workflow output
+          # ⚠️ No white space around `<<` is crucial!
+          echo "release_notes<<.eot0x03" >> $GITHUB_OUTPUT
+          echo "$release_notes" >> $GITHUB_OUTPUT
+          echo ".eot0x03" >> $GITHUB_OUTPUT
+
+      - name: Build with Gradle
+        run: ./gradlew assembleDist
+
+      - name: Create release
+        uses: actions/forgejo-release@v2
+        with:
+          direction: upload
+          url: https://code.host.antville.org
+          token: ${{ github.token }}
+          title: Helma ${{ github.ref_name }}
+          release-dir: build/distributions
+          release-notes: ${{ steps.create_release_notes.outputs.release_notes }}
+          verbose: true
+
+      - name: Create release at GitHub
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "Helma ${{ github.ref_name }}" \
+            --notes "${{ steps.create_release_notes.outputs.release_notes }}"
+
+      - name: Upload release assets to GitHub
+        run: |
+          gh release upload "$GITHUB_REF_NAME" build/distributions/helma-*.* \
+            --repo "$GITHUB_REPOSITORY" \
+            --clobber

.github/workflows/renovate.yml

@@ -0,0 +1,44 @@
+name: Run Renovate
+
+on:
+  schedule:
+    - cron: "13 * * * *"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: antville
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Renovate
+        # See <https://docs.renovatebot.com/troubleshooting/#log-debug-levels>
+        # debug | info | warn | error | fatal
+        run: LOG_LEVEL=info npx renovate
+        env:
+          # Renovate is using this token to retrieve release notes
+          GITHUB_COM_TOKEN: ${{ secrets.renovate_github_com_token }}
+          # Autodiscover is better suited for an extra repo running Renovate on all desired repos
+          #RENOVATE_AUTODISCOVER: 'true'
+          RENOVATE_CONFIG_FILE: renovate.json
+          RENOVATE_ENDPOINT: ${{ github.api_url }}
+          RENOVATE_GIT_AUTHOR: Renovate Bot <mail+renovate@antville.org>
+          #RENOVATE_GIT_IGNORED_AUTHORS:
+          #  - 29139614+renovate[bot]@users.noreply.github.com
+          RENOVATE_IGNORE_PR_AUTHOR: 'true'
+          RENOVATE_LOG_FILE: renovate-log.ndjson
+          RENOVATE_LOG_FILE_LEVEL: debug
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_REPOSITORY_CACHE: 'enabled'
+          # github.token is not working here, it lacks some permissions required by Renovate
+          RENOVATE_TOKEN: ${{ secrets.renovate_token }}
+
+      - name: Save log file
+        # FIXME: v4 of this action causes an error on Forgejo (“You must configure a GitHub token”)
+        uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: renovate-log.ndjson
+          path: renovate-log.ndjson

.github/workflows/stage.yml

@@ -0,0 +1,32 @@
+name: Deploy (Staging)
+
+on: workflow_dispatch
+
+jobs:
+  stage:
+    runs-on: antville
+
+    environment:
+      name: stage
+      url: ${{ vars.stage_url }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build with Gradle
+        run: ./gradlew installDist
+
+      - name: Publish to staging server
+        run: |
+          rsync ./build/install/helma/ staging-server:./ \
+            --verbose --archive --delete --compress \
+            --filter '+ /bin' \
+            --filter '+ /extras' \
+            --filter '+ /launcher.jar' \
+            --filter '- /lib/ext' \
+            --filter '+ /lib' \
+            --filter '+ /modules' \
+            --filter '- /*'
+
+      - name: Restart Helma
+        run: ssh staging-server restart

.gitignore

@@ -1,4 +1,5 @@
 .gradle
+.idea
 .settings
 build
 

.java-version

@@ -0,0 +1 @@
+11.0

.vscode/extensions.json

@@ -0,0 +1,6 @@
+{
+    "recommendations": [
+        "vscjava.vscode-java-pack",
+        "vscjava.vscode-gradle"
+    ]
+}

.vscode/settings.json

@@ -0,0 +1,6 @@
+{
+	"files.watcherExclude": {
+		"apps/": true
+	},
+	"java.configuration.updateBuildConfiguration": "automatic"
+}

LICENSE.md

@@ -1,6 +1,6 @@
 # License
 
-Copyright (c) 1999-2008 Helma Project. All rights reserved.
+Copyright (c) 1999-2025 Helma Project. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions

README.md

@@ -2,8 +2,8 @@
 
 ## TL;DR
 
-- Make sure you have Java 1.6 or higher installed
-- Download and unpack the [latest release](https://github.com/antville/helma/releases)
+- Make sure you have Java 11 or higher installed
+- Download and unpack the [latest release](https://code.host.antville.org/antville/helma/releases)
 - Invoke `./bin/helma`, resp. `./bin/helma.bat`, depending on your platform
 - Direct your web browser to <http://localhost:8080>
 
@@ -21,7 +21,7 @@ Although Helma became a Grande Dame of server-side JavaScript already decades ag
 
 ## System Requirements
 
-You need a Java virtual machine 1.6 or higher to run Helma.
+You need a Java virtual machine version 11 or higher to run Helma.
 
 Please consult the documentation of your platform how to obtain and install Java.
 
@@ -31,7 +31,14 @@ Helma is built with [Gradle](https://gradle.org), the build task depends on the
 
 ## Development
 
-Clone this repository to your machine and start the build process with `./gradlew install`. The build script is going to ask you if you want to update the installation, enter `y`.
+### Additional Prerequisites
+
+* [Node.js](https://nodejs.org) LTS version
+* [Rsync](https://rsync.samba.org) version ≥ 3.1.0
+
+Clone this repository to your machine and run Helma with `./gradlew run`.
+
+To update the installation from a build, run `./gradlew update` and enter `yes` at the prompt.
 
 > ⚠️    
 > Please be aware that this step is going to overwrite files in the installation directory – escpecially at a later time when there might be substantial changes. Should this happen by accident you find the previous installation in the `backups` directory.
@@ -40,7 +47,7 @@ Clone this repository to your machine and start the build process with `./gradle
 
 After all files are put into place start Helma by invoking `./bin/helma.bat` or `./bin/helma`, depending on whether you are on Windows or Linux / Unix / OS X, respectively. If the `java` command is not found, try setting the `JAVA_HOME` environment variable to the location of your Java installation.
 
-You can adjust server-wide settings in the `server.properties` file. For example, you could set the `smtp` property to the name of the SMTP server that Helma should use to send e-mail. Applications can be started or stopped by editing the `apps.properties` file through the web interface using the management application that is part of Helma.
+You can adjust server-wide settings in the `server.properties` file. For example, you could set the `smtp` property to the name of the SMTP server that Helma should use to send e-mail. Applications can be started or stopped by editing the `apps.properties` file, or through the web interface using the management application that is part of Helma.
 
 If all goes well you should be able to connect your browser to <http://localhost:8080> – port 8080 on the local machine, that is.
 
@@ -55,7 +62,7 @@ Finally, Helma can be plugged into Servlet containers using Servlet classes that
 After installing and running Helma, you will be able to access introductions to the features of Helma and the various included development tools. Further information you will find on the helma.org website:
 
 > 😿  
-> Unfortunately, the Helma website disappeard in the meantime. However, with some archeological web digging and thanks to the great search engines and archive services out there it is still possible to find useful resources.
+> Unfortunately, the Helma website disappeard in the meantime. However, with some archaeological web digging and thanks to the great search engines and archive services out there it is still possible to find useful resources.
 
 - [helma.org at Internet Archive](http://web.archive.org/web/20180122132315/http://helma.org)
 - [Documentation](http://web.archive.org/web/20100530234322/http://helma.org/documentation/)

build.gradle

@@ -1,6 +1,6 @@
 plugins {
   id 'application'
-  id 'com.github.jk1.dependency-license-report' version '1.13'
+  id 'com.github.jk1.dependency-license-report' version '2.9'
 }
 
 import org.apache.tools.ant.filters.FixCrLfFilter
@@ -17,17 +17,31 @@ def textFiles = ['**/*.hac', '**/.html', '**/*.js', '**/*.md', '**/*.properties'
 allprojects {
   apply plugin: 'java'
 
-  compileJava {
-    sourceCompatibility = JavaVersion.VERSION_1_6
-    targetCompatibility = JavaVersion.VERSION_1_6
+  java {
+    sourceCompatibility = JavaVersion.VERSION_11
+    targetCompatibility = JavaVersion.VERSION_11
+  }
+
+  repositories {
+    mavenCentral()
   }
 }
 
-version = new Date().format("yyyyMMdd")
+version = new Date().format("yy.M.d")
 
 tasks.build.dependsOn javadoc, 'jsdoc', 'generateLicenseReport'
 tasks.compileJava.dependsOn 'processSource'
 
+// Disable DocLint for now
+// See <https://blog.joda.org/2014/02/turning-off-doclint-in-jdk-8-javadoc.html>
+if (JavaVersion.current().isJava8Compatible()) {
+  allprojects {
+    tasks.withType(Javadoc) {
+      options.addStringOption('Xdoclint:none', '-quiet')
+    }
+  }
+}
+
 sourceSets {
   main {
     java {
@@ -37,11 +51,6 @@ sourceSets {
   }
 }
 
-repositories {
-  mavenCentral()
-  jcenter()
-}
-
 configurations {
   // Wrapping implementation because it does not allow access to its files
   // (i.e. cannot be resolved)
@@ -49,19 +58,19 @@ configurations {
 }
 
 dependencies {
-  implementation 'com.google.code.gson:gson:2.8.6'
-  implementation 'com.sun.activation:javax.activation:1.2.0'
-  implementation 'commons-codec:commons-codec:1.14'
-  implementation 'commons-fileupload:commons-fileupload:1.4'
-  implementation 'commons-logging:commons-logging:1.2'
-  implementation 'commons-net:commons-net:3.6'
+  implementation 'com.google.code.gson:gson:2.12.1'
+  implementation 'commons-codec:commons-codec:1.18.0'
+  implementation 'commons-fileupload:commons-fileupload:1.5'
+  implementation 'commons-logging:commons-logging:1.3.5'
+  implementation 'commons-net:commons-net:3.11.1'
   implementation 'com.sun.mail:javax.mail:1.6.2'
   implementation 'javax.servlet:javax.servlet-api:4.0.1'
   implementation 'org.ccil.cowan.tagsoup:tagsoup:1.2.1'
-  implementation 'org.eclipse.jetty:jetty-servlet:9.4.27.v20200227'
-  implementation 'org.eclipse.jetty:jetty-xml:9.4.27.v20200227'
-  implementation 'org.mozilla:rhino:1.7.12'
-  implementation 'xerces:xercesImpl:2.12.0'
+  implementation 'org.eclipse.jetty:jetty-servlet:9.4.57.v20241219'
+  implementation 'org.eclipse.jetty:jetty-xml:9.4.57.v20241219'
+  implementation 'org.mozilla:rhino-all:1.8.0'
+  implementation 'org.sejda.imageio:webp-imageio:0.1.6'
+  implementation 'xerces:xercesImpl:2.12.2'
   implementation 'xmlrpc:xmlrpc:2.0.1'
 }
 
@@ -69,31 +78,13 @@ def rhinoJar = configurations.library.files.find { jar ->
   jar.name.startsWith('rhino')
 }
 
-
-startScripts {
-  applicationName = 'helma'
-  classpath = files('../launcher.jar')
-  mainClassName = 'helma.main.launcher.Main'
-
-  defaultJvmOpts = [jettyLogLevel, suppressMacosDockIcon]
-
-  doLast {
-    // Work-around to make the classpath above work (launcher.jar is located outside of `lib` dir)
-    // See https://discuss.gradle.org/t/classpath-in-application-plugin-is-building-always-relative-to-app-home-lib-directory/2012
-    def unixScriptFile = file getUnixScript()
-    def windowsScriptFile = file getWindowsScript()
-    unixScriptFile.text = unixScriptFile.text.replace('$APP_HOME/lib', '$APP_HOME')
-    windowsScriptFile.text = windowsScriptFile.text.replace('%APP_HOME%\\lib', '%APP_HOME%')
-  }
+run {
+  jvmArgs jettyLogLevel, suppressMacosDockIcon
+  classpath += fileTree(dir: 'lib/ext', include: '*.jar')
 }
 
-distributions {
-  main {
-    contents {
-      from project(':launcher').jar
-    }
-  }
-}
+application {
+  mainClass = 'helma.main.Server'
 
   applicationDistribution.from(projectDir) {
     include 'modules/**'
@@ -116,8 +107,36 @@ applicationDistribution.from("${project.buildDir}/reports/dependency-license") {
     include '**'
     into 'licenses'
   }
+}
+
+startScripts {
+  applicationName = 'helma'
+  classpath = files('../launcher.jar')
+  mainClass = 'helma.main.launcher.Main'
+
+  defaultJvmOpts = [jettyLogLevel, suppressMacosDockIcon]
+
+  doLast {
+    // Work-around to make the classpath above work (launcher.jar is located outside of `lib` dir)
+    // See https://discuss.gradle.org/t/classpath-in-application-plugin-is-building-always-relative-to-app-home-lib-directory/2012
+    def unixScriptFile = file getUnixScript()
+    def windowsScriptFile = file getWindowsScript()
+    unixScriptFile.text = unixScriptFile.text.replace('$APP_HOME/lib', '$APP_HOME')
+    windowsScriptFile.text = windowsScriptFile.text.replace('%APP_HOME%\\lib', '%APP_HOME%')
+  }
+}
+
+distributions {
+  main {
+    contents {
+      from project(':launcher').jar
+    }
+  }
+}
 
 distTar {
+  dependsOn ':generateLicenseReport', ':javadoc', ':jsdoc'
+
   compression = Compression.GZIP
 
   filesMatching(textFiles) {
@@ -126,6 +145,8 @@ distTar {
 }
 
 distZip {
+  dependsOn ':generateLicenseReport', ':javadoc', ':jsdoc'
+
   filesMatching(textFiles) {
     filter(FixCrLfFilter.class, eol: FixCrLfFilter.CrLf.newInstance("crlf"))
   }
@@ -133,44 +154,36 @@ distZip {
 
 installDist {
   dependsOn build
-  finalizedBy 'update'
 }
 
-run {
-  classpath = files('launcher.jar')
-  jvmArgs jettyLogLevel, suppressMacosDockIcon
-}
-
-task processSource(type: Sync) {
-  def date = new Date().format("MMMM dd, yyyy")
+tasks.register('processSource', Sync) {
   def gitOutput = new ByteArrayOutputStream()
 
   exec {
-    commandLine 'git', 'describe'
+    commandLine 'git', 'rev-parse', '--short', 'HEAD'
     standardOutput = gitOutput
     errorOutput = new ByteArrayOutputStream()
     ignoreExitValue = true
   }
 
-  def description = date
-  def tag = gitOutput.toString().trim()
-
-  // TODO: Implement extended description in Java code
-  if (tag) description = "$tag; $description"
-
   from 'src'
 
   filter {
-    line -> line.replaceAll('__builddate__', date)
+    line -> line
+      .replaceAll('__builddate__', new Date().format("d MMM yyyy"))
+      .replaceAll('__commithash__', gitOutput.toString().trim())
+      .replaceAll('__version__', version)
   } into "${project.buildDir}/src"
 }
 
-task update {
-  def rsyncArgs = ['-a', '--info=progress2', '--exclude', 'backups']
+tasks.register('update') {
+  dependsOn installDist
+
+  def rsyncArgs = ['--archive', '--filter', '- backups']
 
   def confirm = {
-    ant.input(message: 'Update this installation?', validargs: 'y,n', addproperty: 'continue')
-    return ant.continue == 'y'
+    ant.input(message: 'Update this installation?', validargs: 'yes,no', addproperty: 'continue')
+    return ant.continue == 'yes'
   }
 
   onlyIf { confirm() }
@@ -181,26 +194,35 @@ task update {
     mkdir backupDir
 
     exec {
-      // Using rsync instead of a CopyTask because the latter chokes on multi-byte characters
+      // Create a backup with rsync instead of a CopyTask because the latter chokes on multi-byte characters
       // See https://github.com/gradle/gradle/issues/789
       executable 'rsync'
       args rsyncArgs
       args "$projectDir/", backupDir
     }
+
+    print "Created backup of ${projectDir} in ${backupDir}"
   }
 
   doLast {
     exec {
-      // Using rsync instead of installDist task because it does not overwrite the project directory
+      // Using rsync to selectively update the repo directory
       executable 'rsync'
+      args '--delete'
       args rsyncArgs
-      args '--exclude', 'bin'
+      args '--filter', '+ bin/***'
+      args '--filter', '+ docs/***'
+      args '--filter', '+ extras/***'
+      args '--filter', '+ launcher.jar'
+      args '--filter', '+ lib'
+      args '--filter', '+ *.jar'
+      args '--filter', '- *'
       args "${installDist.destinationDir}/", projectDir
     }
   }
 }
 
-task jsdoc(type: Exec) {
+tasks.register('jsdoc', Exec) {
   description 'Generates JSDoc API documentation for the included JavaScript modules.'
   group 'Documentation'
 
@@ -212,19 +234,14 @@ task jsdoc(type: Exec) {
 
   executable 'npx'
   args = ['jsdoc', '-d', "$destination"].plus(sources)
-
-  // As of writing jsdoc throws the following error:
-  // Unable to parse /home/tobi/Projects/helma/current/modules/jala/code/Database.js: Unexpected token, expected "(" (844:10)
-  // Seems to be related to the `for each` syntax but did not find any further references.
-  ignoreExitValue true
 }
 
-task xgettext(type: JavaExec) {
+tasks.register('xgettext', JavaExec) {
   description 'Extracts translatable message strings from source code.'
   group 'i18n'
 
   classpath = files('launcher.jar')
-  main = 'helma.main.launcher.Commandline'
+  mainClass = 'helma.main.launcher.Commandline'
 
   // TODO: Decouple from Antville app
   args = [
@@ -236,12 +253,12 @@ task xgettext(type: JavaExec) {
   ]
 }
 
-task po2js(type: JavaExec) {
+tasks.register('po2js', JavaExec) {
   description 'Converts translated message strings from PO format to JavaScript.'
   group 'i18n'
 
   classpath = files(rhinoJar)
-  main = 'org.mozilla.javascript.tools.shell.Main'
+  mainClass = 'org.mozilla.javascript.tools.shell.Main'
 
   // TODO: Decouple from Antville app
   args = [
@@ -251,23 +268,31 @@ task po2js(type: JavaExec) {
   ]
 }
 
-task rhinoShell(type: JavaExec) {
+tasks.register('rhinoShell', JavaExec) {
   description 'Runs the interactive Rhino JavaScript shell.'
   group 'Application'
 
   classpath = files(rhinoJar)
-  main = 'org.mozilla.javascript.tools.shell.Main'
+  mainClass = 'org.mozilla.javascript.tools.shell.Main'
 
   standardInput = System.in
 }
 
 // Call this task with a function definition using the `-P` parameter, e.g.
 // `./gradlew commandLine -Pfunction=manage.getAllApplications`
-task commandLine(type: JavaExec) {
+tasks.register('commandLine', JavaExec) {
   description 'Runs a function in a Helma application with `-Pfunction=app.functionName`.'
   group 'Application'
 
   classpath = files('launcher.jar')
-  main = 'helma.main.launcher.Commandline'
+  mainClass = 'helma.main.launcher.Commandline'
   args '-h', projectDir, function
 }
+
+tasks.register('debug', JavaExec) {
+  group = 'application'
+  main = 'helma.main.Server'
+  classpath = sourceSets.main.runtimeClasspath
+  jvmArgs = ['-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005']
+  classpath += fileTree(dir: 'lib/ext', include: '*.jar')
+}

cliff.toml

@@ -0,0 +1,52 @@
+# git-cliff ~ default configuration file
+# https://git-cliff.org/docs/configuration
+#
+# Lines starting with "#" are comments.
+# Configuration options are organized into tables and keys.
+# See documentation for more information on available options.
+
+[changelog]
+trim = true
+
+header = "## Changes"
+
+body = """
+{% for group, commits in commits | filter(attribute="merge_commit") | group_by(attribute="group") %}
+  ### {{ group | striptags | trim | upper_first }}
+  {% for commit in commits %}
+    * [<tt>{{ commit.id | split(pat="") | slice(end=11) | join() }}</tt>]\
+      (https://code.host.antville.org/antville/helma/commit/{{ commit.id }}) \
+      {% if commit.breaking %}**Breaking:** {% endif %}\
+      {{ commit.message | split(pat="\\n") | first | upper_first | escape }}\
+  {% endfor %}
+{% endfor %}
+
+**Full Changelog:** [{{ previous.version }} → {{ version }}]\
+(https://code.host.antville.org/antville/helma/compare/\
+{{ previous.version | urlencode }}..{{ version | urlencode }})\n\n
+"""
+
+footer = """
+Generated by [git-cliff](https://git-cliff.org/).
+"""
+
+[git]
+conventional_commits = false
+filter_commits = false
+filter_unconventional = false
+protect_breaking_commits = false
+sort_commits = "newest"
+split_commits = false
+topo_order = false
+
+commit_parsers = [
+  { message = "^Apply \\d+ suggestion", skip = true },
+  { message = "^Merge .*(branch|dependabot|dependency|renovate)", skip = true },
+  { message = "^Lock file maintenance", skip = true },
+  { message = "yarn\\.lock", skip = true },
+
+  { message = "^[Ff]ix", group = "<!-- 0 --> 🐛 Bug Fixes" },
+  { field = "author.name", pattern = "[Rr]enovate|[Dd]ependabot", group = "<!-- 3 --> 📦 Dependency Updates" },
+  { message = "^Merge pull request", group = "<!-- 1 --> 🔀 Merges" },
+  { message = ".*", group = "<!-- 2 --> Uncategorized" },
+]

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,7 @@
-distributionUrl=https\://services.gradle.org/distributions/gradle-6.2.2-bin.zip
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-zipStorePath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.12.1-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists

gradlew

@@ -1,78 +1,129 @@
-#!/usr/bin/env sh
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
 
 ##############################################################################
-##
-##  Gradle start up script for UN*X
-##
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
 ##############################################################################
 
 # Attempt to set APP_HOME
+
 # Resolve links: $0 may be a link
-PRG="$0"
-# Need this for relative symlinks.
-while [ -h "$PRG" ] ; do
-    ls=`ls -ld "$PRG"`
-    link=`expr "$ls" : '.*-> \(.*\)$'`
-    if expr "$link" : '/.*' > /dev/null; then
-        PRG="$link"
-    else
-        PRG=`dirname "$PRG"`"/$link"
-    fi
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
 done
-SAVED="`pwd`"
-cd "`dirname \"$PRG\"`/" >/dev/null
-APP_HOME="`pwd -P`"
-cd "$SAVED" >/dev/null
 
-APP_NAME="Gradle"
-APP_BASE_NAME=`basename "$0"`
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS=""
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD="maximum"
+MAX_FD=maximum
 
 warn () {
     echo "$*"
-}
+} >&2
 
 die () {
     echo
     echo "$*"
     echo
     exit 1
-}
+} >&2
 
 # OS specific support (must be 'true' or 'false').
 cygwin=false
 msys=false
 darwin=false
 nonstop=false
-case "`uname`" in
-  CYGWIN* )
-    cygwin=true
-    ;;
-  Darwin* )
-    darwin=true
-    ;;
-  MINGW* )
-    msys=true
-    ;;
-  NONSTOP* )
-    nonstop=true
-    ;;
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
 esac
 
 CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
 
+
 # Determine the Java command to use to start the JVM.
 if [ -n "$JAVA_HOME" ] ; then
     if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
         # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD="$JAVA_HOME/jre/sh/java"
+        JAVACMD=$JAVA_HOME/jre/sh/java
     else
-        JAVACMD="$JAVA_HOME/bin/java"
+        JAVACMD=$JAVA_HOME/bin/java
     fi
     if [ ! -x "$JAVACMD" ] ; then
         die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
@@ -81,92 +132,120 @@ Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
 else
-    JAVACMD="java"
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
+fi
 
 # Increase the maximum file descriptors if we can.
-if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
-    MAX_FD_LIMIT=`ulimit -H -n`
-    if [ $? -eq 0 ] ; then
-        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
-            MAX_FD="$MAX_FD_LIMIT"
-        fi
-        ulimit -n $MAX_FD
-        if [ $? -ne 0 ] ; then
-            warn "Could not set maximum file descriptor limit: $MAX_FD"
-        fi
-    else
-        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
-    fi
-fi
-
-# For Darwin, add options to specify how the application appears in the dock
-if $darwin; then
-    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
-fi
-
-# For Cygwin, switch paths to Windows format before running java
-if $cygwin ; then
-    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
-    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
-    JAVACMD=`cygpath --unix "$JAVACMD"`
-
-    # We build the pattern for arguments to be converted via cygpath
-    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
-    SEP=""
-    for dir in $ROOTDIRSRAW ; do
-        ROOTDIRS="$ROOTDIRS$SEP$dir"
-        SEP="|"
-    done
-    OURCYGPATTERN="(^($ROOTDIRS))"
-    # Add a user-defined pattern to the cygpath arguments
-    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
-        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
-    fi
-    # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    i=0
-    for arg in "$@" ; do
-        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
-        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
-
-        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
-            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
-        else
-            eval `echo args$i`="\"$arg\""
-        fi
-        i=$((i+1))
-    done
-    case $i in
-        (0) set -- ;;
-        (1) set -- "$args0" ;;
-        (2) set -- "$args0" "$args1" ;;
-        (3) set -- "$args0" "$args1" "$args2" ;;
-        (4) set -- "$args0" "$args1" "$args2" "$args3" ;;
-        (5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
-        (6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
-        (7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
-        (8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
-        (9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
 fi
 
-# Escape application args
-save () {
-    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
-    echo " "
-}
-APP_ARGS=$(save "$@")
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
 
-# Collect all arguments for the java command, following the shell quoting and substitution rules
-eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
 
-# by default we should be in the correct project dir, but when run from Finder on Mac, the cwd is wrong
-if [ "$(uname)" = "Darwin" ] && [ "$HOME" = "$PWD" ]; then
-  cd "$(dirname "$0")"
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
 fi
 
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
 exec "$JAVACMD" "$@"

gradlew.bat

@@ -1,3 +1,21 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
 @if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
 @rem
@@ -10,24 +28,28 @@ if "%OS%"=="Windows_NT" setlocal
 
 set DIRNAME=%~dp0
 if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
 set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
 
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
 @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS=
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
 
 @rem Find java.exe
 if defined JAVA_HOME goto findJavaFromJavaHome
 
 set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
-if "%ERRORLEVEL%" == "0" goto init
+if %ERRORLEVEL% equ 0 goto execute
 
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
@@ -35,48 +57,36 @@ goto fail
 set JAVA_HOME=%JAVA_HOME:"=%
 set JAVA_EXE=%JAVA_HOME%/bin/java.exe
 
-if exist "%JAVA_EXE%" goto init
+if exist "%JAVA_EXE%" goto execute
 
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
-:init
-@rem Get command-line arguments, handling Windows variants
-
-if not "%OS%" == "Windows_NT" goto win9xME_args
-
-:win9xME_args
-@rem Slurp the command line arguments.
-set CMD_LINE_ARGS=
-set _SKIP=2
-
-:win9xME_args_slurp
-if "x%~1" == "x" goto execute
-
-set CMD_LINE_ARGS=%*
-
 :execute
 @rem Setup the command line
 
 set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
 
+
 @rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
 
 :end
 @rem End local scope for the variables with windows NT shell
-if "%ERRORLEVEL%"=="0" goto mainEnd
+if %ERRORLEVEL% equ 0 goto mainEnd
 
 :fail
 rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
 rem the _cmd.exe /c_ return code!
-if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
-exit /b 1
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
 
 :mainEnd
 if "%OS%"=="Windows_NT" endlocal

modules/helma/Chart.js

@@ -23,7 +23,7 @@
  */
 
 // take care of any dependencies
-app.addRepository('modules/helma/jxl.jar');
+app.addRepository('modules/helma/jxl-2.5.7.jar');
 
 /**
  * Define the global namespace if not existing

modules/helma/Http.js

@@ -62,17 +62,18 @@ helma.Http = function() {
 
     var responseHandler = function(connection, result) {
        var input;
+       var stream;
        try {
-          if (method !== 'DELETE') {
-              var stream = connection.getInputStream();
+          stream = connection.getInputStream();
+       } catch (error) {
+          stream = connection.getErrorStream();
+       }
+       if  (stream) {
           if (connection.getContentEncoding() === 'gzip') {
               stream = new java.util.zip.GZIPInputStream(stream);
           }
           input = new java.io.BufferedInputStream(stream);
        }
-       } catch (error) {
-          input = new java.io.BufferedInputStream(connection.getErrorStream());
-       }
        if (input) {
           var body = new java.io.ByteArrayOutputStream();
           var buf = java.lang.reflect.Array.newInstance(java.lang.Byte.TYPE, 1024);
@@ -90,8 +91,7 @@ helma.Http = function() {
           } catch (error) {
              // safe to ignore
           }
-          if (binaryMode && (result.code >= 200 && result.code < 300)) {
-             // only honor binaryMode if the request succeeded
+          if (binaryMode) {
              result.content = body.toByteArray();
           } else {
              result.content = result.charset ?

modules/helma/Search.js

@@ -31,8 +31,8 @@
  */
 
 // take care of any dependencies
-app.addRepository('modules/helma/lucene-core.jar');
-app.addRepository('modules/helma/lucene-analyzers.jar');
+app.addRepository('modules/helma/lucene-core-2.2.0.jar');
+app.addRepository('modules/helma/lucene-analyzers-2.2.0.jar');
 
 
 if (!global.helma) {

modules/helma/Ssh.js

@@ -24,7 +24,7 @@
 
 // take care of any dependencies
 app.addRepository('modules/helma/File.js');
-app.addRepository('modules/helma/ganymed-ssh2.jar');
+app.addRepository('modules/helma/ganymed-ssh2-build208.jar');
 
 // define the helma namespace, if not existing
 if (!global.helma) {

modules/helma/build.gradle

@@ -0,0 +1,18 @@
+dependencies {
+	runtimeOnly 'ch.ethz.ganymed:ganymed-ssh2:build209'
+	runtimeOnly 'net.sourceforge.jexcelapi:jxl:2.5.7'
+	runtimeOnly 'org.apache.lucene:lucene-analyzers:2.2.0'
+	runtimeOnly 'org.apache.lucene:lucene-core:2.2.0'
+}
+
+jar.enabled = false
+compileJava.enabled = false
+compileTestJava.enabled = false
+processResources.enabled = false
+processTestResources.enabled = false
+test.enabled = false
+
+tasks.register('deps', Copy) {
+	from sourceSets.main.runtimeClasspath
+	into '.'
+}

modules/jala/build.gradle

@@ -0,0 +1,21 @@
+dependencies {
+	runtimeOnly 'dom4j:dom4j:1.1.3'
+	runtimeOnly 'jaxen:jaxen:1.1-beta-8'
+	runtimeOnly 'net.sf.javamusictag:jid3lib:0.5.4'
+
+	// FIXME: Did not find these two or appropriate replacements for them
+	//runtime 'id3:de.ueberdosis.mp3info:1.6.0d9'
+	//runtime 'javadns:org.wonderly:?'
+}
+
+jar.enabled = false
+compileJava.enabled = false
+compileTestJava.enabled = false
+processResources.enabled = false
+processTestResources.enabled = false
+test.enabled = false
+
+tasks.register('deps', Copy) {
+	from sourceSets.main.runtimeClasspath
+	into 'lib'
+}

modules/jala/code/Database.js

@@ -841,7 +841,7 @@ jala.db.RamDatabase.prototype.copyTables = function(database, tables) {
          tables = jala.db.metadata.getTableNames(dbMetadata);
       }
 
-      for each (var tableName in tables) {
+      for (let tableName of tables) {
          // drop the table if it exists
          if (this.tableExists(tableName)) {
             this.dropTable(tableName);

modules/jala/util/HopKit/build.gradle

@@ -0,0 +1,16 @@
+dependencies {
+	// FIXME: Seems to be not used, anymore…?
+	runtimeOnly 'bsf:bsf:2.4.0'
+}
+
+jar.enabled = false
+compileJava.enabled = false
+compileTestJava.enabled = false
+processResources.enabled = false
+processTestResources.enabled = false
+test.enabled = false
+
+tasks.register('deps', Copy) {
+	from sourceSets.main.runtimeClasspath
+	into 'lib'
+}

modules/jala/util/HopKit/scripts/MessageParser.js

@@ -330,7 +330,7 @@ MessageParser.prototype.parseSkinFile = function(file, encoding) {
   var processMacros = function(macros) {
     var re = gettext_macro.REGEX;
     var id, pluralId, name, args, param, key, msg;
-    for each (var macro in macros) {
+    for (let macro of macros) {
       id = pluralId = null;
       name = macro.getName();
       param = macro.getNamedParams();
@@ -374,7 +374,7 @@ MessageParser.prototype.parseSkinFile = function(file, encoding) {
   if (skin.hasMainskin()) {
     processMacros(skin.getMacros());
   }
-  for each (var name in skin.getSubskinNames()) {
+  for (let name of skin.getSubskinNames()) {
     var subskin = skin.getSubskin(name);
     processMacros(subskin.getMacros());
   }

modules/jala/util/Test/build.gradle

@@ -0,0 +1,16 @@
+dependencies {
+	runtimeOnly 'org.subethamail:subethasmtp-smtp:1.2'
+	runtimeOnly 'org.subethamail:subethasmtp-wiser:1.2'
+}
+
+jar.enabled = false
+compileJava.enabled = false
+compileTestJava.enabled = false
+processResources.enabled = false
+processTestResources.enabled = false
+test.enabled = false
+
+tasks.register('deps', Copy) {
+	from sourceSets.main.runtimeClasspath
+	into 'code'
+}

modules/jala/util/Test/code/Global/jala.Test.js

@@ -1336,7 +1336,7 @@ jala.Test.DatabaseMgr.prototype.startDatabase = function(dbSourceName, copyTable
             // collect the table names of all relational prototypes
             tables = [];
             var protos = app.getPrototypes();
-            for each (var proto in protos) {
+            for (let proto of protos) {
                var dbMap = proto.getDbMapping();
                if (dbMap.isRelational()) {
                   tables.push(dbMap.getTableName());

renovate.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+
+  "extends": [
+    "config:recommended",
+    "mergeConfidence:all-badges",
+    "npm:unpublishSafe",
+    ":disableRateLimiting",
+    ":pinVersions",
+    ":semanticCommitsDisabled"
+  ],
+
+  "osvVulnerabilityAlerts": true,
+
+  "vulnerabilityAlerts": {
+    "labels": ["security", "urgent"],
+    "automerge": true
+  },
+
+  "labels": ["dependency"],
+
+  "packageRules": [
+    {
+      "description": "Label Helma core packages",
+      "matchFiles": ["build.gradle"],
+      "addLabels": ["core"]
+    },
+    {
+      "description": "Label major version bumps",
+      "matchUpdateTypes": ["major"],
+      "addLabels": ["major"]
+    },
+    {
+      "description": "Label packages required at runtime",
+      "matchDepTypes": ["dependencies"],
+      "addLabels": ["runtime"]
+    },
+    {
+      "description": "Group Jetty packages",
+      "matchPackagePrefixes": ["org.eclipse.jetty"],
+      "groupName": "Jetty packages"
+    },
+    {
+      "description": "Group Lucene packages",
+      "matchPackagePrefixes": ["org.apache.lucene"],
+      "groupName": "Lucene packages"
+    }
+  ]
+}
+

settings.gradle

@@ -7,3 +7,12 @@ org.apache.tools.ant.DirectoryScanner.removeDefaultExclude('**/.git/**')
 org.apache.tools.ant.DirectoryScanner.removeDefaultExclude('**/.gitignore')
 
 include 'launcher'
+include 'modules'
+include 'jala'
+include 'hopKit'
+include 'test'
+
+project(':modules').projectDir = file('modules/helma')
+project(':jala').projectDir = file('modules/jala')
+project(':hopKit').projectDir = file('modules/jala/util/HopKit')
+project(':test').projectDir = file('modules/jala/util/Test')

src/dist/apps/test/tests/HopObjectCollection.js

@@ -149,7 +149,7 @@ function testOrder(org, pos) {
 
 function cleanup() {
     var persons = root.persons.list();
-    for each (var person in persons) {
+    for (let person of persons) {
         person.remove();
     }
     ikea.remove();

src/dist/apps/test/tests/HopObjectGeneric.js

@@ -86,7 +86,7 @@ function testAdd() {
 
 function cleanup() {
     var persons = org.generic.list();
-    for each (var person in persons) {
+    for (let person of persons) {
         person.remove();
     }
     org.remove();

src/dist/apps/test/tests/HopObjectGroupBy.js

@@ -143,7 +143,7 @@ function testGroupTransient() {
 
 function cleanup() {
     var orgs = root.organisations.list();
-    for each (var org in orgs) {
+    for (let org of orgs) {
         org.remove();
     }
 }

src/dist/extras/deploy.sh

@@ -0,0 +1,60 @@
+#!/bin/sh
+
+# Use this script as forced command of an authorized SSH key:
+# command="/home/helma/extras/deploy.sh" ssh-ed25519 AAAAC3NzaC…
+
+# Define HELMA_HOST and ANTVILLE_HOST in this file
+# shellcheck source=/dev/null
+. "$HOME"/deploy.env
+
+case "$SSH_ORIGINAL_COMMAND" in
+  ping)
+    echo pong
+    ;;
+
+  deploy-helma)
+    rsync ./ "$HELMA_HOST":./ \
+      --archive --compress --delete --verbose \
+      --filter '+ /bin' \
+      --filter '+ /extras' \
+      --filter '+ /launcher.jar' \
+      --filter '- /lib/ext' \
+      --filter '+ /lib' \
+      --filter '+ /modules' \
+      --filter '- /*'
+    printf 'Restarting Helma on HELMA_host… '
+    ssh "$HELMA_HOST" sudo /bin/systemctl restart helma
+    ;;
+
+  deploy-antville)
+    rsync ./apps/antville/ "$ANTVILLE_HOST":./apps/antville/ \
+      --archive --compress --delete --verbose \
+      --filter '+ /claustra' \
+      --filter '+ /code' \
+      --filter '+ /compat' \
+      --filter '+ /i18n' \
+      --filter '+ /lib' \
+      --filter '- /*'
+    rsync ./apps/antville/static/helma/ "$ANTVILLE_HOST":./apps/antville/static/helma/ \
+      --archive --compress --verbose \
+      --filter '+ /fonts' \
+      --filter '+ /formica.html' \
+      --filter '+ /img' \
+      --filter '+ /scripts' \
+      --filter '+ /styles' \
+      --filter '- /*'
+    printf 'Restarting Helma on ANTVILLE_host… '
+    ssh "$ANTVILLE_HOST" sudo /bin/systemctl restart helma
+    ;;
+
+  restart)
+    printf 'Restarting Helma… '
+    sudo /bin/systemctl restart helma
+    printf '%s\n' 'done.'
+    ;;
+
+  *)
+    # Allow any rsync command but restrict it to the installation directory
+    rrsync -wo /home/helma
+    ;;
+esac

src/dist/extras/helma.service

@@ -0,0 +1,25 @@
+[Unit]
+Description = Helma Object Publisher
+After = syslog.target network.target
+StartLimitIntervalSec = 0
+
+[Service]
+Type = simple
+Restart = always
+RestartSec = 1
+SuccessExitStatus = 143
+User = helma
+WorkingDirectory = /home/helma
+
+ExecStart = /usr/bin/java -server \
+  -Dfile.encoding=utf8 \
+  -Djava.awt.headless=true \
+  -Xms1024m -Xmx2048m \
+  -jar launcher.jar \
+  -w 8080 -x 8081
+
+ExecReload = /bin/sh -c 'touch apps.properties && touch server.properties'
+ExecStop = /bin/kill -15 $MAINPID
+
+[Install]
+WantedBy = multi-user.target

src/dist/extras/upstart/helma

@@ -6,6 +6,15 @@
 # andreas bolka, 2003-11-30
 #
 
+### BEGIN INIT INFO
+# Provides: helma
+# Required-Start: postgresql apache2
+# Required-Stop:
+# Default-Start: 2 3 4 5
+# Default-STop: 0 1 6
+# Short-Description: Helma Application Server
+### END INIT INFO
+
 HELMA_CONFIG=/etc/helma.conf
 
 ###
@@ -19,22 +28,24 @@ else
 fi
 
 # Check for missing files and directories
+
 if [ ! -x $JAVA_BIN ]; then
   echo "Config error: JAVA_BIN $JAVA_BIN not found or not executable"
   exit 5
 fi
+
 if [ ! -r $HELMA_INSTALL/launcher.jar ]; then
   echo "Config error: $HELMA_INSTALL/launcher.jar not found or not readable"
   exit 5
 fi
+
 if [ ! -d $HELMA_HOME ]; then
   echo "Config error: HELMA_HOME $HELMA_HOME not found"
   exit 5
 fi
 
-# local settins
-RUN_CMD="sudo -u $HELMA_USER $JAVA_BIN"
-RUN_ARGS="$JAVA_OPTS -jar $HELMA_INSTALL/launcher.jar -h $HELMA_HOME $HELMA_ARGS"
+RUN_CMD="su - $HELMA_USER"
+RUN_ARGS="-c $JAVA_BIN $JAVA_OPTS -jar $HELMA_INSTALL/launcher.jar -h $HELMA_HOME $HELMA_ARGS"
 
 case "$1" in
   start)
@@ -46,7 +57,7 @@ start)
     fi
 
     cd $HELMA_HOME
-    nohup $RUN_CMD $RUN_ARGS > $HELMA_LOG 2>&1 &
+    nohup $RUN_CMD "$RUN_ARGS" > $HELMA_LOG 2>&1 &
     echo $! > $HELMA_PID
     echo "$HELMA_SERVICE (pid `cat $HELMA_PID`) started."
     ;;
@@ -81,4 +92,5 @@ reload)
     exit 1
     ;;
 esac
+
 exit 0

src/dist/extras/upstart/helma.conf

@@ -1,72 +1,44 @@
-##############################################################
-###
-###   Helma object publisher config file
-###   Author:  Hannes Wallnoefer, <hannes@helma.at>
-###   Author:  Andreas Bolka
-###
-###   This file should be placed in /etc/helma.conf.
-###   It is read by the Helma service control script, 
-###   usually /etc/init.d/helma.
-###
-##############################################################
+#
+# Helma Object Publisher configuration file
+#
+# Authors:
+# Hannes Wallnoefer <hannes@helma.at>,
+# Andreas Bolka
+#
+# This file should be placed in /etc/helma.conf.
+# It is read by the Helma service control script,
+# usually /etc/init.d/helma.
+#
 
-##############################################################
-###   The name of this Helma server/service and the
-###   pid file to be used
-#############################################################
+# Full path to Java executable
+JAVA_HOME=/usr/lib/jvm/default-java
+JAVA_BIN=$JAVA_HOME/bin/java
+
+# Options passed to the Java runtime
+JAVA_OPTS="-server -Djava.awt.headless=true -Dfile.encoding=utf-8 -Djsse.enableSNIExtension=false"
+
+# The name of this Helma server/service and the pid file to be used
 HELMA_SERVICE=helma
 HELMA_PID=/var/run/helma.pid
 
+# Helma install directory. This is where we look for the Helma jar files
+# (launcher.jar, lib/* and lib/ext/*)
+HELMA_INSTALL=/home/helma
 
-##############################################################
-###   Full path to Java executable
-##############################################################
-JAVA_HOME=/usr/lib/j2sdk1.5-sun
-JAVA_BIN=$JAVA_HOME/bin/java
-
-
-##############################################################
-###    Options passed to the Java runtime
-##############################################################
-JAVA_OPTS="-Djava.awt.headless=true"
-
-
-##############################################################
-###   Helma install directory. This is where we look for 
-###   the Helma jar files (launcher.jar, lib/* and lib/ext/*)
-##############################################################
-HELMA_INSTALL=/usr/local/helma/helma-1.6.x
-
-
-##############################################################
-###   Helma home directory, in case it is different from the
-###   Helma install dir. This is where Helma will look for 
-###   properties files and applications.
-##############################################################
+# Helma home directory, in case it is different from the Helma install dir.
+# This is where Helma will look for properties files and applications.
 HELMA_HOME=$HELMA_INSTALL
 
-
-##############################################################
-###   The user Helma should be running as
-##############################################################
+# The user Helma should be running as
 HELMA_USER=helma
 
-
-##############################################################
-###   File to which standard and error output from Helma 
-###   is redirected
-##############################################################
+# File to which standard and error output from Helma is redirected
 HELMA_LOG=$HELMA_HOME/log/helma-out.log
 
-
-##############################################################
-###   Helma options. Possible options are:
-###
-###    -f file    Specify server.properties file
-###    -p port    Specify RMI port number
-###    -w port    Specify port number for embedded Web server
-###    -x port    Specify XML-RPC port number
-###    -jk port   Specify AJP13 port number
-###
-##############################################################
+# Helma options. Possible options are:
+# -f file  - Location of server.properties file
+# -p port  - RMI port
+# -w port  - Web server port
+# -x port  - XML-RPC port
+# -jk port - AJP13 port
 HELMA_ARGS="-w 8080"

src/main/java/helma/framework/CookieTrans.java

@@ -24,15 +24,13 @@ import javax.servlet.http.Cookie;
  *  of an HTTP cookie.
  */
 public final class CookieTrans implements Serializable {
-    private static final long serialVersionUID = 1811202114296536258L;
-
-    String name;
-    String value;
-    String path;
-    String domain;
-    int days = -1;
-    boolean secure;
-    boolean httpOnly;
+    private String name;
+    private String value;
+    private String path;
+    private String domain;
+    private boolean isHttpOnly = true;
+    private boolean isSecure = false;
+    private int days = -1;
 
     CookieTrans(String name, String value) {
         this.name = name;
@@ -55,9 +53,15 @@ public final class CookieTrans implements Serializable {
         this.domain = domain;
     }
 
+    void setHttpOnly(boolean isHttpOnly) {
+        this.isHttpOnly = isHttpOnly;
+    }
+
+    void setSecure(boolean isSecure) {
+        this.isSecure = isSecure;
+    }
+
     /**
-     *
-     *
      * @return ...
      */
     public String getName() {
@@ -65,8 +69,6 @@ public final class CookieTrans implements Serializable {
     }
 
     /**
-     *
-     *
      * @return ...
      */
     public String getValue() {
@@ -74,8 +76,6 @@ public final class CookieTrans implements Serializable {
     }
 
     /**
-     *
-     *
      * @return ...
      */
     public int getDays() {
@@ -83,8 +83,6 @@ public final class CookieTrans implements Serializable {
     }
 
     /**
-     *
-     *
      * @return ...
      */
     public String getPath() {
@@ -92,28 +90,24 @@ public final class CookieTrans implements Serializable {
     }
 
     /**
-     *
-     *
      * @return ...
      */
     public String getDomain() {
         return domain;
     }
 
-    public boolean isSecure() {
-        return secure;
+    /**
+     * @return ...
+     */
+    public boolean getHttpOnly() {
+        return isHttpOnly;
     }
 
-    void isSecure(boolean secure) {
-        this.secure = secure;
-    }
-
-    public boolean isHttpOnly() {
-        return httpOnly;
-    }
-
-    void isHttpOnly(boolean httpOnly) {
-        this.httpOnly = httpOnly;
+    /**
+     * @return ...
+     */
+    public boolean getSecure() {
+        return isSecure;
     }
 
     /**
@@ -147,8 +141,8 @@ public final class CookieTrans implements Serializable {
             c.setDomain(defaultDomain);
         }
 
-        c.setHttpOnly(httpOnly);
-        c.setSecure(secure);
+        c.setHttpOnly(isHttpOnly);
+        c.setSecure(isSecure);
 
         return c;
     }

src/main/java/helma/framework/ResponseBean.java

@@ -143,7 +143,7 @@ public class ResponseBean implements Serializable {
      * @param value the cookie value
      */
     public void setCookie(String key, String value) {
-        res.setCookie(key, value, -1, null, null);
+        res.setCookie(key, value, -1, null, null, true, false);
     }
 
     /**
@@ -156,7 +156,7 @@ public class ResponseBean implements Serializable {
      * @param days number of days the cookie should be stored
      */
     public void setCookie(String key, String value, int days) {
-        res.setCookie(key, value, days, null, null);
+        res.setCookie(key, value, days, null, null, true, false);
     }
 
     /**
@@ -171,7 +171,42 @@ public class ResponseBean implements Serializable {
      * @param path the URL path to apply the cookie to
      */
     public void setCookie(String key, String value, int days, String path) {
-        res.setCookie(key, value, days, path, null);
+        res.setCookie(key, value, days, path, null, true, false);
+    }
+
+    /**
+     * Set a HTTP cookie with the name and value that is only applied to
+     * the URLs matching the given path and is stored by the
+     * HTTP client for the given number of days. A days value of 0 means the
+     * cookie should be immediately discarded.
+     *
+     * @param key the cookie name
+     * @param value the cookie value
+     * @param days number of days the cookie should be stored
+     * @param path the URL path to apply the cookie to
+     * @param domain domain
+     * @param isHttpOnly marks the cookie as HttpOnly
+     */
+    public void setCookie(String key, String value, int days, String path, String domain, boolean isHttpOnly) {
+        res.setCookie(key, value, days, path, domain, isHttpOnly, false);
+    }
+
+    /**
+     * Set a HTTP cookie with the name and value that is only applied to
+     * the URLs matching the given path and is stored by the
+     * HTTP client for the given number of days. A days value of 0 means the
+     * cookie should be immediately discarded.
+     *
+     * @param key the cookie name
+     * @param value the cookie value
+     * @param days number of days the cookie should be stored
+     * @param path the URL path to apply the cookie to
+     * @param domain domain
+     * @param isHttpOnly marks the cookie as HttpOnly
+     * @param isSecure limits the cookie to secure protocols
+     */
+    public void setCookie(String key, String value, int days, String path, String domain, boolean isHttpOnly, boolean isSecure) {
+        res.setCookie(key, value, days, path, domain, isHttpOnly, isSecure);
     }
 
     /**
@@ -187,7 +222,7 @@ public class ResponseBean implements Serializable {
      * @param domain domain
      */
     public void setCookie(String key, String value, int days, String path, String domain) {
-        res.setCookie(key, value, days, path, domain);
+        res.setCookie(key, value, days, path, domain, true, false);
     }
 
     /**
@@ -197,7 +232,7 @@ public class ResponseBean implements Serializable {
      * @param key the name of the cookie to be discarded
      */
     public void unsetCookie(String key) {
-        res.setCookie(key, "", 0, null, null);
+        res.setCookie(key, "", 0, null, null, true, false);
     }
 
     /**
@@ -245,9 +280,9 @@ public class ResponseBean implements Serializable {
     }
 
     /**
-     * add an HTML formatted debug message to the end of the page.
+     * add HTML formatted debug messages to the end of the page.
      *
-     * @param message the message
+     * @param messages the list of messages
      */
     public void debug(String... messages) {
         if (messages == null) {

src/main/java/helma/framework/ResponseTrans.java

@@ -384,7 +384,7 @@ public final class ResponseTrans extends Writer implements Serializable {
     }
 
     /**
-     * Replace special characters with entities, including <, > and ", thus allowing
+     * Replace special characters with entities, including {@code <}, {@code >} and {@code "}, thus allowing
      * no HTML tags.
      */
     public synchronized void encode(Object what) {
@@ -415,7 +415,7 @@ public final class ResponseTrans extends Writer implements Serializable {
     }
 
     /**
-     * Replace special characters with entities, including <, > and ", thus allowing
+     * Replace special characters with entities, including {@code <}, {@code >} and {@code "}, thus allowing
      * no HTML tags.
      */
     public synchronized void encodeXml(Object what) {
@@ -974,8 +974,10 @@ public final class ResponseTrans extends Writer implements Serializable {
      * @param days the cookie's lifespan in days
      * @param path the URL path to apply the cookie to
      * @param domain the domain to apply the cookie to
+     * @param isHttpOnly marks the cookie as HttpOnly
+     * @param isSecure limits the cookie for use with secure protocols
      */
-    public void setCookie(String key, String value, int days, String path, String domain) {
+    public void setCookie(String key, String value, int days, String path, String domain, boolean isHttpOnly, boolean isSecure) {
         CookieTrans c = null;
 
         if (cookies == null) {
@@ -1001,11 +1003,11 @@ public final class ResponseTrans extends Writer implements Serializable {
         c.setDomain(domain);
 
         if (!"false".equalsIgnoreCase(app.getProperty("cookies.httpOnly"))) {
-            c.isHttpOnly(true);
+            c.setHttpOnly(true);
         }
 
         if ("true".equalsIgnoreCase(app.getProperty("cookies.secure"))) {
-            c.isSecure(true);
+            c.setSecure(true);
         }
     }
 

src/main/java/helma/framework/core/TypeManager.java

@@ -192,7 +192,7 @@ public final class TypeManager {
             long lastScan = lastRepoScan.containsKey(repository) ?
                     ((Long) lastRepoScan.get(repository)).longValue() : 0;
             if (repository.lastModified() != lastScan) {
-                lastRepoScan.put(repository, new Long(repository.lastModified()));
+                lastRepoScan.put(repository, Long.valueOf(repository.lastModified()));
                 checkRepository(repository, false);
             }
         }

src/main/java/helma/image/ImageWrapper.java

@@ -514,7 +514,7 @@ public class ImageWrapper {
     /**
      * Reduces the colors used in the image. Necessary before saving as GIF.
      *
-     * @param colors colors the number of colors to use, usually <= 256.
+     * @param colors colors the number of colors to use, usually {@literal <}= 256.
      */
     public void reduceColors(int colors) {
         reduceColors(colors, false);
@@ -523,7 +523,7 @@ public class ImageWrapper {
     /**
      * Reduces the colors used in the image. Necessary before saving as GIF.
      *
-     * @param colors colors the number of colors to use, usually <= 256.
+     * @param colors colors the number of colors to use, usually {@literal <}= 256.
      * @param dither ...
      */
     public void reduceColors(int colors, boolean dither) {
@@ -534,7 +534,7 @@ public class ImageWrapper {
      * Reduce the colors used in this image. Useful and necessary before saving
      * the image as GIF file.
      *
-     * @param colors the number of colors to use, usually <= 256.
+     * @param colors the number of colors to use, usually {@literal <}= 256.
      * @param dither ...
      * @param alphaToBitmask ...
      */

src/main/java/helma/main/ApplicationManager.java

@@ -473,10 +473,10 @@ public class ApplicationManager implements XmlRpcHandler {
                 }
 
                 // bind to Jetty HTTP server
-                if (ApplicationManager.this.jetty != null) {
-                    if(ApplicationManager.this.context == null) {
-                        ApplicationManager.this.context = new ContextHandlerCollection();
-                        ApplicationManager.this.jetty.getHttpServer().setHandler(ApplicationManager.this.context);
+                if (jetty != null) {
+                    if (context == null) {
+                        context = new ContextHandlerCollection();
+                        jetty.getHttpServer().setHandler(context);
                     }
 
                     // if there is a static direcory specified, mount it
@@ -501,9 +501,8 @@ public class ApplicationManager implements XmlRpcHandler {
                     Class servletClass = servletClassName == null ?
                             EmbeddedServletClient.class : Class.forName(servletClassName);
                     ServletHolder holder = new ServletHolder(servletClass);
-                    appContext.addServlet(holder, "/*"); //$NON-NLS-1$
-
-                    holder.setInitParameter("application", appName); //$NON-NLS-1$
+                    holder.setInitParameter("application", appName);
+                    appContext.addServlet(holder, "/*");
 
                     if (this.cookieDomain != null) {
                         holder.setInitParameter("cookieDomain", this.cookieDomain); //$NON-NLS-1$
@@ -529,9 +528,9 @@ public class ApplicationManager implements XmlRpcHandler {
                         holder.setInitParameter("debug", this.debug); //$NON-NLS-1$
                     }
 
-                    if (this.protectedStaticDir != null) {
-                        File protectedContent = getAbsoluteFile(this.protectedStaticDir);
-                        this.appContext.setResourceBase(protectedContent.getPath());
+                    if (protectedStaticDir != null) {
+                        File protectedContent = getAbsoluteFile(protectedStaticDir);
+                        appContext.setResourceBase(protectedContent.getPath());
                         getLogger().info("Serving protected static from " +
                                        protectedContent.getPath());
                     }

src/main/java/helma/main/Server.java

@@ -36,7 +36,13 @@ import helma.util.ResourceProperties;
  */
 public class Server implements Runnable {
     // version string
-    public static final String version = "🐜 (__builddate__)";
+    public static final String version = "__version__";
+
+    // build date
+    public static final String buildDate = "__builddate__";
+
+    // commit hash
+    public static final String commitHash = "__commithash__";
 
     // static server instance
     private static Server server;
@@ -143,17 +149,13 @@ public class Server implements Runnable {
       * check if we are running on a Java 2 VM - otherwise exit with an error message
       */
     public static void checkJavaVersion() {
-        String javaVersion = System.getProperty("java.version");
+        String javaVersion = System.getProperty("java.version", "0");
+        int majorVersion = Integer.parseInt(javaVersion.split("\\.")[0]);
 
-        if ((javaVersion == null) || javaVersion.startsWith("1.5")
-                                  || javaVersion.startsWith("1.4")
-                                  || javaVersion.startsWith("1.3")
-                                  || javaVersion.startsWith("1.2")
-                                  || javaVersion.startsWith("1.1")
-                                  || javaVersion.startsWith("1.0")) {
-            System.err.println("This version of Helma requires Java 1.6 or greater.");
+        if (majorVersion < 11) {
+            System.err.println("This version of Helma requires Java 11 or greater.");
 
-            if (javaVersion == null) { // don't think this will ever happen, but you never know
+            if (majorVersion == 0) { // don't think this will ever happen, but you never know
                 System.err.println("Your Java Runtime did not provide a version number. Please update to a more recent version.");
             } else {
                 System.err.println("Your Java Runtime is version " + javaVersion +

src/main/java/helma/objectmodel/TransientProperty.java

@@ -76,13 +76,13 @@ public final class TransientProperty implements IProperty, Serializable {
                 return svalue;
 
             case BOOLEAN:
-                return new Boolean(bvalue);
+                return Boolean.valueOf(bvalue);
 
             case INTEGER:
-                return new Long(lvalue);
+                return Long.valueOf(lvalue);
 
             case FLOAT:
-                return new Double(dvalue);
+                return Double.valueOf(dvalue);
 
             case DATE:
                 return new Date(lvalue);

src/main/java/helma/objectmodel/db/Property.java

@@ -93,7 +93,7 @@ public final class Property implements IProperty, Serializable, Cloneable, Compa
                     break;
 
                 case INTEGER:
-                    value = new Long(in.readLong());
+                    value = Long.valueOf(in.readLong());
 
                     break;
 
@@ -103,7 +103,7 @@ public final class Property implements IProperty, Serializable, Cloneable, Compa
                     break;
 
                 case FLOAT:
-                    value = new Double(in.readDouble());
+                    value = Double.valueOf(in.readDouble());
 
                     break;
 
@@ -231,7 +231,7 @@ public final class Property implements IProperty, Serializable, Cloneable, Compa
      */
     public void setIntegerValue(long l) {
         type = INTEGER;
-        value = new Long(l);
+        value = Long.valueOf(l);
         dirty = true;
     }
 
@@ -242,7 +242,7 @@ public final class Property implements IProperty, Serializable, Cloneable, Compa
      */
     public void setFloatValue(double d) {
         type = FLOAT;
-        value = new Double(d);
+        value = Double.valueOf(d);
         dirty = true;
     }
 

src/main/java/helma/objectmodel/db/Transactor.java

@@ -240,7 +240,7 @@ public class Transactor {
     public void registerConnection(DbSource src, Connection con) {
         sqlConnections.put(src, con);
         // we assume a freshly created connection is ok.
-        testedConnections.put(src, new Long(System.currentTimeMillis()));
+        testedConnections.put(src, Long.valueOf(System.currentTimeMillis()));
     }
 
     /**
@@ -262,7 +262,7 @@ public class Transactor {
                     stmt.execute("SELECT 1");
                 }
                 stmt.close();
-                testedConnections.put(src, new Long(now));
+                testedConnections.put(src, Long.valueOf(now));
             } catch (SQLException sx) {
                 try {
                     con.close();

src/main/java/helma/objectmodel/dom/XmlDatabaseReader.java

@@ -225,9 +225,9 @@ public final class XmlDatabaseReader extends DefaultHandler implements XmlConsta
                     prop.setStringValue(charValue);
                 }
             } else if ("float".equals(elementType)) {
-                prop.setFloatValue((new Double(charValue)).doubleValue());
+                prop.setFloatValue((Double.valueOf(charValue)).doubleValue());
             } else if ("integer".equals(elementType)) {
-                prop.setIntegerValue((new Long(charValue)).longValue());
+                prop.setIntegerValue((Long.valueOf(charValue)).longValue());
             } else {
                 prop.setStringValue(charValue);
             }

src/main/java/helma/objectmodel/dom/XmlReader.java

@@ -299,9 +299,9 @@ public final class XmlReader extends DefaultHandler implements XmlConstants {
                     currentNode.setString(elementName, charValue);
                 }
             } else if ("float".equals(elementType)) {
-                currentNode.setFloat(elementName, (new Double(charValue)).doubleValue());
+                currentNode.setFloat(elementName, (Double.valueOf(charValue)).doubleValue());
             } else if ("integer".equals(elementType)) {
-                currentNode.setInteger(elementName, (new Long(charValue)).longValue());
+                currentNode.setInteger(elementName, (Long.valueOf(charValue)).longValue());
             } else {
                 currentNode.setString(elementName, charValue);
             }

src/main/java/helma/scripting/rhino/HopObject.java

@@ -879,7 +879,7 @@ public class HopObject extends ScriptableObject implements Wrapper, PropertyReco
                     if (d == null) {
                         return null;
                     } else {
-                        Object[] args = { new Long(d.getTime()) };
+                        Object[] args = { Long.valueOf(d.getTime()) };
                         try {
                             return cx.newObject(core.global, "Date", args);
                         } catch (JavaScriptException nafx) {

src/main/java/helma/scripting/rhino/JSAdapter.java

@@ -100,7 +100,7 @@ public final class JSAdapter implements Scriptable, Function {
     public Object get(int index, Scriptable start) {
         Function func = getAdapteeFunction(GET_PROP);
         if (func != null) {
-            return call(func, new Object[] { new Integer(index) });
+            return call(func, new Object[] { Integer.valueOf(index) });
         } else {
             start = getAdaptee();
             return start.get(index, start);
@@ -121,7 +121,7 @@ public final class JSAdapter implements Scriptable, Function {
     public boolean has(int index, Scriptable start) {
         Function func = getAdapteeFunction(HAS_PROP);
         if (func != null) {
-            Object res = call(func, new Object[] { new Integer(index) });
+            Object res = call(func, new Object[] { Integer.valueOf(index) });
             return Context.toBoolean(res);
         } else {
             start = getAdaptee();
@@ -147,7 +147,7 @@ public final class JSAdapter implements Scriptable, Function {
         if (start == this) {
             Function func = getAdapteeFunction(PUT_PROP);
             if( func != null) {
-                call(func, new Object[] { new Integer(index), value });
+                call(func, new Object[] { Integer.valueOf(index), value });
             } else {
                 start = getAdaptee();
                 start.put(index, start, value);
@@ -169,7 +169,7 @@ public final class JSAdapter implements Scriptable, Function {
     public void delete(int index) {
         Function func = getAdapteeFunction(DEL_PROP);
         if (func != null) {
-            call(func, new Object[] { new Integer(index) });
+            call(func, new Object[] { Integer.valueOf(index) });
         } else {
             getAdaptee().delete(index);
         }
@@ -296,7 +296,7 @@ public final class JSAdapter implements Scriptable, Function {
     // map a property id. Property id can only be an Integer or String
     private Object mapToId(Object tmp) {
         if (tmp instanceof Double) {
-            return new Integer(((Double)tmp).intValue());
+            return Integer.valueOf(((Double)tmp).intValue());
         } else {
             return Context.toString(tmp);
         }

src/main/java/helma/scripting/rhino/PathWrapper.java

@@ -106,7 +106,7 @@ public class PathWrapper extends ScriptableObject {
         Object[] ids = new Object[path.size()];
 
         for (int i=0; i<ids.length; i++) {
-            ids[i] = new Integer(i);
+            ids[i] = Integer.valueOf(i);
         }
 
         return ids;

src/main/java/helma/scripting/rhino/RhinoCore.java

@@ -93,8 +93,8 @@ public final class RhinoCore implements ScopeProvider {
     // optimization level for rhino engine, ranges from -1 to 9
     int optLevel = 0;
 
-    // language version - default to JS 1.8
-    int languageVersion = 180;
+    // language version - default to ES6
+    int languageVersion = 200;
 
     // debugger/tracer flags
     boolean hasDebugger = false;
@@ -569,7 +569,7 @@ public final class RhinoCore implements ScopeProvider {
             return arg;
         if (arg instanceof Date) {
             Date d = (Date) arg;
-            Object[] args = { new Long(d.getTime()) };
+            Object[] args = { Long.valueOf(d.getTime()) };
             return Context.getCurrentContext().newObject(global, "Date", args);
         }
         return Context.toObject(arg, global);
@@ -618,9 +618,9 @@ public final class RhinoCore implements ScopeProvider {
         } else if (arg instanceof Number) {
             Number n = (Number) arg;
             if (arg instanceof Float || arg instanceof Long) {
-                return new Double(n.doubleValue());
+                return Double.valueOf(n.doubleValue());
             } else if (!(arg instanceof Double)) {
-                return new Integer(n.intValue());
+                return Integer.valueOf(n.intValue());
             }
         } else if (arg instanceof INode) {
             // interpret HopObject as object/dict
@@ -1146,7 +1146,7 @@ public final class RhinoCore implements ScopeProvider {
 
             // Convert java.util.Date objects to JavaScript Dates
             if (obj instanceof Date) {
-                Object[] args = { new Long(((Date) obj).getTime()) };
+                Object[] args = { Long.valueOf(((Date) obj).getTime()) };
                 try {
                     return cx.newObject(global, "Date", args);
                  } catch (JavaScriptException nafx) {

src/main/java/helma/scripting/rhino/debug/Profiler.java

@@ -106,7 +106,7 @@ public class Profiler implements Debugger {
                             Scriptable thisObj, Object[] args) {
 
             long time = System.nanoTime();
-            timer.push(new Long(time));
+            timer.push(Long.valueOf(time));
         }
 
         /**

src/main/java/helma/scripting/rhino/extensions/DatabaseObject.java

@@ -216,6 +216,23 @@ public class DatabaseObject {
         }
     }
 
+    public RowSet executePreparedRetrieval(PreparedStatement statement) {
+        ResultSet resultSet = null;
+
+        try {
+            resultSet = statement.executeQuery();
+            return new RowSet(statement.toString(), this, statement, resultSet);
+        } catch (SQLException e) {
+            lastError = e;
+            try {
+                if (statement != null) statement.close();
+            } catch (Exception ignored) {
+            }
+            statement = null;
+            return null;
+        }
+    }
+
     public int executeCommand(String sql) {
         int count = 0;
 
@@ -439,7 +456,7 @@ public class DatabaseObject {
 
             // First return system or or prototype properties
             if (propertyName.equals("length")) {
-                 return new Integer(colNames.size());
+                 return Integer.valueOf(colNames.size());
             } else {
                if (resultSet == null) {
                     lastError = new SQLException("Attempt to access a released result set");
@@ -498,12 +515,12 @@ public class DatabaseObject {
                     case Types.BIGINT:
                     case Types.SMALLINT:
                     case Types.INTEGER:
-                        return new Long(resultSet.getLong(index));
+                        return Long.valueOf(resultSet.getLong(index));
 
                     case Types.REAL:
                     case Types.FLOAT:
                     case Types.DOUBLE:
-                        return new Double(resultSet.getDouble(index));
+                        return Double.valueOf(resultSet.getDouble(index));
 
                     case Types.DECIMAL:
                     case Types.NUMERIC:
@@ -513,9 +530,9 @@ public class DatabaseObject {
                         }
 
                         if (num.scale() > 0) {
-                            return new Double(num.doubleValue());
+                            return Double.valueOf(num.doubleValue());
                         } else {
-                            return new Long(num.longValue());
+                            return Long.valueOf(num.longValue());
                         }
 
                     case Types.VARBINARY:

src/main/java/helma/servlet/AbstractServletClient.java

@@ -554,8 +554,13 @@ public abstract class AbstractServletClient extends HttpServlet {
             // If protected session cookies are enabled we also force a new session
             // if the existing session id doesn't match the client's ip address
             StringBuffer buffer = new StringBuffer();
+            String ip = request.getHeader("X-Forwarded-For");
+            if (ip != null && ip.length() != 0) {
+                addIPAddress(buffer, ip);
+            } else {
                 addIPAddress(buffer, request.getRemoteAddr());
-            addIPAddress(buffer, request.getHeader("X-Forwarded-For"));
+            }
+            // Not sure, if this line can be removed
             addIPAddress(buffer, request.getHeader("Client-ip"));
             if (reqtrans.getSession() == null || !reqtrans.getSession().startsWith(buffer.toString())) {
                 createSession(response, buffer.toString(), reqtrans, domain);
@@ -748,7 +753,7 @@ public abstract class AbstractServletClient extends HttpServlet {
      * <strong>IMPLEMENTATION NOTE</strong>:  URL decoding is performed
      * individually on the parsed name and value elements, rather than on
      * the entire query string ahead of time, to properly deal with the case
-     * where the name or value includes an encoded "=" or "&" character
+     * where the name or value includes an encoded {@code =} or {@code &} character
      * that would otherwise be interpreted as a delimiter.
      *
      * NOTE: byte array data is modified by this method.  Caller beware.

src/main/java/helma/util/CronJob.java

@@ -450,27 +450,27 @@ public class CronJob {
     cal.setTime(date);
 
     // try and short-circuit as fast as possible.
-    Integer theYear = new Integer(cal.get(Calendar.YEAR));
+    Integer theYear = Integer.valueOf(cal.get(Calendar.YEAR));
     if (!year.contains(ALL_VALUE) && !year.contains(theYear))
       return false;
 
-    Integer theMonth = new Integer(cal.get(Calendar.MONTH));
+    Integer theMonth = Integer.valueOf(cal.get(Calendar.MONTH));
     if (!month.contains(ALL_VALUE) && !month.contains(theMonth))
       return false;
 
-    Integer theDay = new Integer(cal.get(Calendar.DAY_OF_MONTH));
+    Integer theDay = Integer.valueOf(cal.get(Calendar.DAY_OF_MONTH));
     if (!day.contains(ALL_VALUE) && !day.contains(theDay))
       return false;
 
-    Integer theWeekDay = new Integer(cal.get(Calendar.DAY_OF_WEEK));
+    Integer theWeekDay = Integer.valueOf(cal.get(Calendar.DAY_OF_WEEK));
     if (!weekday.contains(ALL_VALUE) && !weekday.contains(theWeekDay))
       return false;
 
-    Integer theHour = new Integer(cal.get(Calendar.HOUR_OF_DAY));
+    Integer theHour = Integer.valueOf(cal.get(Calendar.HOUR_OF_DAY));
     if (!hour.contains(ALL_VALUE) && !hour.contains(theHour))
       return false;
 
-    Integer theMinute = new Integer(cal.get(Calendar.MINUTE));
+    Integer theMinute = Integer.valueOf(cal.get(Calendar.MINUTE));
     if (!minute.contains(ALL_VALUE) && !minute.contains(theMinute))
       return false;
 
@@ -484,7 +484,7 @@ public class CronJob {
   public void addYear(int year)
   {
     this.year.remove(ALL_VALUE);
-    this.year.add(new Integer(year));
+    this.year.add(Integer.valueOf(year));
   }
 
   /**
@@ -492,7 +492,7 @@ public class CronJob {
    */
   public void removeYear(int year)
   {
-    this.year.remove(new Integer(year));
+    this.year.remove(Integer.valueOf(year));
   }
 
   /**
@@ -520,7 +520,7 @@ public class CronJob {
   public void addMonth(int month)
   {
     this.month.remove(ALL_VALUE);
-    this.month.add(new Integer(month));
+    this.month.add(Integer.valueOf(month));
   }
 
   /**
@@ -530,7 +530,7 @@ public class CronJob {
    */
   public void removeMonth(int month)
   {
-    this.month.remove(new Integer(month));
+    this.month.remove(Integer.valueOf(month));
   }
 
   /**
@@ -556,7 +556,7 @@ public class CronJob {
   public void addDay(int day)
   {
     this.day.remove(ALL_VALUE);
-    this.day.add(new Integer(day));
+    this.day.add(Integer.valueOf(day));
   }
 
   /**
@@ -564,7 +564,7 @@ public class CronJob {
    */
   public void removeDay(int day)
   {
-    this.day.remove(new Integer(day));
+    this.day.remove(Integer.valueOf(day));
   }
 
   /**
@@ -592,7 +592,7 @@ public class CronJob {
   public void addWeekday(int weekday)
   {
     this.weekday.remove(ALL_VALUE);
-    this.weekday.add(new Integer(weekday));
+    this.weekday.add(Integer.valueOf(weekday));
   }
 
   /**
@@ -602,7 +602,7 @@ public class CronJob {
    */
   public void removeWeekday(int weekday)
   {
-    this.weekday.remove(new Integer(weekday));
+    this.weekday.remove(Integer.valueOf(weekday));
   }
 
   /**
@@ -628,7 +628,7 @@ public class CronJob {
   public void addHour(int hour)
   {
     this.hour.remove(ALL_VALUE);
-    this.hour.add(new Integer(hour));
+    this.hour.add(Integer.valueOf(hour));
   }
 
   /**
@@ -636,7 +636,7 @@ public class CronJob {
    */
   public void removeHour(int hour)
   {
-    this.hour.remove(new Integer(hour));
+    this.hour.remove(Integer.valueOf(hour));
   }
 
   /**
@@ -662,7 +662,7 @@ public class CronJob {
   public void addMinute(int minute)
   {
     this.minute.remove(ALL_VALUE);
-    this.minute.add(new Integer(minute));
+    this.minute.add(Integer.valueOf(minute));
   }
 
   /**
@@ -670,7 +670,7 @@ public class CronJob {
    */
   public void removeMinute(int minute)
   {
-    this.minute.remove(new Integer(minute));
+    this.minute.remove(Integer.valueOf(minute));
   }
 
   /**

src/main/java/helma/util/HtmlEncoder.java

@@ -127,7 +127,7 @@ public final class HtmlEncoder {
     /**
      *  Do "smart" encodging on a string. This means that valid HTML entities and tags,
      *  Helma macros and HTML comments are passed through unescaped, while
-     *  other occurrences of '<', '>' and '&' are encoded to HTML entities.
+     *  other occurrences of {@code <}, {@code >} and {@code &} are encoded to HTML entities.
      */
     public final static String encode(String str) {
         if (str == null) {
@@ -151,7 +151,7 @@ public final class HtmlEncoder {
     /**
      *  Do "smart" encodging on a string. This means that valid HTML entities and tags,
      *  Helma macros and HTML comments are passed through unescaped, while
-     *  other occurrences of '<', '>' and '&' are encoded to HTML entities.
+     *  other occurrences of {@code <}, {@code >} and {@code &} are encoded to HTML entities.
      */
     public final static void encode(String str, StringBuffer ret) {
         encode(str, ret, false, null);
@@ -160,7 +160,7 @@ public final class HtmlEncoder {
     /**
      *  Do "smart" encodging on a string. This means that valid HTML entities and tags,
      *  Helma macros and HTML comments are passed through unescaped, while
-     *  other occurrences of '<', '>' and '&' are encoded to HTML entities.
+     *  other occurrences of {@code <}, {@code >} and {@code &} are encoded to HTML entities.
      *
      *  @param str the string to encode
      *  @param ret the string buffer to encode to