Parent POM for the Firefly Framework providing centralized dependency management, plugin configuration, and build standards for all framework modules.

• Overview
• Features
• Requirements
• Installation
• Quick Start
• Managed Dependencies
• Managed Plugins
• Configuration
• Build Profiles
• Native Image Builds
• SBOM Generation
• Contributing
• License

The Firefly Framework Parent POM serves as the foundational build configuration for all Firefly Framework modules. It centralizes dependency version management, plugin configurations, and build standards to ensure consistency across the entire framework ecosystem.

By inheriting from this parent POM, all Firefly modules automatically receive managed versions for Spring Boot 3.5.x, Spring Cloud 2025.0.x, database drivers, mapping libraries, testing frameworks, and build plugins. This eliminates version conflicts and simplifies dependency management across the framework.

The parent POM also configures annotation processors for Lombok, MapStruct, and Spring Boot Configuration Processor, along with Maven Enforcer rules requiring JDK 21+.

Core Platform

• Centralized dependency management for Spring Boot 3.5.x and Spring Cloud 2025.0.x
• Pre-configured annotation processors (Lombok, MapStruct, Spring Boot Configuration Processor)
• Maven Enforcer plugin requiring JDK 21+
• Java 25 by default with Java 21 backward compatibility via -Pjava21

Database

• Managed versions for PostgreSQL (JDBC and R2DBC), MySQL (R2DBC)
• Flyway database migrations with multi-database support (PostgreSQL, MySQL, SQL Server, Oracle, DB2, HSQLDB, Derby, Informix, Cassandra, ClickHouse, TiDB)

API & Messaging

• OpenAPI Generator plugin for server/client code generation from API specs
• SpringDoc OpenAPI for reactive API documentation
• gRPC 1.79.x and Protobuf 4.x version management
• Apache Avro serialization

Cloud Providers

• AWS SDK 2.x and Spring Cloud AWS
• Spring Cloud Azure
• Spring Cloud GCP

Resilience & Observability

• Resilience4j BOM for fault tolerance patterns
• OpenTelemetry BOM for distributed tracing and metrics
• Logstash Logback Encoder for structured logging

Web Services

• Apache CXF and JAX-WS for SOAP/WS-Security
• WSS4J for WS-Security processing

Testing

• Testcontainers BOM for integration testing
• WireMock for HTTP service simulation

Security & Supply Chain

• GraalVM Native Image support via -Pnative profile with Paketo Buildpacks
• CycloneDX SBOM generation for application dependency transparency
• BouncyCastle for cryptographic operations

• Java 21+
• Maven 3.9+
• Docker (for native image container builds with Paketo)
• GraalVM (for local native image builds, optional)

Use this as a parent POM in your Firefly Framework module:

<parent>
    <groupId>org.fireflyframework</groupId>
    <artifactId>fireflyframework-parent</artifactId>
    <version>26.02.06</version>
    <relativePath/>
</parent>

Create a new Firefly Framework module by referencing the parent POM:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>org.fireflyframework</groupId>
        <artifactId>fireflyframework-parent</artifactId>
        <version>26.02.06</version>
        <relativePath/>
    </parent>

    <artifactId>my-firefly-module</artifactId>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webflux</artifactId>
        </dependency>
    </dependencies>
</project>

All dependency versions are inherited automatically from the parent POM.

All plugins are declared in <pluginManagement> so child modules inherit versions and configuration without activating them by default.

The maven-compiler-plugin is pre-configured with:

• Annotation processors: Lombok, MapStruct, Lombok-MapStruct binding, Spring Boot Configuration Processor
• Compiler arguments: -parameters (method parameter names at runtime), -proc:full (full annotation processing)

Key properties that can be overridden in child modules:

<properties>
    <!-- Java version (default: 25) -->
    <java.version>25</java.version>

    <!-- Base package for code generation -->
    <base.package>org.fireflyframework</base.package>

    <!-- OpenAPI generation settings -->
    <openapi.skip.validate>false</openapi.skip.validate>
    <openapi.use.tags>true</openapi.use.tags>
    <openapi.use.optional>true</openapi.use.optional>
    <openapi.date.library>java8</openapi.date.library>
</properties>

The native profile provides infrastructure for building GraalVM native images. It configures two plugins via pluginManagement:

• spring-boot-maven-plugin with process-aot goal for Spring Ahead-of-Time processing
• native-maven-plugin (GraalVM 0.11.4) with build goal for native compilation
• Paketo Buildpacks (paketobuildpacks/builder-jammy-tiny) for containerized native image builds

Child modules opt in by declaring both plugins (version and configuration are inherited):

<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
        </plugin>
        <plugin>
            <groupId>org.graalvm.buildtools</groupId>
            <artifactId>native-maven-plugin</artifactId>
        </plugin>
    </plugins>
</build>

# Local GraalVM native executable (requires GraalVM installed)
mvn -Pnative package

# Containerized native image via Paketo Buildpacks (requires Docker)
mvn -Pnative spring-boot:build-image

Paketo Buildpacks automatically generate container-level SBOMs (Syft, SPDX, CycloneDX) embedded in the built image, covering OS packages, JDK, and buildpack-installed components.

The parent POM provides managed configuration for the CycloneDX Maven Plugin, generating application-level Software Bill of Materials (SBOM) in CycloneDX JSON format.

Declare the plugin (version and configuration are inherited):

<build>
    <plugins>
        <plugin>
            <groupId>org.cyclonedx</groupId>
            <artifactId>cyclonedx-maven-plugin</artifactId>
        </plugin>
    </plugins>
</build>

This generates application.cdx.json at META-INF/sbom/ inside the built JAR, containing all direct and transitive Maven dependencies with versions, licenses, and hashes.

Spring Boot 3.3+ automatically detects the SBOM at META-INF/sbom/application.cdx.json and exposes it via the actuator:

management:
  endpoints:
    web:
      exposure:
        include: health,sbom

The SBOM is then available at GET /actuator/sbom/application.

Contributions are welcome. Please read the CONTRIBUTING.md guide for details on our code of conduct, development process, and how to submit pull requests.

Copyright 2024-2026 Firefly Software Solutions Inc.

Licensed under the Apache License, Version 2.0. See LICENSE for details.