We Keep Coding

log4j used as property under maven-surefire-plugin , Do I need to change anything as log4j has vulnerability in its version?

log4j used as property under maven-surefire-plugin , Do I need to change anything as log4j has vulnerability in its version? If yes then how to know which version is used by this plugin and how do I update the same.
Plugin configuration goes like this, also my plugin version is 2.12
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>2.12</version>
<configuration>
<systemProperties>
<property>
<name>loggerPath</name>
<value>conf/log4j.properties</value>
</property>
</systemProperties>
<argLine>-Xms512m -Xmx1500m</argLine>
<parallel>methods</parallel>
<forkMode>pertest</forkMode>
</configuration>
</plugin>
Thanks!

I'm not sure that it is even working for you. I didn't see any usage of loggerPath property inside the plugin.
Does it create a proper appender in your tests?
I think you can easily remove systemProperties from here if tests generate logs in the same way they do now.

Set VM option from maven config

Is there any way to set an argument for the command line from the maven config? Maybe some plugin?
I need to run my service on spring boot with the following VM option:
-Dspring.config.additional-location=classpath:/config/business-config.yml
I have tried using maven-surefire-plugin:
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<configuration>
<argLine>
-Dspring.config.additional-location=classpath:/config/business-config.yml
</argLine>
</configuration>
</plugin>
and spring-boot-maven-plugin:
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<configuration>
<jvmArguments>
-Dspring.config.additional-location=classpath:/config/business-config.yml
</jvmArguments>
</configuration>
</plugin>
But that doesn't work for me. I test by running my maven project locally from IDEA Intellij as a Spring Boot application. If I set this option in IDEA configuration then it works properly.
Any ideas why?

Maven is a build tool, not a runtime environment.
For the simplest see The java Command:
java ... -Dproperty=value ...
Sets a system property value. The property variable is a string with no spaces that represents the name of the property. The value variable is a string that represents the value of the property. If value is a string with spaces, then enclose it in quotation marks (for example -Dfoo="foo bar").
Otherwise the container your application is running in has to have a possibility to configure java command line parameters.

How to get argLine to work in maven surefire plugin

I'm having difficulty trying to add an argument to the jvm. It looks like using surefire is the only way to do this. My current code in the pom.xml is
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>2.19</version>
<configuration>
<argLine>-Xmx512m</argLine>
<systemPropertyVariables>
<all.clusters>${all.clusters}</all.clusters>
<branding.token>${brandingToken}</branding.token>
</systemPropertyVariables>
</configuration>
</plugin>
Maven is new to me so perhaps I'm missing something simple.
Running in a Netbeans 8.1 environment.

Turns out that what I needed to do was not to get surefire to run with special arguments, because that only covers tests. The trick to getting it working was the fact that this project is a NetBeans application which uses the
nbm-maven-plugin.
The following blog post describes how to modify the arguments.
Blogpost

Maven Surefire only acknowledges "forkMode" on the command line

We have our POM defining the maven-surefire-plugin as follows:
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>2.14</version>
<configuration>
<reuseForks>false</reuseForks>
<forkCount>1</forkCount>
<argLine>-Xms64m -Xmx256m</argLine>
<includes>
<include>**/*Test.java</include>
</includes>
</configuration>
</plugin>
However, our Java tests (which involve some parallel tests and static singletons) only run properly when we run our test phase/build using:
mvn test -DforkMode=always
Strangely, even if we change our <configuration> to use (instead of the newer options):
<forkMode>always</forkMode>
And run:
mvn test
It will fail. But then if we run:
mvn test -DforkMode=always
It will pass. Instead of the newer options, it still will only work if we explicitly provide forkMode on the command line. We have tried this with multiple versions of the surefire plugin, to the same effect.
Are there any locations where this property could be overridden, or known issues in which the XML configuration is not properly used?

Rookie mistake. The configuration I was using was listed in a separate <profile> block that was not being executed. The profile with:
<activeByDefault>true</activeByDefault>
Did not include its own Surefire configuration at all (so it didn't show up in a search), and was using inherited values, which explains why the command-line system properties were able to affect its behavior.

Integrating Maven reporting plugins

I need to setup Maven plugins. I have downloaded the JARs. Can anyone please tell me what do I do next in order to integrate or setup the plugins with Maven?
Should I copy the JARs into the parent directory or do I need to edit any file?
The plugins are:
Java2HTML
JDepend
Checkstyle
Clover
Cobertura
EMMA
Findbugs
JavaNCSS
PMD
QALab
Xradar
Sonar

If Maven has access to the central repository it will download most plugins (some are not hosted on central, to access those you need to define an additional repository in your pom or settings).
If the dependencies are configured in your POM, Maven will automatically attempt to download them when you run a relevant goal. For the dependencies you listed this is mvn site.
The majority of those jars you've listed are reports, so should be declared in the reporting section of the POM, for example (I would also declare the versions to be sure you're getting the expected plugin):
<reporting>
<plugins>
<plugin>
<artifactId>maven-checkstyle-plugin</artifactId>
</plugin>
<plugin>
<artifactId>maven-pmd-plugin</artifactId>
<configuration>
<linkXref>true</linkXref>
</configuration>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>cobertura-maven-plugin</artifactId>
<version>2.1</version>
<configuration>
<formats>
<format>html</format>
<format>xml</format>
</formats>
<outputDirectory>target/site/cobertura</outputDirectory>
</configuration>
</plugin>
<plugin>
<artifactId>maven-surefire-report-plugin</artifactId>
<configuration>
<outputDirectory>${basedir}/target/surefire-reports</outputDirectory>
</configuration>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>jdepend-maven-plugin</artifactId>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>findbugs-maven-plugin</artifactId>
<configuration>
<xmlOutput>true</xmlOutput>
<effort>Max</effort>
</configuration>
</plugin>
</plugins>
</reporting>
Some background on Maven's plugin execution model:
When you run mvn site, this is short hand for "run the site goal from the latest version of the site plugin", i.e. it is equivalent to mvn site:site, which is in turn shorthand for mvn org.apache.maven.plugins:maven-site-plugin:LATEST:site
Maven will attempt to contact the central repository, determine the LATEST version from the maven-metadata.xml, then download it (and any of its dependencies that are also missing) before executing it.
If you are behind a proxy you may see an error message in your build log like this:
[INFO] The plugin 'org.apache.maven.plugins:maven-site-plugin' does not exist or no valid version could be found
To address this you can declare proxy settings in your Maven settings.xml (in [MVN_HOME]/conf/settings.xml). They are commented out by defualt, but look something like this:
<proxy>
<id>optional</id>
<active>true</active>
<protocol>http</protocol>
<username>proxyuser</username>
<password>proxypass</password>
<host>proxy.host.net</host>
<port>80</port>
<nonProxyHosts>local.net,some.host.com</nonProxyHosts>
</proxy>
Replace the username, password, host, and port values with the relevant for your environment and Maven will be able to download the required dependencies.
For more details on using Maven, check out the Maven: The Definitive Guide by Sonatype, it is online and free.

Sirakov is right; Maven will download and install the plugins automatically when they are used.
You can either run them directly (for one-off jobs), or configure them in your pom.xml - this also allows you to configure then, and set the to run automatically, for example, to generate source code or report on test coverage. A major advantage of this is that you can define a single set of plugin configs in a shared parent pom, and reuse the same configurations across across all your projects, while still being able to override the inherited configuration in each subproject where necessary - this is one of the biggest advantages of using Maven on larger projects.
Each plugin has its own configuration parameters, the standard ones are documented at http://maven.apache.org/plugins/. Another good resource is the O'Reilly Maven book, online at http://www.sonatype.com/books/maven-book/reference/
An example configuration for cobertura:
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-pmd-plugin</artifactId>
<version>2.3</version>
<configuration>
<outputDirectory>${project.build.directory}/pmd</outputDirectory>
<targetDirectory>${project.build.directory}</targetDirectory>
<aggregate>true</aggregate>
<!-- CPD minimum tokens to report on (5 to 10 duplicate lines) -->
<minimumTokens>100</minimumTokens>
<minimumPriority>3</minimumPriority>
<!-- Exclude mock classes -->
<excludes>
<exclude>**/Mock.*</exclude>
<exclude>**/Dummy.*</exclude>
<exclude>**/*Mock.java</exclude>
<exclude>**/*Dummy.java</exclude>
</excludes>
<includeTests>true</includeTests>
<targetJdk>1.5</targetJdk>
<rulesets>
<ruleset>pmd_ruleset.xml</ruleset>
</rulesets>
</configuration>
</plugin>

You don't need to download the plugins manually. I'm not 100% sure, but if you want to use for example the checkstyle plugin, you need to start maven with checkstyle parameter form command line
something like:
mvn checkstyle:checkstyle
or
mvn checkstyle:check
edit1: But you can also put the jars into the local m2 repository with the specific folder structure to access them.
edit2: you can put all your plugins into your own repository and then you need to tell maven (using the pom), which repositories you want to use. Every plugin must be described in the pom.