Maven tweaks

[nscuro]

• Use properties to define dependency versions
• Add maven.config with common settings

[Copilot]

Pull Request Overview

This PR centralizes dependency versions in Maven properties, updates imports for nullability annotations, and adds global Maven CLI settings.

• Define version properties for all project dependencies in pom.xml
• Update <dependency> entries to reference the new properties
• Replace jakarta.annotation.Nullable imports with org.jspecify.annotations.Nullable in record classes
• Add .mvn/maven.config to enable --errors and --no-transfer-progress flags

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/main/java/org/dependencytrack/vulndb/store/VulnerabilityRatingRecord.java	Swap nullable import to jspecify
src/main/java/org/dependencytrack/vulndb/store/VulnerabilityDataRecord.java	Swap nullable import to jspecify
src/main/java/org/dependencytrack/vulndb/store/SourceMetadataRecord.java	Swap nullable import to jspecify
pom.xml	Introduce version properties and update all <version> entries
.mvn/maven.config	Add Maven CLI flags for errors and transfer progress suppression

Comments suppressed due to low confidence (3)

src/main/java/org/dependencytrack/vulndb/store/VulnerabilityRatingRecord.java:5

• jspecify @nullable annotations have SOURCE retention and are not retained at runtime. If any reflection-based or serialization processes depend on jakarta.annotation.Nullable, this change could break nullability handling. Consider verifying the runtime requirements or reinstating a runtime-retained annotation.

import org.jspecify.annotations.Nullable;

src/main/java/org/dependencytrack/vulndb/store/VulnerabilityDataRecord.java:6

• jspecify @nullable is SOURCE-only, so any libraries or frameworks that use runtime retention to detect nullability (e.g., JSON mappers) may no longer recognize this annotation. Confirm that replacing jakarta.annotation.Nullable won't disrupt runtime behavior.

import org.jspecify.annotations.Nullable;

src/main/java/org/dependencytrack/vulndb/store/SourceMetadataRecord.java:3

• Replacing jakarta.annotation.Nullable with jspecify @nullable removes runtime retention. Ensure that any downstream tools or validation logic dependent on runtime nullability annotations remain functional or adjust accordingly.

import org.jspecify.annotations.Nullable;