Parent POM for the Firefly Framework providing centralized dependency management, plugin configuration, and build standards inherited by every framework module.

• Overview
• Features
• Requirements
• Installation
• Quick Start
• Managed Dependencies
• Managed Plugins
• Configuration
• Build Profiles
• Native Image Builds
• SBOM Generation
• Documentation
• Contributing
• License

The Firefly Framework Parent POM (org.fireflyframework:fireflyframework-parent) is the foundational build artifact of the Firefly Framework — a Spring Boot superset providing CQRS, event-driven architecture, a transactional/saga engine, caching, and more. It is the single point of truth for dependency versions, plugin configuration, and build standards inherited by every framework module and downstream microservice.

By declaring this artifact as their Maven <parent>, Firefly modules and applications automatically receive aligned, conflict-free versions for Spring Boot 3.5.x, Spring Cloud 2025.0.x, reactive (R2DBC) and JDBC database drivers, mapping and serialization libraries, gRPC/Protobuf, OpenTelemetry, the major cloud SDKs (AWS, Azure, GCP), SOAP/WS stacks, and testing frameworks — plus ready-to-use build plugins. This removes per-module version bookkeeping and guarantees the whole ecosystem builds against one coherent dependency graph.

Beyond version management, the parent wires the compiler annotation-processor chain (Lombok, MapStruct, the Lombok-MapStruct binding, and the Spring Boot Configuration Processor), enables runtime-visible method parameter names (-parameters), and enforces a JDK 21+ floor via the Maven Enforcer plugin. It defaults to Java 25 with a -Pjava21 profile for backward compatibility, and ships opt-in profiles for GraalVM native images, source/Javadoc release artifacts, and Maven Central publishing.

This is a pure build-infrastructure POM (<packaging>pom</packaging>): it has no Java source, no submodules, and no Spring auto-configuration. It is a parent to inherit, not a dependency to add. Modules that need framework capabilities (caching, EDA, CQRS, orchestration, etc.) inherit this parent and then declare the relevant Firefly module dependencies, whose versions are themselves governed here.

Core Platform

• Centralized dependency management for Spring Boot 3.5.x and Spring Cloud 2025.0.x
• Pre-configured annotation processors (Lombok, MapStruct, Spring Boot Configuration Processor)
• Maven Enforcer plugin requiring JDK 21+
• Java 25 by default with Java 21 backward compatibility via -Pjava21

Database

• Managed versions for PostgreSQL (JDBC and R2DBC), MySQL (R2DBC)
• Flyway database migrations with multi-database support (PostgreSQL, MySQL, SQL Server, Oracle, DB2, HSQLDB, Derby, Informix, Cassandra, ClickHouse, TiDB)

API & Messaging

• OpenAPI Generator plugin for server/client code generation from API specs
• SpringDoc OpenAPI for reactive API documentation
• gRPC 1.79.x and Protobuf 4.x version management
• Apache Avro serialization

Cloud Providers

• AWS SDK 2.x and Spring Cloud AWS
• Spring Cloud Azure
• Spring Cloud GCP

Resilience & Observability

• Resilience4j BOM for fault tolerance patterns
• OpenTelemetry BOM for distributed tracing and metrics
• Logstash Logback Encoder for structured logging

Web Services

• Apache CXF and JAX-WS for SOAP/WS-Security
• WSS4J for WS-Security processing

Testing

• Testcontainers BOM for integration testing
• WireMock for HTTP service simulation

Security & Supply Chain

• GraalVM Native Image support via -Pnative profile with Paketo Buildpacks
• CycloneDX SBOM generation for application dependency transparency
• BouncyCastle for cryptographic operations

• Java 21+ (Java 25 recommended; build defaults to 25, use -Pjava21 for 21)
• Spring Boot 3.x (3.5.x is managed here)
• Maven 3.9+
• Docker (optional — for native image container builds with Paketo Buildpacks)
• GraalVM (optional — for local native image builds)

Declare this as the <parent> of your Firefly Framework module or application. Pin it to the latest released version (see the GitHub releases); use <relativePath/> so Maven resolves it from your repository rather than the local filesystem:

<parent>
    <groupId>org.fireflyframework</groupId>
    <artifactId>fireflyframework-parent</artifactId>
    <version>26.05.08</version>
    <relativePath/>
</parent>

Create a new Firefly Framework module by referencing the parent POM:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>org.fireflyframework</groupId>
        <artifactId>fireflyframework-parent</artifactId>
        <version>26.05.08</version>
        <relativePath/>
    </parent>

    <artifactId>my-firefly-module</artifactId>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webflux</artifactId>
        </dependency>
    </dependencies>
</project>

All dependency versions are inherited automatically from the parent POM.

All plugins are declared in <pluginManagement> so child modules inherit versions and configuration without activating them by default.

The maven-compiler-plugin is pre-configured with:

• Annotation processors: Lombok, MapStruct, Lombok-MapStruct binding, Spring Boot Configuration Processor
• Compiler arguments: -parameters (method parameter names at runtime), -proc:full (full annotation processing)

Key properties that can be overridden in child modules:

<properties>
    <!-- Java version (default: 25) -->
    <java.version>25</java.version>

    <!-- Base package for code generation -->
    <base.package>org.fireflyframework</base.package>

    <!-- OpenAPI generation settings -->
    <openapi.skip.validate>false</openapi.skip.validate>
    <openapi.use.tags>true</openapi.use.tags>
    <openapi.use.optional>true</openapi.use.optional>
    <openapi.date.library>java8</openapi.date.library>
</properties>

The native profile provides infrastructure for building GraalVM native images. It configures two plugins via pluginManagement:

• spring-boot-maven-plugin with process-aot goal for Spring Ahead-of-Time processing
• native-maven-plugin (GraalVM 0.11.4) with build goal for native compilation
• Paketo Buildpacks (paketobuildpacks/builder-jammy-tiny) for containerized native image builds

Child modules opt in by declaring both plugins (version and configuration are inherited):

<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
        </plugin>
        <plugin>
            <groupId>org.graalvm.buildtools</groupId>
            <artifactId>native-maven-plugin</artifactId>
        </plugin>
    </plugins>
</build>

# Local GraalVM native executable (requires GraalVM installed)
mvn -Pnative package

# Containerized native image via Paketo Buildpacks (requires Docker)
mvn -Pnative spring-boot:build-image

Paketo Buildpacks automatically generate container-level SBOMs (Syft, SPDX, CycloneDX) embedded in the built image, covering OS packages, JDK, and buildpack-installed components.

The parent POM provides managed configuration for the CycloneDX Maven Plugin, generating application-level Software Bill of Materials (SBOM) in CycloneDX JSON format.

Declare the plugin (version and configuration are inherited):

<build>
    <plugins>
        <plugin>
            <groupId>org.cyclonedx</groupId>
            <artifactId>cyclonedx-maven-plugin</artifactId>
        </plugin>
    </plugins>
</build>

This generates application.cdx.json at META-INF/sbom/ inside the built JAR, containing all direct and transitive Maven dependencies with versions, licenses, and hashes.

Spring Boot 3.3+ automatically detects the SBOM at META-INF/sbom/application.cdx.json and exposes it via the actuator:

management:
  endpoints:
    web:
      exposure:
        include: health,sbom

The SBOM is then available at GET /actuator/sbom/application.

• Firefly Framework on GitHub — the full module catalog and sibling repositories that inherit this parent
• AOT / Native Image Design — design notes for the native profile in this repo
• Release versions and changelogs: GitHub releases

Contributions are welcome. Please read the CONTRIBUTING.md guide for details on our code of conduct, development process, and how to submit pull requests.

Copyright 2024-2026 Firefly Software Foundation.

Licensed under the Apache License, Version 2.0. See LICENSE for details.