{"id":15024536,"url":"https://github.com/michael-simons/wro4j-spring-boot-starter","last_synced_at":"2025-09-07T01:38:36.745Z","repository":{"id":3590568,"uuid":"50037913","full_name":"michael-simons/wro4j-spring-boot-starter","owner":"michael-simons","description":"A Spring Boot starter and auto-configuration for wro4j (http://alexo.github.io/wro4j/)","archived":false,"fork":false,"pushed_at":"2025-09-01T07:02:11.000Z","size":522,"stargazers_count":71,"open_issues_count":2,"forks_count":6,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-09-01T12:50:00.918Z","etag":null,"topics":["java","spring-boot","starter","wro4j"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/michael-simons.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE-2.0.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2016-01-20T15:09:57.000Z","updated_at":"2025-08-13T11:14:33.000Z","dependencies_parsed_at":"2024-03-19T18:27:05.855Z","dependency_job_id":"50a13be2-ec71-430f-b820-fc23b0d37145","html_url":"https://github.com/michael-simons/wro4j-spring-boot-starter","commit_stats":{"total_commits":366,"total_committers":6,"mean_commits":61.0,"dds":0.2595628415300546,"last_synced_commit":"8e617c442987d4bccc6610eff234338e406f58eb"},"previous_names":["michael-simons/spring-boot-starter-wro4j"],"tags_count":54,"template":false,"template_full_name":null,"purl":"pkg:github/michael-simons/wro4j-spring-boot-starter","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/michael-simons%2Fwro4j-spring-boot-starter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/michael-simons%2Fwro4j-spring-boot-starter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/michael-simons%2Fwro4j-spring-boot-starter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/michael-simons%2Fwro4j-spring-boot-starter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/michael-simons","download_url":"https://codeload.github.com/michael-simons/wro4j-spring-boot-starter/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/michael-simons%2Fwro4j-spring-boot-starter/sbom","scorecard":{"id":640860,"data":{"date":"2025-08-11","repo":{"name":"github.com/michael-simons/wro4j-spring-boot-starter","commit":"ebd7536e4ae0817773d62af466a09d919027fb95"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.4,"checks":[{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/maven.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Maintained","score":5,"reason":"6 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Binary-Artifacts","score":9,"reason":"binaries present in source code","details":["Warn: binary detected: .mvn/wrapper/maven-wrapper.jar:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Code-Review","score":0,"reason":"Found 0/27 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/michael-simons/wro4j-spring-boot-starter/maven.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/michael-simons/wro4j-spring-boot-starter/maven.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/michael-simons/wro4j-spring-boot-starter/maven.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/michael-simons/wro4j-spring-boot-starter/maven.yml/master?enable=pin","Info:   0 out of   4 GitHub-owned GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE-2.0.txt:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 14 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":6,"reason":"4 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-78wr-2p64-hpwj","Warn: Project is vulnerable to: GHSA-j288-q9x7-2f5v","Warn: Project is vulnerable to: GHSA-h3gc-qfqq-6h8f","Warn: Project is vulnerable to: GHSA-wc4r-xq3c-5cf3"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-21T10:41:48.834Z","repository_id":3590568,"created_at":"2025-08-21T10:41:48.834Z","updated_at":"2025-08-21T10:41:48.834Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":273986613,"owners_count":25202704,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-06T02:00:13.247Z","response_time":2576,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["java","spring-boot","starter","wro4j"],"created_at":"2024-09-24T20:00:30.948Z","updated_at":"2025-09-07T01:38:36.734Z","avatar_url":"https://github.com/michael-simons.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# wro4j-spring-boot-starter\n\nA Spring Boot starter and auto-configuration for wro4j:\n\n\u003e [Wro4j](http://alexo.github.io/wro4j/) is a tool for analysis and optimization of web resources. It brings together almost all the modern web tools: JsHint, CssLint, JsMin, Google Closure compressor, YUI Compressor, UglifyJs, Dojo Shrinksafe, Css Variables Support, JSON Compression, Less, Sass, CoffeeScript and much more.\n\n[![Build Status](https://github.com/michael-simons/wro4j-spring-boot-starter/workflows/build/badge.svg)](https://github.com/michael-simons/wro4j-spring-boot-starter/actions) [![Test coverage](https://sonarcloud.io/api/project_badges/measure?project=eu.michael-simons%3Awro4j-spring-boot-starter\u0026metric=coverage)](https://sonarcloud.io/dashboard?id=eu.michael-simons%3Awro4j-spring-boot-starter) [![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=eu.michael-simons%3Awro4j-spring-boot-starter\u0026metric=alert_status)](https://sonarcloud.io/dashboard?id=eu.michael-simons%3Awro4j-spring-boot-starter) [![Maven Central](https://maven-badges.herokuapp.com/maven-central/eu.michael-simons/wro4j-spring-boot-starter/badge.svg)](https://maven-badges.herokuapp.com/maven-central/eu.michael-simons/wro4j-spring-boot-starter)\n\n*NOTE* Wro4j has been updated to the Jakarta Servlet API with Wro4j 2 and it does now require Java 17, similar to Spring Boot 3. This integration has been upgraded to support Wro4j 2 on Spring Boot 3 since release 0.12.1.\n\n\n## Introduction\n\nThis starter does the following auto configuration for you:\n\n* Creating the _WroFilter_ and the _WroModelFactory_\n* Registering them as a ServletFilter through a Spring _FilterRegistrationBean_\n\nFurthermore it provides a Spring Based caching strategy if a [CacheManager](https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/cache/CacheManager.html) is present (which is the case if you're Spring Boot Application is configured with [@EnableCaching](https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/cache/annotation/EnableCaching.html)) and a cache name is configured.\n\nThe wro4j-spring-boot-starter expecteds the Wro4j model configuration in xml format. If you want the Groovy version you have to role your own _WroModelFactory_, which is recognized by the auto configuration.\n\nThis starter doesn't bring in the _wro4j-extension_ artifact which are a lot of third party libraries. If you need them, you have to include this in your Maven or Gradle build file.\n\nWith the starter comes an additional resource processor _removeSourceMaps_ which removes stale source maps from minified and concatenated files.\n\nThis starter is in production at [euregjug.eu](http://www.euregjug.eu) and in various [ENERKO Informatik](http://www.enerko-informatik.de) products.\n\n## Usage and configuration\n\nJust include the starter in your pom.xml:\n\n```\n\u003cdependency\u003e\n    \u003cgroupId\u003eeu.michael-simons\u003c/groupId\u003e\n    \u003cartifactId\u003ewro4j-spring-boot-starter\u003c/artifactId\u003e\n    \u003cversion\u003e0.14.1\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\nThese versions have been tested together:\n\n| Spring Boot | Wro4j Starter    |\n|-------------|------------------|\n| 2.0.x       | 0.4.2            |\n| 2.1.x       | 0.5.3            |\n| 2.2.x       | 0.6.3            |\n| 2.3.x       | 0.7.2            |\n| 2.4.x       | 0.8.x            |\n| 2.5.x       | 0.9.x            |\n| 2.6.x       | 0.10.x           |\n| 2.7.x       | 0.11.x           |\n| 3.1.x       | 0.12.x           |\n| 3.2.x       | 0.13.x           |\n| 3.3.x       | 0.14.x or 0.15.x |\n| 3.4.x       | 0.16.x           |\n| 3.5.x       | 0.17.x           |\n\nAdd a wro.xml to your resources:\n\n```\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003cgroups xmlns=\"http://www.isdc.ro/wro\"\u003e\n\u003c/groups\u003e\n```\n\nincluding your CSS and JS files, and you're pretty much good to go. Be aware that this file belongs to your resources (i.e. /src/main/resources) and not under your WEB-INF directory as without the starter. I prefer having those configurations in one place. Read more about the wro.xml format at the official [Wro4j documentation](http://wro4j.readthedocs.org/en/stable/GettingStarted/#step-3-create-wroxml-under-web-inf-directory-and-organize-your-resources-in-groups).\n\nTo actually minify your resources, you have to configure some processors. The starter is used at [euregjug.eu](http://www.euregjug.eu) for example with the following configuration:\n\n```\nwro4j.managerFactory.preProcessors = removeSourceMaps, cssUrlRewriting, cssImport, cssMinJawr, semicolonAppender, jsMin\n```\n\nHave a look at the configuration of the JUGs site at the source [here](https://github.com/EuregJUG-Maas-Rhine/site). If you're already looking for a solution to use Wro4j with Spring Boot and found this starter than i guess you already know about the runtime solution Wro4j provides for your CSS and JS resources.\n\nYou can use all processors as described [here](http://wro4j.readthedocs.org/en/stable/AvailableProcessors/).\n\nFor further configuration you can use all properties described under [Available Configuration Options](http://wro4j.readthedocs.org/en/stable/ConfigurationOptions/) under the namespace _wro4j.*_, the options for configuring the pre- and postprocessors are under the subnamespace _wro4j.managerFactory.*_, as _wro4j.managerFactory.preProcessors_ and _wro4j.managerFactory.postProcessors_.\n\nAs an alternative, you can add processors via their fully qualified classname as _wro4j.preProcessors_ and _wro4j.postProcessors_. Configuring the processors via name or fully qualified class are mutually exclusive.\n\n### Configuration of Pre- and PostProcessors\n\nYou can configure Pre- and PostProcessors at two different points:\n\nIf you use `wro4j.managerFactory.preProcessors` and `wro4j.managerFactory.postProcessors` you must use predefined [aliases](http://wro4j.readthedocs.io/en/stable/RegisterCustomProcessors/?highlight=alias) or register your own processor provider as described in the comments of [issue #3](https://github.com/michael-simons/wro4j-spring-boot-starter/issues/3).\n\nYou can however use \"our\" custom options `wro4j.preProcessors` and `wro4j.postProcessors` (note the difference: No manager factory in between!). Those options take a comma separated list of classes that must implement `ResourcePreProcessor` and `ResourcePostProcessor` respectively.\n\nIf you do this, the `wro4j-spring-boot-starter` first checks, if a bean of the given type exists in the application context. This way, you can manage your processors as normal Spring beans. The only thing you have to take care of is to make sure that those are present in the context before `Wro4jAutoConfiguration` runs. See the example [Wro4jAutoConfigurationIntegrationTests](https://github.com/michael-simons/wro4j-spring-boot-starter/blob/master/src/test/java/ac/simons/spring/boot/wro4j/Wro4jAutoConfigurationIntegrationTests.java#L95).\n\n### Options not present in the original Wro4j version\n\n\u003ctable\u003e\n        \u003cthead\u003e\n                \u003ctr\u003e\n                        \u003cth\u003eOption\u003c/th\u003e\n                        \u003cth\u003eDefault\u003c/th\u003e\n                        \u003cth\u003eMeaning\u003c/th\u003e\n                \u003c/tr\u003e\n        \u003c/thead\u003e\n        \u003ctfoot /\u003e\n        \u003ctbody\u003e\n                \u003ctr\u003e\n                        \u003ctd\u003ewro4j.model\u003c/td\u003e\n                        \u003ctd\u003e/wro.xml\u003c/td\u003e\n                        \u003ctd\u003eThe resource containing the Wro4j model definition (will be looked up as a classloader resource, not inside WEB-INF)\u003c/td\u003e\n                \u003c/tr\u003e\n                \u003ctr\u003e\n                        \u003ctd\u003ewro4j.filterUrl\u003c/td\u003e\n                        \u003ctd\u003e/wro4j\u003c/td\u003e\n                        \u003ctd\u003eUrl to which the filter is mapped. Will be expanded to \u003cem\u003evalue/*\u003c/em\u003e\u003c/td\u003e\n                \u003c/tr\u003e\n                \u003ctr\u003e\n                        \u003ctd\u003ewro4j.cacheName\u003c/td\u003e\n                        \u003ctd\u003e\u003c/td\u003e\n                        \u003ctd\u003eThe name of a Spring Cache. If this property is set and a CacheManager is configured (for example through @EnableCaching), then a CacheStrategy based on Spring cache abstraction will be used.\u003c/td\u003e\n                \u003c/tr\u003e\n        \u003c/tbody\u003e\n\u003c/table\u003e\n\n### Custom filter registrations\n\nSince 0.15.1 you are able to customize the registration of the Wro4jFilter with a custom `FilterRegistrationBean` by defining such a bean in one of your configuration classes like this:\n\n```java\n@Bean\nFilterRegistrationBean\u003cConfigurableWroFilter\u003e wro4jFilterRegistration(ConfigurableWroFilter wroFilter, Wro4jProperties wro4jProperties) {\n\n    var filterRegistrationBean = new FilterRegistrationBean\u003c\u003e(wroFilter);\n    filterRegistrationBean.setUrlPatterns(List.of(\"/whatever/*\"));\n    filterRegistrationBean.setOrder(4711);\n    // whatever else you want to configure\n    return filterRegistrationBean;\n}\n```\n\n###  Misc\n\nBeans of the following types are recognized and added to wro4j\n\n* `ResourceAuthorizationManager`\n\n### Not configurable at the moment\n\nThe options _uriLocators_, _namingStrategy_ and _hashStrategy_ are not configurable at the moment through this starter. If you need those, you have to provide your own _WroManagerFactory_ as a Spring Bean, configured to your needs. The starter will still configure the model and processors factories for you and pass them to your manager factory, though.\n\n## Acknowledgements\n\nI've been using Wro4j as a runtime solution since 2012 on [dailyfratze.de](https://dailyfratze.de) and it really worked well for me. Thanks [Alex](https://twitter.com/wro4j) for your work.\n\nAs always, the Spring documentation is a valuable resource. Here's how to start your own auto-configuration or starter: [Creating your own auto-configuration](https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-developing-auto-configuration.html). Thanks to all the people involved.\n\nThere's another Wro4j [starter](https://github.com/sbuettner/spring-boot-autoconfigure-wro4j) by Simon Buettner from which I had the basic idea, but I didn't like the fact that it centers around the Groovy model and especially the whole wro4-extensions.\n\n## Examples\n\n* [euregjug.eu](http://www.euregjug.eu), Source code here [github.com/EuregJUG-Maas-Rhine/site](https://github.com/EuregJUG-Maas-Rhine/site). Pretty standard site that uses a theme from [html5up](http://html5up.net), some JQuery.\n* [biking2](http://biking.michael-simons.eu), Source code here [github.com/michael-simons/biking2](https://github.com/michael-simons/biking2). A full-blown AngularJS application.\n* [Minimal working example](https://github.com/michael-simons/wro4j-spring-boot-starter/files/901848/wro4jdemo.zip), created as a request in [#6](https://github.com/michael-simons/wro4j-spring-boot-starter/issues/6). Just download, unzip and run with `mvn spring-boot:run` to see it working.\n* [An example using the wroj4-extensions, especially the SASS/SCSS processor](https://github.com/michael-simons/wro4j-spring-boot-starter/files/947239/wro4jscssdemo.zip), again, just download, unzip and run with `mvn spring-boot:run` to see it working. See explanation in [#7](https://github.com/michael-simons/wro4j-spring-boot-starter/issues/7).\n\n[ENERKO Informatik GmbH](http://www.enerko-informatik.de) is using Wro4j and this starter in several products as well.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmichael-simons%2Fwro4j-spring-boot-starter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmichael-simons%2Fwro4j-spring-boot-starter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmichael-simons%2Fwro4j-spring-boot-starter/lists"}