faces-migrate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited faces-migrate (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Version 1.2.3
Migrate the current project to Jakarta Faces $ARGUMENTS (if no argument, ask the developer for the target version).
Determine the current Faces version from:
pom.xml or build.gradle dependencies (look for javax.faces, jakarta.faces, jsf-api, myfaces-api).faces-config.xml version attribute.java.sun.com = JSF 1.0+, xmlns.jcp.org = JSF 2.2+, jakarta.faces = Faces 4.0+).javax.faces = JSF 1.x/2.x vs jakarta.faces = Faces 3.0+).Also determine the runtime type:
<scope>provided</scope>, not on standalone implementations.When updating dependencies in migration steps, update the appropriate artifact:
javax:javaee-web-api:8.0 with <scope>provided</scope>jakarta.platform:jakarta.jakartaee-web-api:9.0.0 with <scope>provided</scope>jakarta.platform:jakarta.jakartaee-web-api:10.0.0 with <scope>provided</scope>jakarta.platform:jakarta.jakartaee-web-api:11.0.0 with <scope>provided</scope>org.glassfish:jakarta.faces for Mojarra, org.apache.myfaces.core:myfaces-impl for MyFaces); do NOT use javaee-api or jakarta.jakartaee-api as a substitute because it will allow compiling against APIs that the servlet container doesn't actually provide.Report the detected version and runtime type, and confirm with the developer before proceeding.
Based on source → target version, apply the relevant steps below. Multiple steps may apply for multi-version jumps (e.g. JSF 2.0 → Faces 4.1 requires all intermediate steps).
This is a significant migration; confirm scope with developer before proceeding.
<f:view>, <f:subview> with Facelets templating (<ui:composition>, <ui:define>).<managed-bean> entries in faces-config.xml with @ManagedBean + scope annotations (will be migrated to @Named in later step).<navigation-rule> entries in faces-config.xml with return values from action methods or ?faces-redirect=true.javax.faces.webapp.FacesServlet URL pattern /faces/* or *.faces or *.jsf with *.xhtml.pom.xml to JSF 2.3 dependency.@ManagedBean + @javax.faces.bean.*Scoped with @Named + @javax.enterprise.context.*Scoped.@ViewScoped: replace javax.faces.bean.ViewScoped with javax.faces.view.ViewScoped.beans.xml exists in WEB-INF/ with bean-discovery-mode="all" or "annotated".@javax.faces.bean.ManagedProperty on managed beans with @Inject.@javax.faces.bean.ManagedProperty on unmanaged variables with @javax.faces.annotation.ManagedProperty.*.xhtml; remove legacy *.jsf, *.faces, /faces/* mappings.faces-config.xml version to 2.3. <faces-config
xmlns="https://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://xmlns.jcp.org/xml/ns/javaee https://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_3.xsd"
version="2.3"
>*.taglib.xml version to 2.3. <facelet-taglib
xmlns="https://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://xmlns.jcp.org/xml/ns/javaee https://xmlns.jcp.org/xml/ns/javaee/web-facelettaglibrary_2_3.xsd"
version="2.3"
>java.sun.com to xmlns.jcp.org (if on JSF 2.2+).<!DOCTYPE html> (if on JSF 2.2+).This is purely a package rename; no behavioral changes.
pom.xml to Jakarta Faces 3.0 dependency.javax.faces.* imports to jakarta.faces.* in Java files.javax.servlet.* to jakarta.servlet.*.javax.inject.* to jakarta.inject.*.javax.enterprise.* to jakarta.enterprise.*.javax.annotation.* to jakarta.annotation.*.javax.validation.* to jakarta.validation.*.javax.persistence.* to jakarta.persistence.* (if JPA is used).javax.ejb.* to jakarta.ejb.* (if EJB is used).javax.ws.rs.* to jakarta.ws.rs.* (if JAX-RS is used).web.xml context param names from javax.faces.* to jakarta.faces.*.*.xhtml; remove legacy *.jsf, *.faces, /faces/* mappings.faces-config.xml namespace and version to 3.0. <faces-config
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facesconfig_3_0.xsd"
version="3.0"
>*.taglib.xml namespace and version to 3.0. <facelet-taglib
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facelettaglibrary_3_0.xsd"
version="3.0"
>xmlns.jcp.org) in Faces 3.0; they only change in 4.0.<!DOCTYPE html> (if not already).pom.xml to Jakarta Faces 4.0 dependency.xmlns.jcp.org to jakarta.faces URNs:http://xmlns.jcp.org/jsf/html → jakarta.faces.htmlhttp://xmlns.jcp.org/jsf/core → jakarta.faces.corehttp://xmlns.jcp.org/jsf/facelets → jakarta.faces.faceletshttp://xmlns.jcp.org/jsf/composite → jakarta.faces.compositehttp://xmlns.jcp.org/jsf/passthrough → jakarta.faces.passthroughhttp://xmlns.jcp.org/jsf → jakarta.faceshttp://xmlns.jcp.org/jsp/jstl/core → jakarta.tags.corexmlns="http://www.w3.org/1999/xhtml" from XHTML files; since Faces 4.0 it is always implied.@ManagedBean usage (removed in Faces 4.0); replace with @Named + CDI scope.javax.faces.bean.* imports (package removed entirely).*.xhtml; remove legacy *.jsf, *.faces, /faces/* mappings.faces-config.xml version to 4.0. <faces-config
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facesconfig_4_0.xsd"
version="4.0"
>*.taglib.xml version to 4.0. <facelet-taglib
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facelettaglibrary_4_0.xsd"
version="4.0"
><!DOCTYPE html> (if not already).pom.xml to Jakarta Faces 4.1 dependency.faces-config.xml version to 4.1. <faces-config
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facesconfig_4_1.xsd"
version="4.1"
>*.taglib.xml version to 4.1. <facelet-taglib
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facelettaglibrary_4_1.xsd"
version="4.1"
>FULL_STATE_SAVING_VIEW_IDS) usage; FSS is deprecated and will be removed in Faces 6.0.For each applicable migration step:
After migration:
pom.xml/build.gradle has no conflicting dependency versions./faces-review to catch any remaining issues.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.