faces-migrate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited faces-migrate (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Version 1.9.0
Migrate the current project to Jakarta Faces $ARGUMENTS (if no argument, ask the developer for the target version).
Determine the current Faces version from:
pom.xml or build.gradle dependencies (look for javax.faces, jakarta.faces, jsf-api, myfaces-api).faces-config.xml version attribute.java.sun.com = JSF 1.0+, xmlns.jcp.org = JSF 2.2+, jakarta.faces = Faces 4.0+).javax.faces = JSF 1.x/2.x vs jakarta.faces = Faces 3.0+).Also determine the runtime type:
<scope>provided</scope>, not on standalone implementations.When updating dependencies in migration steps, update the appropriate artifact:
javax:javaee-web-api:8.0 with <scope>provided</scope>jakarta.platform:jakarta.jakartaee-web-api:9.0.0 with <scope>provided</scope>jakarta.platform:jakarta.jakartaee-web-api:10.0.0 with <scope>provided</scope>jakarta.platform:jakarta.jakartaee-web-api:11.0.0 with <scope>provided</scope>org.glassfish:jakarta.faces for Mojarra, org.apache.myfaces.core:myfaces-impl for MyFaces); do NOT use javaee-api or jakarta.jakartaee-api as a substitute because it will allow compiling against APIs that the servlet container doesn't actually provide.Report the detected version and runtime type, and confirm with the developer before proceeding.
Based on source → target version, apply the relevant steps below. Multiple steps may apply for multi-version jumps (e.g. JSF 2.0 → Faces 4.1 requires all intermediate steps).
This is a significant migration; confirm scope with developer before proceeding.
<f:view>, <f:subview> with Facelets templating (<ui:composition>, <ui:define>).<managed-bean> entries in faces-config.xml with @ManagedBean + scope annotations (will be migrated to @Named in later step).<navigation-rule> entries in faces-config.xml with return values from action methods or ?faces-redirect=true.javax.faces.webapp.FacesServlet URL pattern /faces/* or *.faces or *.jsf with *.xhtml.pom.xml to JSF 2.3 dependency.@ManagedBean + @javax.faces.bean.*Scoped with @Named + @javax.enterprise.context.*Scoped.@ViewScoped: replace javax.faces.bean.ViewScoped with javax.faces.view.ViewScoped.@javax.faces.bean.ManagedProperty on managed beans with @Inject.@javax.faces.bean.ManagedProperty on unmanaged variables with @javax.faces.annotation.ManagedProperty.*.xhtml; remove legacy *.jsf, *.faces, /faces/* mappings.faces-config.xml version to 2.3. <faces-config
xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_3.xsd"
version="2.3"
>*.taglib.xml version to 2.3. <facelet-taglib
xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facelettaglibrary_2_3.xsd"
version="2.3"
>java.sun.com to xmlns.jcp.org (if on JSF 2.2+).<!DOCTYPE html> (if on JSF 2.2+).web.xml and its declared version lags behind Servlet 4.0 (Java EE 8), update it. If it still carries a legacy DTD-based DOCTYPE declaration (pre-Servlet 2.4), drop it entirely — the XML Schema xmlns/xsi:schemaLocation form below replaces it. <web-app
xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
version="4.0"
>beans.xml exists in WEB-INF/, and update it to CDI 2.0 (Java EE 8) when it lags behind. Once a version attribute is present, bean-discovery-mode is required alongside it. Prefer annotated: @Named plus a CDI scope is a bean defining annotation, so Faces beans are discovered either way. <beans
xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_2_0.xsd"
version="2.0"
bean-discovery-mode="annotated"
>This is purely a package rename; no behavioral changes.
pom.xml to Jakarta Faces 3.0 dependency.javax.faces.* imports to jakarta.faces.* in Java files.javax.servlet.* to jakarta.servlet.*.javax.inject.* to jakarta.inject.*.javax.enterprise.* to jakarta.enterprise.*.javax.annotation.* to jakarta.annotation.*.javax.validation.* to jakarta.validation.*.javax.persistence.* to jakarta.persistence.* (if JPA is used).javax.ejb.* to jakarta.ejb.* (if EJB is used).javax.ws.rs.* to jakarta.ws.rs.* (if JAX-RS is used).web.xml context param names from javax.faces.* to jakarta.faces.*.javax/faces/Messages*.properties from the project's own resources to jakarta/faces/, keeping the locale suffixes (Messages_it.properties, Messages_nl_BE.properties, etc.).javax.faces.* to jakarta.faces.* (e.g. javax.faces.component.UIInput.REQUIRED → jakarta.faces.component.UIInput.REQUIRED).<message-bundle> in faces-config.xml and in all its locale variants, if any. The declared name is a base name; the file names are project-chosen and stay as-is, only the keys change.javax.validation.constraints.*.message keys to jakarta.validation.constraints.*.message in ValidationMessages*.properties, if present.<resource-bundle> in faces-config.xml hold application-defined keys and need no key rename.*.xhtml; remove legacy *.jsf, *.faces, /faces/* mappings.faces-config.xml namespace and version to 3.0. <faces-config
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facesconfig_3_0.xsd"
version="3.0"
>*.taglib.xml namespace and version to 3.0. <facelet-taglib
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facelettaglibrary_3_0.xsd"
version="3.0"
>xmlns.jcp.org) in Faces 3.0; they only change in 4.0.<!DOCTYPE html> (if not already).web.xml and its declared version lags behind Servlet 5.0 (Jakarta EE 9), update it. <web-app
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_5_0.xsd"
version="5.0"
>beans.xml namespace and version to CDI 3.0 (Jakarta EE 9), keeping the existing bean-discovery-mode, which stays required next to version. <beans
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
version="3.0"
bean-discovery-mode="annotated"
>pom.xml to Jakarta Faces 4.0 dependency.xmlns.jcp.org to jakarta.faces URNs:http://xmlns.jcp.org/jsf/html → jakarta.faces.htmlhttp://xmlns.jcp.org/jsf/core → jakarta.faces.corehttp://xmlns.jcp.org/jsf/facelets → jakarta.faces.faceletshttp://xmlns.jcp.org/jsf/composite → jakarta.faces.compositehttp://xmlns.jcp.org/jsf/passthrough → jakarta.faces.passthroughhttp://xmlns.jcp.org/jsf/component → jakarta.faces.componenthttp://xmlns.jcp.org/jsp/jstl/core → jakarta.tags.corehttp://xmlns.jcp.org/jsf → jakarta.facesnamespace = "http://xmlns.jcp.org/jsf/component" on @FacesComponent as well, or drop the attribute so it follows FacesComponent.NAMESPACE again. A pinned namespace is registered as-is, so a page migrated to jakarta.faces.component while the class still pins the old URI fails with Tag Library supports namespace: jakarta.faces.component, but no tag was defined for name: <tag>.xmlns="http://www.w3.org/1999/xhtml" from XHTML files; since Faces 4.0 it is always implied.@ManagedBean usage (removed in Faces 4.0); replace with @Named + CDI scope.javax.faces.bean.* imports (package removed entirely).*.xhtml; remove legacy *.jsf, *.faces, /faces/* mappings.faces-config.xml version to 4.0. <faces-config
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facesconfig_4_0.xsd"
version="4.0"
>*.taglib.xml version to 4.0. <facelet-taglib
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facelettaglibrary_4_0.xsd"
version="4.0"
><!DOCTYPE html> (if not already).web.xml and its declared version lags behind Servlet 6.0 (Jakarta EE 10), update it. <web-app
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_0.xsd"
version="6.0"
>bean-discovery-mode explicit in beans.xml BEFORE bumping it to CDI 4.0. Up to CDI 3.0 an empty or version-less beans.xml meant all; since CDI 4.0 the attribute is optional and defaults to annotated. Every bean without a bean defining annotation then stops being discovered at runtime, and nothing fails at build time. Report the choice: keep all to preserve current behavior, or move to annotated and annotate the beans that need it.beans.xml version to CDI 4.0 (Jakarta EE 10), keeping the bean-discovery-mode decided above. <beans
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_4_0.xsd"
version="4.0"
bean-discovery-mode="annotated"
>pom.xml to Jakarta Faces 4.1 dependency.faces-config.xml version to 4.1. <faces-config
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facesconfig_4_1.xsd"
version="4.1"
>*.taglib.xml version to 4.1. <facelet-taglib
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-facelettaglibrary_4_1.xsd"
version="4.1"
>web.xml and its declared version lags behind Servlet 6.1 (Jakarta EE 11), update it. <web-app
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_6_1.xsd"
version="6.1"
>beans.xml version to CDI 4.1 (Jakarta EE 11), keeping the existing bean-discovery-mode. <beans
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_4_1.xsd"
version="4.1"
bean-discovery-mode="annotated"
>jakarta/faces/Messages*.properties) or declares a <message-bundle>, report the keys that Faces 4.1 adds so the developer can supply translations. Faces 4.1 adds two, for the new UUIDConverter:jakarta.faces.converter.UUIDConverter.UUIDjakarta.faces.converter.UUIDConverter.UUID_detailweb.xml. Migrating them off now is what makes the next jump a version bump rather than a rewrite:jakarta.faces.PARTIAL_STATE_SAVING: remove it when set to true, which is the default since 2.0. When set to false, report it rather than removing it; the application is running on full state saving and removing the param flips it onto partial state saving, which surfaces any custom component that does not save its state correctly; fix those first.jakarta.faces.FULL_STATE_SAVING_VIEW_IDS: report the listed view IDs, which need the same treatment per view.ActionSource2 types, all deprecated for removal since 4.1; their members moved to the ActionSource counterpart:jakarta.faces.component.ActionSource2 → jakarta.faces.component.ActionSourcejakarta.faces.view.ActionSource2AttachedObjectHandler → jakarta.faces.view.ActionSourceAttachedObjectHandlerjakarta.faces.view.ActionSource2AttachedObjectTarget → jakarta.faces.view.ActionSourceAttachedObjectTargetFor each applicable migration step:
After migration:
javax. keys in *.properties files and for a leftover javax/faces/ resource directory; these fail silently rather than at build time.faces-config.xml, web.xml and beans.xml each declare a version no higher than the Faces, Servlet resp. CDI API the runtime supplies, and no lower than needed for the descriptor features in use.pom.xml/build.gradle has no conflicting dependency versions./faces-review to catch any remaining issues.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.