feat: add help goal for maven plugin

[mcollovati]

Adds generation of help goal for the Vaadin maven plugin.

[mcollovati]

Allows running commands like mvn vaadin:help to list all available goals and mvn vaadin:help -Dgoal=goal-name -Ddetail to see all available options for a specific goal.

[github-actions]

Dependencies Report

• 🚫 Vulnerabilities:

  • Vulnerabilities in: pkg:maven/org.codehaus.plexus/[email protected] [CVE-2025-67030] (osv-bomber,osv-scan,owasp)
    · cpe:2.3:a:codehaus-plexus:plexus-utils::::::::
  • Vulnerabilities in: pkg:npm/[email protected] [GHSA-5c6j-r48x-rmvq, CVE-2026-34043] (osv-bomber,oss-bomber,osv-scan)
    ·
  • Vulnerabilities in: pkg:npm/[email protected] [CVE-2025-64756] (oss-bomber)
    ·

• 🟠 Known Vulnerabilities:

  • Vulnerabilities in: pkg:maven/me.friwi/jcef-api@jcef-ca49ada%2Bcef-135.0.20%2Bge7de5c3%2Bchromium-135.0.7049.85 [CVE-2024-21639, CVE-2024-21640, CVE-2024-9410] (owasp)
    👌 Wait for the update from the jcefmaven community. Meanwhile the swing-kit is supposed to be used with fixed websites and not to browse the internet, we have a check for that, so the only possible attacker would be the same person that created the swing application, aka our customer devs. so this vulnerability is not classified by us as critical issue
    · cpe:2.3:a:chromiumembedded:chromium_embedded_framework::::::::
    · cpe:2.3:a:ada:ada::::::::

• 📔 Found Core License Issues:

  • Invalid license 'https://vaadin.com/commercial-license-and-service-terms' in: pkg:maven/com.vaadin/[email protected]

• 📔 No License Issues

• 🟠 Changes in 25.2-SNAPSHOT since V25.2.0-alpha2

  • 10 packages removed (10 external, 0 vaadin)
  • 8 packages added (8 external, 0 vaadin)
  • 130 packages modified (32 external, 98 vaadin)
  • 768 packages same (631 external, 137 vaadin)

[Click for more Details]

[ZheSun88]

looks good, here is an example output:

This plugin has 12 goals:

vaadin:build-frontend
  Goal that builds the frontend bundle. It performs the following actions when
  creating a package:
  * Update com.vaadin.flow.server.Constants.PACKAGE_JSON file with the
  com.vaadin.flow.component.dependency.NpmPackage annotations defined in the
  classpath,
  * Copy resource files used by flow from `.jar` files to the `node_modules`
  folder
  * Install dependencies by running npm install
  * Update the FrontendUtils#IMPORTS_NAME file imports with the
  com.vaadin.flow.component.dependency.JsModule com.vaadin.flow.theme.Theme and
  com.vaadin.flow.component.dependency.JavaScript annotations defined in the
  classpath,
  * Update FrontendUtils#VITE_CONFIG file.

vaadin:clean-frontend
  Goal that cleans the frontend files to a clean state.
  Deletes Vaadin dependencies from package.json, the generated frontend folder
  and the npm/pnpm-related files and folders:

  * node_modules
  * pnpm-lock.yaml
  * package-lock.json

vaadin:configure
  Deprecated. No reason given

vaadin:convert-polymer
  A Maven goal that converts Polymer-based source files to Lit.

vaadin:dance
  This is the hidden `vaadin:dance` to clean up the frontend files.

vaadin:download-license
  Goal that downloads a Vaadin Pro license key by opening the browser and
  waiting for the user to log in.
  The downloaded license key is saved to the local file system
  (~/.vaadin/proKey) and can be used for validating commercial Vaadin
  components.

vaadin:download-offline-license
  Goal that provides the URL to download a Vaadin offline license key.
  This command displays a machine-specific URL that can be used to manually
  download an offline license key. The offline license is tied to this machine's
  hardware ID and must be saved manually to the file system
  (~/.vaadin/offlineKey).

  Unlike the online license (proKey), offline licenses work without internet
  connectivity and are suitable for CI/CD environments and offline development.

vaadin:generate
  Maven Plugin for Hilla. Handles parsing Java bytecode and generating
  TypeScript code from it.

vaadin:generate-maven-sbom
  Goal that generates a CycloneDX SBOM file focused on backend dependencies.

vaadin:generate-npm-sbom
  Goal that generates a CycloneDX SBOM file focused on frontend dependencies.

vaadin:help
  Display help information on vaadin-maven-plugin.
  Call mvn vaadin:help -Ddetail=true -Dgoal=<goal-name> to display parameter
  details.

vaadin:prepare-frontend
  This goal checks that node and npm tools are installed and creates or updates
  `package.json` and the frontend build tool configuration files.
  Copies frontend resources available inside `.jar` dependencies to
  `node_modules` when building a jar package.