<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>org.kiwiproject</groupId>
        <artifactId>kiwi-parent</artifactId>
        <version>3.0.40</version>
    </parent>

    <artifactId>dropwizard-mongo-migrations</artifactId>
    <version>3.0.3</version>

    <name>${project.groupId}:${project.artifactId}</name>
    <description>
        This is a small library that provides a Dropwizard command to perform database migrations for Mongo.
    </description>
    <url>https://github.com/kiwiproject/dropwizard-mongo-migrations</url>
    <inceptionYear>2021</inceptionYear>

    <scm>
        <connection>scm:git:https://github.com/kiwiproject/dropwizard-mongo-migrations.git</connection>
        <developerConnection>scm:git:git@github.com:kiwiproject/dropwizard-mongo-migrations.git</developerConnection>
        <url>https://github.com/kiwiproject/dropwizard-mongo-migrations</url>
        <tag>v3.0.3</tag>
    </scm>

    <properties>
        <!-- Versions for required dependencies -->
        <kiwi.version>5.4.0</kiwi.version>
        <kiwi-bom.version>3.3.0</kiwi-bom.version>
        <mongock.version>5.5.1</mongock.version>

        <!-- Versions for managed transitive dependencies -->
        
        <!-- See note below on plexus-utils re: a Directory Traversal CVE fixed by this version -->
        <plexus-utils.version>4.0.3</plexus-utils.version>

        <!-- Versions for test dependencies -->
        <kiwi-test.version>4.2.0</kiwi-test.version>

        <!-- Sonar properties -->
        <sonar.projectKey>kiwiproject_dropwizard-mongo-migrations</sonar.projectKey>
    </properties>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.kiwiproject</groupId>
                <artifactId>kiwi-bom</artifactId>
                <version>${kiwi-bom.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <dependency>
                <groupId>org.kiwiproject</groupId>
                <artifactId>kiwi</artifactId>
                <version>${kiwi.version}</version>
            </dependency>

            <dependency>
                <groupId>org.kiwiproject</groupId>
                <artifactId>kiwi-test</artifactId>
                <version>${kiwi-test.version}</version>
            </dependency>

            <!-- 
                Fix: Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
                See: https://github.com/advisories/GHSA-6fmv-xxpf-w3cw

                There is no 3.x version that fixes the CVE; 4.0.3 is the first patched version.
                This is a major version bump from the 3.2.0 pulled in transitively by mongock 5.5.1,
                but maven-artifact 3.6.1 (which introduces plexus-utils) only uses
                StringUtils.isNotEmpty() from it, so the major version bump is safe.
            -->   
             <dependency>
                <groupId>org.codehaus.plexus</groupId>
                <artifactId>plexus-utils</artifactId>
                <version>${plexus-utils.version}</version>
            </dependency>

            <dependency>
                <groupId>io.mongock</groupId>
                <artifactId>mongock-bom</artifactId>
                <version>${mongock.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <!-- required dependencies -->
        <dependency>
            <groupId>io.dropwizard</groupId>
            <artifactId>dropwizard-core</artifactId>
        </dependency>

        <dependency>
            <groupId>org.kiwiproject</groupId>
            <artifactId>kiwi</artifactId>
        </dependency>

        <dependency>
            <groupId>io.mongock</groupId>
            <artifactId>mongock-standalone</artifactId>
        </dependency>

        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
        </dependency>

        <!-- Test dependencies -->

        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>testcontainers-junit-jupiter</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>testcontainers-mongodb</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.kiwiproject</groupId>
            <artifactId>kiwi-test</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>io.mongock</groupId>
            <artifactId>mongodb-springdata-v4-driver</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.mongodb</groupId>
            <artifactId>mongodb-driver-sync</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
            <scope>test</scope>
        </dependency>

        <!-- This is needed if the mongodb-springdata-v3-driver is being used -->
        <dependency>
            <groupId>org.springframework.data</groupId>
            <artifactId>spring-data-mongodb</artifactId>
            <scope>test</scope>
        </dependency>

    </dependencies>

</project>
