<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.openjproxy</groupId>
    <artifactId>ojp-parent</artifactId>
    <version>0.5.0-beta</version>
    <packaging>pom</packaging>

    <name>OJP Parent</name>
    <url>https://github.com/Open-J-Proxy/ojp</url>
    <description>Parent pom for OJP (Open J Proxy)</description>

    <modules>
        <module>ojp-grpc-commons</module>
        <module>ojp-jdbc-driver</module>
        <module>ojp-server</module>
        <module>ojp-datasource-api</module>
        <module>ojp-datasource-hikari</module>
        <module>ojp-datasource-dbcp</module>
        <module>ojp-xa-pool-commons</module>
        <module>ojp-testcontainers</module>
        <module>spring-boot-starter-ojp</module>
    </modules>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <lombok.version>1.18.44</lombok.version>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
        <slf4j.version>2.0.17</slf4j.version>
        <logback.version>1.5.32</logback.version>
        <protobuf.version>4.34.1</protobuf.version>
        <netty.version>4.1.135.Final</netty.version>
        <commons-lang3.version>3.18.0</commons-lang3.version>
        <jackson-core.version>2.18.8</jackson-core.version>
        <plexus-utils.version>4.0.3</plexus-utils.version>
    </properties>

    <dependencyManagement>
        <dependencies>
            <!-- Force protobuf-java version to address CVE-2024-7254 -->
            <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protobuf-java</artifactId>
                <version>${protobuf.version}</version>
            </dependency>
            
            <!-- Force Netty version to fix CVE-2025-67735, CVE-2025-58057, CVE-2025-58056, CVE-2025-55163, CVE-2025-25193, CVE-2024-47535, CVE-2025-24970, CVE-2026-50020, CVE-2026-50560, CVE-2026-48043, CVE-2026-47244, CVE-2026-44249, CVE-2026-50010, CVE-2026-45416 -->
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-bom</artifactId>
                <version>${netty.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            
            <!-- Override commons-lang3 to fix CVE-2025-48924 -->
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-lang3</artifactId>
                <version>${commons-lang3.version}</version>
            </dependency>

            <!-- Force jackson-core version to fix DoS vulnerability in async JSON parser (CVSS 8), GHSA-2M67-WJPJ-XHG9 -->
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-core</artifactId>
                <version>${jackson-core.version}</version>
            </dependency>

            <!-- Force logback-core to fix CVE-2026-1225 (ACE in config processing, affects ≤1.5.24) -->
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-core</artifactId>
                <version>${logback.version}</version>
            </dependency>

            <!-- Force plexus-utils to fix CVE-2025-67030 (Directory Traversal in extractFile, affects <4.0.3) -->
            <dependency>
                <groupId>org.codehaus.plexus</groupId>
                <artifactId>plexus-utils</artifactId>
                <version>${plexus-utils.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>

        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <version>${lombok.version}</version>
            <scope>provided</scope>
        </dependency>

    </dependencies>
    <profiles>
        <profile>
            <id>run-ojp-server</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>exec-maven-plugin</artifactId>
                        <version>3.5.1</version>
                        <executions>
                            <execution>
                                <id>run-grpc-server</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>java</goal>
                                </goals>
                                <configuration>
                                    <mainClass>org.openjproxy.grpc.server.GrpcServer</mainClass>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <!--
                Release profile: activated by -Prelease during CI release workflow.
                Enables GPG signing, source/javadoc JAR generation, and Sonatype Central publishing.
                Required GitHub secrets: SONATYPE_USERNAME, SONATYPE_PASSWORD, GPG_PRIVATE_KEY, GPG_PASSPHRASE.
            -->
            <id>release</id>
            <build>
                <plugins>
                    <!-- Sources JAR - required by Maven Central -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-source-plugin</artifactId>
                        <version>3.2.1</version>
                        <executions>
                            <execution>
                                <id>attach-sources</id>
                                <goals>
                                    <goal>jar-no-fork</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <!-- Javadoc JAR - required by Maven Central -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-javadoc-plugin</artifactId>
                        <version>3.6.3</version>
                        <configuration>
                            <failOnWarnings>false</failOnWarnings>
                            <doclint>none</doclint>
                        </configuration>
                        <executions>
                            <execution>
                                <id>attach-javadocs</id>
                                <goals>
                                    <goal>jar</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <!-- GPG artifact signing - required by Maven Central -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>3.1.0</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                                <configuration>
                                    <!-- loopback mode is required for non-interactive CI environments -->
                                    <gpgArguments>
                                        <arg>--pinentry-mode</arg>
                                        <arg>loopback</arg>
                                    </gpgArguments>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <!-- Sonatype Central publishing -->
                    <plugin>
                        <groupId>org.sonatype.central</groupId>
                        <artifactId>central-publishing-maven-plugin</artifactId>
                        <version>0.8.0</version>
                        <extensions>true</extensions>
                        <configuration>
                            <!-- Server ID matching the credentials in Maven settings.xml -->
                            <publishingServerId>central</publishingServerId>
                            <!-- Automatically publish after validation (no manual approval needed) -->
                            <autoPublish>true</autoPublish>
                            <!-- Wait for publishing to complete before the build finishes -->
                            <waitForPublishing>true</waitForPublishing>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.13.0</version>
                    <configuration>
                        <source>${maven.compiler.source}</source>
                        <target>${maven.compiler.target}</target>
                        <annotationProcessorPaths>
                            <path>
                                <groupId>org.projectlombok</groupId>
                                <artifactId>lombok</artifactId>
                                <version>${lombok.version}</version>
                            </path>
                        </annotationProcessorPaths>
                    </configuration>
                </plugin>
            </plugins>
        </pluginManagement>
        <plugins>
            <!-- Checkstyle: enforces SonarLint-aligned coding rules; fails the build on violations -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>3.6.0</version>
                <configuration>
                    <configLocation>checkstyle.xml</configLocation>
                    <!-- Only scan hand-written sources; skip generated protobuf stubs -->
                    <sourceDirectories>${project.build.sourceDirectory}</sourceDirectories>
                    <includeTestSourceDirectory>false</includeTestSourceDirectory>
                    <failOnViolation>true</failOnViolation>
                    <violationSeverity>error</violationSeverity>
                    <consoleOutput>true</consoleOutput>
                    <linkXRef>false</linkXRef>
                </configuration>
                <executions>
                    <execution>
                        <id>validate-checkstyle</id>
                        <phase>validate</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <!--Signs the JARs for deployments-->
            <!--<plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-gpg-plugin</artifactId>
                <version>3.1.0</version>
                <executions>
                    <execution>
                        <id>sign-artifacts</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>sign</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>-->
            <!--Deploys to maven central-->
    <!--<plugin>
        <groupId>org.sonatype.central</groupId>
        <artifactId>central-publishing-maven-plugin</artifactId>
        <version>0.8.0</version>
        <extensions>true</extensions>
        <configuration>
            <publishingServerId>central</publishingServerId>
        </configuration>
    </plugin>-->
</plugins>
</build>

<!-- Add SCM and project info for Maven Central requirements -->
    <scm>
        <url>https://github.com/Open-J-Proxy/ojp</url>
        <connection>scm:git:https://github.com/Open-J-Proxy/ojp.git</connection>
        <developerConnection>scm:git:ssh://git@github.com/Open-J-Proxy/ojp.git</developerConnection>
        <tag>HEAD</tag>
    </scm>

    <licenses>
        <license>
            <name>The Apache License, Version 2.0</name>
            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <developers>
        <developer>
            <id>rrobetti</id>
            <name>Rogerio Robetti</name>
        </developer>
        <developer>
            <id>petruki</id>
            <name>Roger Floriano</name>
        </developer>
    </developers>

</project>