<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>org.simplejavamail</groupId>
        <artifactId>maven-master-project</artifactId>
        <version>8.12.6</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

    <artifactId>spring-module</artifactId>
    <packaging>jar</packaging>
    <name>Simple Java Mail - Spring module</name>
    <description>Simple API, Complex Emails. Now with Spring support</description>

    <properties>
            <automaticModuleName>org.simplejavamail.spring</automaticModuleName>
            <spring.version>5.3.39</spring.version>
            <spring.boot.version>2.7.18</spring.boot.version>
    </properties>

    <dependencies>

        <!-- core dependencies -->
        <dependency>
            <groupId>org.simplejavamail</groupId>
            <artifactId>simple-java-mail</artifactId>
            <version>${project.version}</version>
        </dependency>

        <!-- spring -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <scope>provided</scope>
        </dependency>
        <!--suppress VulnerableLibrariesLocal -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-beans</artifactId>
            <scope>provided</scope>
        </dependency>

        <!-- spring boot support (build scope only, used to generate spring-configuration-metadata.json for IDE hints)-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-configuration-processor</artifactId>
            <optional>true</optional>
            <version>${spring.boot.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-autoconfigure</artifactId>
            <optional>true</optional>
            <version>${spring.boot.version}</version>
        </dependency>

        <!-- spring testing -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-test</artifactId>
            <scope>test</scope>
        </dependency>
        <!--suppress VulnerableLibrariesLocal -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <version>${spring.boot.version}</version>
            <scope>test</scope>
            <exclusions>
                <exclusion>
                    <groupId>org.apache.logging.log4j</groupId>
                    <artifactId>log4j-to-slf4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
    </dependencies>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-framework-bom</artifactId>
                <version>${spring.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <annotationProcessorPaths>
                        <path>
                            <groupId>org.springframework.boot</groupId>
                            <artifactId>spring-boot-configuration-processor</artifactId>
                            <version>${spring.boot.version}</version>
                        </path>
                        <path>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                            <version>${lombok.version}</version>
                        </path>
                    </annotationProcessorPaths>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.sonatype.ossindex.maven</groupId>
                <artifactId>ossindex-maven-plugin</artifactId>
                <configuration>
                    <excludeVulnerabilityIds>
                        <!-- Cannot be fixed:
                            1. fix version is only available in a Spring commercial version
                            2. the next OSS version requires minimum Java 17
                            3. Spring is a 'provided' dependency anyway, so not shipped with this library -->
                        <excludeVulnerabilityId>CVE-2024-38820</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2023-51074</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2024-31573</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2022-1471</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2022-25857</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2022-38749</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2022-38750</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2022-38751</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2022-38752</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2022-41854</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2023-1370</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2023-6378</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2024-12798</excludeVulnerabilityId>
                        <excludeVulnerabilityId>CVE-2024-12801</excludeVulnerabilityId>
                    </excludeVulnerabilityIds>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>
