pom.xml

<?xml version="1.0"?>
<!--
  ~ This file is part of Dependency-Track.
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~   http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  ~
  ~ SPDX-License-Identifier: Apache-2.0
  ~ Copyright (c) OWASP Foundation. All Rights Reserved.
  -->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">

  <modelVersion>4.0.0</modelVersion>
  <groupId>org.dependencytrack</groupId>
  <artifactId>hyades</artifactId>
  <version>0.6.0-SNAPSHOT</version>
  <packaging>pom</packaging>

  <modules>
    <module>quarkus-extensions</module>
    <module>commons</module>
    <module>commons-kstreams</module>
    <module>commons-persistence</module>
    <module>mirror-service</module>
    <module>notification-publisher</module>
    <module>repository-meta-analyzer</module>
    <module>proto</module>
    <module>vulnerability-analyzer</module>
    <module>e2e</module>
  </modules>

  <licenses>
    <license>
      <name>Apache-2.0</name>
      <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <scm>
    <connection>${scm.connection}</connection>
    <developerConnection>${scm.developer.connection}</developerConnection>
    <url>${scm.url}</url>
    <tag>HEAD</tag>
  </scm>

  <properties>
    <!-- General Project Properties -->
    <compiler-plugin.version>3.13.0</compiler-plugin.version>
    <maven.compiler.release>21</maven.compiler.release>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    <project.parentBaseDir>.</project.parentBaseDir>

    <!-- Dependency Versions -->
    <lib.assertj.version>3.26.3</lib.assertj.version>
    <lib.checkstyle.version>10.18.2</lib.checkstyle.version>
    <lib.cloud-sql-postgres-socket-factory.version>1.20.1</lib.cloud-sql-postgres-socket-factory.version>
    <lib.cpe-parser.version>2.1.0</lib.cpe-parser.version>
    <lib.commons-collections4.version>4.4</lib.commons-collections4.version>
    <lib.confluent-parallel-consumer.version>0.5.3.1</lib.confluent-parallel-consumer.version>
    <lib.conscrypt.version>2.5.2</lib.conscrypt.version>
    <lib.cvss-calculator.version>1.4.3</lib.cvss-calculator.version>
    <lib.failsafe.version>3.3.2</lib.failsafe.version>
    <lib.github-api.version>1.324</lib.github-api.version>
    <lib.greenmail.version>2.0.1</lib.greenmail.version>
    <lib.java-uuid-generator.version>5.1.0</lib.java-uuid-generator.version>
    <lib.json-unit.version>3.4.1</lib.json-unit.version>
    <lib.kafka.version>3.7.1</lib.kafka.version>
    <lib.maven-artifact.version>4.0.0-beta-4</lib.maven-artifact.version>
    <lib.micrometer-jvm-extras.version>0.2.2</lib.micrometer-jvm-extras.version>
    <lib.minio.version>8.5.12</lib.minio.version>
    <lib.open-feign.version>13.4</lib.open-feign.version>
    <lib.org-json.version>20240303</lib.org-json.version>
    <lib.pebble.version>3.2.2</lib.pebble.version>
    <lib.resilience4j.version>2.2.0</lib.resilience4j.version>
    <lib.open.vulnerability.clients.version>7.0.0</lib.open.vulnerability.clients.version>
    <lib.packageurl-java.version>1.5.0</lib.packageurl-java.version>
    <lib.protobuf-java.version>4.28.2</lib.protobuf-java.version>
    <lib.quarkus-mailpit.version>1.2.2</lib.quarkus-mailpit.version>
    <lib.snappy-java.version>1.1.10.7</lib.snappy-java.version>
    <lib.testcontainers-minio.version>1.20.2</lib.testcontainers-minio.version>
    <lib.wiremock.version>2.35.2</lib.wiremock.version>
    <quarkus.platform.version>3.15.1</quarkus.platform.version>
    <quarkus.wiremock.version>1.3.3</quarkus.wiremock.version>
    <lib.brotli.version>0.1.2</lib.brotli.version>
    <lib.versatile.version>0.7.0</lib.versatile.version>

    <!-- Plugin Versions -->
    <plugin.jacoco.version>0.8.12</plugin.jacoco.version>
    <plugin.protoc-jar.version>3.11.4</plugin.protoc-jar.version>

    <!-- Tool Versions -->
    <tool.protoc.version>com.google.protobuf:protoc:${lib.protobuf-java.version}</tool.protoc.version>

    <!-- Default SCM Properties -->
    <scm.connection>scm:git:ssh://git@github.com/DependencyTrack/hyades.git</scm.connection>
    <scm.developer.connection>scm:git:ssh://git@github.com/DependencyTrack/hyades.git</scm.developer.connection>
    <scm.url>https://github.com/DependencyTrack/hyades.git</scm.url>

    <skipITs>true</skipITs>
    <surefire-plugin.version>3.5.0</surefire-plugin.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>io.quarkus</groupId>
        <artifactId>quarkus-bom</artifactId>
        <version>${quarkus.platform.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <dependency>
        <groupId>org.dependencytrack</groupId>
        <artifactId>commons</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>org.dependencytrack</groupId>
        <artifactId>commons-kstreams</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>org.dependencytrack</groupId>
        <artifactId>commons-persistence</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>org.dependencytrack</groupId>
        <artifactId>proto</artifactId>
        <version>${project.version}</version>
      </dependency>

      <dependency>
        <groupId>com.google.cloud.sql</groupId>
        <artifactId>postgres-socket-factory</artifactId>
        <version>${lib.cloud-sql-postgres-socket-factory.version}</version>
      </dependency>

      <dependency>
        <groupId>us.springett</groupId>
        <artifactId>cpe-parser</artifactId>
        <version>${lib.cpe-parser.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-collections4</artifactId>
        <version>${lib.commons-collections4.version}</version>
      </dependency>

      <dependency>
        <groupId>io.confluent.parallelconsumer</groupId>
        <artifactId>parallel-consumer-core</artifactId>
        <version>${lib.confluent-parallel-consumer.version}</version>
      </dependency>

      <dependency>
        <groupId>com.fasterxml.uuid</groupId>
        <artifactId>java-uuid-generator</artifactId>
        <version>${lib.java-uuid-generator.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.failsafe</groupId>
        <artifactId>failsafe</artifactId>
        <version>${lib.failsafe.version}</version>
      </dependency>

      <dependency>
        <groupId>org.kohsuke</groupId>
        <artifactId>github-api</artifactId>
        <version>${lib.github-api.version}</version>
      </dependency>

      <dependency>
        <groupId>io.github.jeremylong</groupId>
        <artifactId>open-vulnerability-clients</artifactId>
        <version>${lib.open.vulnerability.clients.version}</version>
      </dependency>

      <dependency>
        <groupId>com.google.protobuf</groupId>
        <artifactId>protobuf-java</artifactId>
        <version>${lib.protobuf-java.version}</version>
      </dependency>
      <dependency>
        <groupId>com.google.protobuf</groupId>
        <artifactId>protobuf-java-util</artifactId>
        <version>${lib.protobuf-java.version}</version>
      </dependency>

      <dependency>
        <groupId>io.github.resilience4j</groupId>
        <artifactId>resilience4j-all</artifactId>
        <version>${lib.resilience4j.version}</version>
      </dependency>
      <dependency>
        <groupId>io.github.resilience4j</groupId>
        <artifactId>resilience4j-retry</artifactId>
        <version>${lib.resilience4j.version}</version>
      </dependency>
      <dependency>
        <groupId>io.github.resilience4j</groupId>
        <artifactId>resilience4j-micrometer</artifactId>
        <version>${lib.resilience4j.version}</version>
      </dependency>

      <dependency>
        <groupId>org.json</groupId>
        <artifactId>json</artifactId>
        <version>${lib.org-json.version}</version>
      </dependency>
             
      <dependency>
        <groupId>org.apache.kafka</groupId>
        <artifactId>kafka-clients</artifactId>
        <version>${lib.kafka.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.kafka</groupId>
        <artifactId>kafka-streams</artifactId>
        <version>${lib.kafka.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.kafka</groupId>
        <artifactId>kafka-streams-test-utils</artifactId>
        <version>${lib.kafka.version}</version>
      </dependency>

      <dependency>
        <groupId>io.github.mweirauch</groupId>
        <artifactId>micrometer-jvm-extras</artifactId>
        <version>${lib.micrometer-jvm-extras.version}</version>
        <exclusions>
          <exclusion>
            <groupId>io.micrometer</groupId>
            <artifactId>micrometer-core</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>io.minio</groupId>
        <artifactId>minio</artifactId>
        <version>${lib.minio.version}</version>
      </dependency>

      <dependency>
        <groupId>com.github.package-url</groupId>
        <artifactId>packageurl-java</artifactId>
        <version>${lib.packageurl-java.version}</version>
      </dependency>

      <dependency>
        <groupId>io.pebbletemplates</groupId>
        <artifactId>pebble</artifactId>
        <version>${lib.pebble.version}</version>
      </dependency>

      <dependency>
        <groupId>org.dependencytrack</groupId>
        <artifactId>quarkus-config-dependencytrack</artifactId>
        <version>${project.version}</version>
      </dependency>

      <dependency>
        <groupId>io.quarkiverse.wiremock</groupId>
        <artifactId>quarkus-wiremock</artifactId>
        <version>${quarkus.wiremock.version}</version>
      </dependency>
      <dependency>
        <groupId>io.quarkiverse.wiremock</groupId>
        <artifactId>quarkus-wiremock-test</artifactId>
        <version>${quarkus.wiremock.version}</version>
      </dependency>
      <dependency>
        <groupId>io.quarkiverse.mailpit</groupId>
        <artifactId>quarkus-mailpit</artifactId>
        <version>${lib.quarkus-mailpit.version}</version>
      </dependency>
      <dependency>
        <groupId>io.quarkiverse.mailpit</groupId>
        <artifactId>quarkus-mailpit-testing</artifactId>
        <version>${lib.quarkus-mailpit.version}</version>
      </dependency>

      <dependency>
        <!--
          Managing snappy-java to fix GHSA-qcwq-55hx-v3vh, GHSA-fjpj-2g6w-x25r, and GHSA-pqr6-cmr2-h8hf.
          Snappy is introduced via kafka-clients; Once kafka-clients bumps its snappy-java version, we can remove this.
        -->
        <groupId>org.xerial.snappy</groupId>
        <artifactId>snappy-java</artifactId>
        <version>${lib.snappy-java.version}</version>
      </dependency>

      <dependency>
        <groupId>org.testcontainers</groupId>
        <artifactId>minio</artifactId>
        <version>${lib.testcontainers-minio.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.maven</groupId>
        <artifactId>maven-artifact</artifactId>
        <version>${lib.maven-artifact.version}</version>
      </dependency>

      <dependency>
        <groupId>us.springett</groupId>
        <artifactId>cvss-calculator</artifactId>
        <version>${lib.cvss-calculator.version}</version>
      </dependency>

      <dependency>
        <groupId>com.github.tomakehurst</groupId>
        <artifactId>wiremock-jre8-standalone</artifactId>
        <version>${lib.wiremock.version}</version>
      </dependency>

      <dependency>
        <groupId>io.github.openfeign</groupId>
        <artifactId>feign-core</artifactId>
        <version>${lib.open-feign.version}</version>
      </dependency>
      <dependency>
        <groupId>io.github.openfeign</groupId>
        <artifactId>feign-jackson</artifactId>
        <version>${lib.open-feign.version}</version>
      </dependency>
      <dependency>
        <groupId>io.github.openfeign</groupId>
        <artifactId>feign-jaxrs3</artifactId>
        <version>${lib.open-feign.version}</version>
      </dependency>

      <dependency>
        <groupId>org.assertj</groupId>
        <artifactId>assertj-core</artifactId>
        <version>${lib.assertj.version}</version>
      </dependency>
      <dependency>
        <groupId>net.javacrumbs.json-unit</groupId>
        <artifactId>json-unit-assertj</artifactId>
        <version>${lib.json-unit.version}</version>
      </dependency>
      <dependency>
        <groupId>com.icegreen</groupId>
        <artifactId>greenmail-junit5</artifactId>
        <version>${lib.greenmail.version}</version>
      </dependency>

      <dependency>
        <groupId>org.brotli</groupId>
        <artifactId>dec</artifactId>
        <version>${lib.brotli.version}</version>
      </dependency>

      <dependency>
        <groupId>io.github.nscuro</groupId>
        <artifactId>versatile</artifactId>
        <version>${lib.versatile.version}</version>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>${compiler-plugin.version}</version>
          <configuration>
            <compilerArgs>
              <arg>-parameters</arg>
            </compilerArgs>
          </configuration>
        </plugin>

        <plugin>
          <groupId>com.github.os72</groupId>
          <artifactId>protoc-jar-maven-plugin</artifactId>
          <version>${plugin.protoc-jar.version}</version>
        </plugin>

        <plugin>
          <groupId>io.smallrye</groupId>
          <artifactId>jandex-maven-plugin</artifactId>
          <version>3.2.2</version>
          <executions>
            <execution>
              <id>make-index</id>
              <goals>
                <goal>jandex</goal>
              </goals>
            </execution>
          </executions>
        </plugin>

        <plugin>
          <groupId>io.quarkus</groupId>
          <artifactId>quarkus-maven-plugin</artifactId>
          <version>${quarkus.platform.version}</version>
          <extensions>true</extensions>
          <executions>
            <execution>
              <goals>
                <goal>build</goal>
                <goal>generate-code</goal>
                <goal>generate-code-tests</goal>
              </goals>
            </execution>
          </executions>
        </plugin>

        <plugin>
          <artifactId>maven-surefire-plugin</artifactId>
          <version>${surefire-plugin.version}</version>
          <configuration>
            <systemPropertyVariables>
              <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
            </systemPropertyVariables>
          </configuration>
        </plugin>

        <plugin>
          <artifactId>maven-failsafe-plugin</artifactId>
          <version>${surefire-plugin.version}</version>
          <executions>
            <execution>
              <goals>
                <goal>integration-test</goal>
                <goal>verify</goal>
              </goals>
              <configuration>
                <includes>
                  <include>**/*IT.java</include>
                  <include>**/*E2ET.java</include>
                </includes>
                <systemPropertyVariables>
                  <native.image.path>${project.build.directory}/${project.build.finalName}-runner</native.image.path>
                  <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
                </systemPropertyVariables>
              </configuration>
            </execution>
          </executions>
        </plugin>

        <plugin>
          <groupId>org.jacoco</groupId>
          <artifactId>jacoco-maven-plugin</artifactId>
          <version>${plugin.jacoco.version}</version>
          <configuration>
            <excludes>
              <exclude>org/cyclonedx/proto/**/*</exclude>
              <exclude>org/dependencytrack/proto/**/*</exclude>
            </excludes>
          </configuration>
          <executions>
            <execution>
              <id>default-prepare-agent</id>
              <goals>
                <goal>prepare-agent</goal>
              </goals>
              <configuration>
                <exclClassLoaders>*QuarkusClassLoader</exclClassLoaders>
                <destFile>${project.build.directory}/jacoco-quarkus.exec</destFile>
                <append>true</append>
              </configuration>
            </execution>
            <execution>
              <id>report</id>
              <goals>
                <goal>report</goal>
              </goals>
              <configuration>
                <dataFile>${project.build.directory}/jacoco-quarkus.exec</dataFile>
                <formats>
                  <format>XML</format>
                </formats>
              </configuration>
            </execution>
          </executions>
        </plugin>

        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-release-plugin</artifactId>
          <version>3.1.1</version>
          <configuration>
            <autoVersionSubmodules>true</autoVersionSubmodules>
            <projectVersionPolicyId>SemVerVersionPolicy</projectVersionPolicyId>
            <tagNameFormat>v@{project.version}</tagNameFormat>
          </configuration>
        </plugin>
      </plugins>
    </pluginManagement>

    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-checkstyle-plugin</artifactId>
        <version>3.5.0</version>
        <configuration>
          <configLocation>${project.parentBaseDir}/.checkstyle.xml</configLocation>
          <includeTestSourceDirectory>true</includeTestSourceDirectory>
          <includeResources>false</includeResources>
          <includeTestResources>false</includeTestResources>
          <propertyExpansion>
            parentBaseDir=${project.parentBaseDir}
          </propertyExpansion>
        </configuration>
        <executions>
          <execution>
            <phase>validate</phase>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
        <dependencies>
          <dependency>
            <groupId>com.puppycrawl.tools</groupId>
            <artifactId>checkstyle</artifactId>
            <version>${lib.checkstyle.version}</version>
          </dependency>
        </dependencies>
      </plugin>
    </plugins>
  </build>

  <profiles>
    <profile>
      <!--
        When running in GitHub Actions, the SCM connection must be via HTTPS
        so that the GITHUB_TOKEN injected by Actions can be used to authenticate.
        In other environments, SSH keys should be used instead.

        Additionally, this allows for SCM connections to be dependent on the
        repository the GHA workflow is executed on, making it possible to test
        the e.g. the release process in forks, without having to modify the POM.

        For details on the environment variables used, see:
          https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
      -->
      <id>github-actions</id>
      <activation>
        <property>
          <name>env.GITHUB_ACTIONS</name>
          <value>true</value>
        </property>
      </activation>
      <properties>
        <scm.connection>scm:git:https://github.com/${env.GITHUB_REPOSITORY}.git</scm.connection>
        <scm.developer.connection>scm:git:https://github.com/${env.GITHUB_REPOSITORY}.git</scm.developer.connection>
        <scm.url>https://github.com/${env.GITHUB_REPOSITORY}.git</scm.url>
      </properties>
    </profile>
  </profiles>
</project>