<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (C) 2010 JFrog Ltd.
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~ http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0          http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.jfrog.teamcity</groupId>
    <artifactId>teamcity-artifactory-plugin</artifactId>
    <packaging>pom</packaging>
    <version>3.0.0</version>
    <name>TeamCity Artifactory Plugin Parent</name>

    <licenses>
        <license>
            <name>The Apache Software License, Version 2.0</name>
            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
            <distribution>http://repo.jfrog.org</distribution>
        </license>
    </licenses>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <plugin.version>${project.version}</plugin.version>
        <teamcity.version>2025.11</teamcity.version>
        <build.info.version>2.43.9</build.info.version>
        <build.info.gradle.version>6.0.4</build.info.gradle.version>
    </properties>

    <developers>
        <developer>
            <id>eyalb</id>
            <name>Eyal Ben Moshe</name>
            <email>eyalb at jfrog.com</email>
            <roles>
                <role>Developer</role>
            </roles>
        </developer>
        <developer>
            <id>diman</id>
            <name>Dima Nevelev</name>
            <email>diman at jfrog.com</email>
            <roles>
                <role>Developer</role>
            </roles>
        </developer>
    </developers>

    <modules>
        <module>common</module>
        <module>agent</module>
        <module>server</module>
        <module>assembly</module>
    </modules>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-core</artifactId>
                <version>2.20.0</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-api</artifactId>
                <version>2.20.0</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.dom4j</groupId>
                <artifactId>dom4j</artifactId>
                <version>2.1.4</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.jfrog.teamcity</groupId>
                <artifactId>teamcity-artifactory-plugin-agent</artifactId>
                <version>3.0.0</version>
            </dependency>
            <dependency>
                <groupId>org.jfrog.teamcity</groupId>
                <artifactId>teamcity-artifactory-plugin-common</artifactId>
                <version>3.0.0</version>
            </dependency>
            <dependency>
                <groupId>org.jfrog.teamcity</groupId>
                <artifactId>teamcity-artifactory-plugin-server</artifactId>
                <version>3.0.0</version>
            </dependency>
            <dependency>
                <groupId>com.google.guava</groupId>
                <artifactId>guava</artifactId>
                <version>32.0.1-jre</version>
            </dependency>
            <dependency>
                <groupId>commons-io</groupId>
                <artifactId>commons-io</artifactId>
                <version>2.18.0</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-core</artifactId>
                <version>2.17.2</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
                <version>2.17.2</version>
            </dependency>
            <!-- build-info-api pulls in jackson-annotations 2.14.1, which is missing enum
                 constants that jackson-databind 2.17.2 references (JsonFormat.Feature.
                 READ_UNKNOWN_ENUM_VALUES_*, added in 2.15). Pin it to match databind so the
                 Docker runner can deserialize daemon responses without NoSuchFieldError. -->
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-annotations</artifactId>
                <version>2.17.2</version>
            </dependency>
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-lang3</artifactId>
                <version>3.18.0</version>
            </dependency>
            <dependency>
                <groupId>com.thoughtworks.xstream</groupId>
                <artifactId>xstream</artifactId>
                <version>1.4.21</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.glassfish.jersey.core</groupId>
                <artifactId>jersey-common</artifactId>
                <version>2.34</version>
            </dependency>
            <dependency>
                <groupId>org.glassfish.jersey.connectors</groupId>
                <artifactId>jersey-apache-connector</artifactId>
                <version>2.34</version>
            </dependency>
            <dependency>
                <groupId>org.bouncycastle</groupId>
                <artifactId>bcpkix-jdk18on</artifactId>
                <version>1.79</version>
            </dependency>
            <dependency>
                <groupId>org.bouncycastle</groupId>
                <artifactId>bcprov-jdk18on</artifactId>
                <version>1.79</version>
            </dependency>
            <dependency>
                <groupId>org.yaml</groupId>
                <artifactId>snakeyaml</artifactId>
                <version>2.3</version>
            </dependency>
            <!--
                svnkit 1.10.11 and sqljet 1.1.15 - Low severity vulnerabilities with no fixed versions.
                These are the latest available versions from TMate Software.
            -->
            <dependency>
                <groupId>org.tmatesoft.svnkit</groupId>
                <artifactId>svnkit</artifactId>
                <version>1.10.11</version>
                <exclusions>
                    <exclusion>
                        <groupId>net.i2p.crypto</groupId>
                        <artifactId>eddsa</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.tmatesoft.sqljet</groupId>
                <artifactId>sqljet</artifactId>
                <version>1.1.15</version>
            </dependency>
            <dependency>
                <groupId>org.apache.sshd</groupId>
                <artifactId>sshd-common</artifactId>
                <version>2.12.0</version>
            </dependency>
            <dependency>
                <groupId>org.apache.sshd</groupId>
                <artifactId>sshd-core</artifactId>
                <version>2.12.0</version>
            </dependency>
            <dependency>
                <groupId>org.bitbucket.b_c</groupId>
                <artifactId>jose4j</artifactId>
                <version>0.9.4</version>
            </dependency>
            <!-- javax.servlet API - required for TeamCity compatibility -->
            <dependency>
                <groupId>javax.servlet</groupId>
                <artifactId>javax.servlet-api</artifactId>
                <version>4.0.1</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.apache.httpcomponents</groupId>
                <artifactId>httpclient</artifactId>
                <version>4.5.13</version>
            </dependency>
            <!--
                JDOM VERSION LIMITATION - TEAMCITY COMPATIBILITY CONSTRAINT
                
                TeamCity provides org.jdom:jdom at runtime (not jdom2).
                CVE-2021-33813 requires jdom2 (org.jdom2 package) which is incompatible.
                This CVE is marked "Not Applicable" by contextual security analysis.
            -->
            <dependency>
                <groupId>org.jdom</groupId>
                <artifactId>jdom</artifactId>
                <version>1.1.3</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.jetbrains.teamcity.internal</groupId>
                <artifactId>agent</artifactId>
                <version>${teamcity.version}</version>
                <scope>provided</scope>
                <exclusions>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-lang</groupId>
                        <artifactId>commons-lang</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-httpclient</groupId>
                        <artifactId>commons-httpclient</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jetbrains.teamcity.internal</groupId>
                <artifactId>web</artifactId>
                <version>${teamcity.version}</version>
                <scope>provided</scope>
                <exclusions>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-lang</groupId>
                        <artifactId>commons-lang</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-httpclient</groupId>
                        <artifactId>commons-httpclient</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>net.i2p.crypto</groupId>
                        <artifactId>eddsa</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jetbrains.teamcity</groupId>
                <artifactId>agent-api</artifactId>
                <version>${teamcity.version}</version>
                <scope>provided</scope>
                <exclusions>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-lang</groupId>
                        <artifactId>commons-lang</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-httpclient</groupId>
                        <artifactId>commons-httpclient</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jetbrains.teamcity</groupId>
                <artifactId>common-api</artifactId>
                <version>${teamcity.version}</version>
                <scope>provided</scope>
                <exclusions>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-lang</groupId>
                        <artifactId>commons-lang</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-httpclient</groupId>
                        <artifactId>commons-httpclient</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jetbrains.teamcity.internal</groupId>
                <artifactId>server</artifactId>
                <version>${teamcity.version}</version>
                <scope>provided</scope>
                <exclusions>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-lang</groupId>
                        <artifactId>commons-lang</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-httpclient</groupId>
                        <artifactId>commons-httpclient</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>net.i2p.crypto</groupId>
                        <artifactId>eddsa</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jetbrains.teamcity</groupId>
                <artifactId>server-api</artifactId>
                <version>${teamcity.version}</version>
                <scope>provided</scope>
                <exclusions>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-lang</groupId>
                        <artifactId>commons-lang</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>commons-httpclient</groupId>
                        <artifactId>commons-httpclient</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jfrog.buildinfo</groupId>
                <artifactId>build-info-api</artifactId>
                <version>${build.info.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>com.google.guava</groupId>
                        <artifactId>guava</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jfrog.buildinfo</groupId>
                <artifactId>build-info-client</artifactId>
                <version>${build.info.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jfrog.buildinfo</groupId>
                <artifactId>build-info-extractor</artifactId>
                <version>${build.info.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jfrog.buildinfo</groupId>
                <artifactId>build-info-vcs</artifactId>
                <version>${build.info.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jfrog.buildinfo</groupId>
                <artifactId>build-info-extractor-ivy</artifactId>
                <version>${build.info.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.apache.ant</groupId>
                        <artifactId>ant</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.apache.ivy</groupId>
                        <artifactId>ivy</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.testng</groupId>
                        <artifactId>testng</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jfrog.buildinfo</groupId>
                <artifactId>build-info-extractor-gradle</artifactId>
                <version>${build.info.gradle.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.apache.ivy</groupId>
                        <artifactId>ivy</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jfrog.buildinfo</groupId>
                <artifactId>build-info-extractor-maven3</artifactId>
                <version>${build.info.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.codehaus.groovy</groupId>
                        <artifactId>groovy-all</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jfrog.buildinfo</groupId>
                <artifactId>build-info-extractor-docker</artifactId>
                <version>${build.info.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-simple</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.bouncycastle</groupId>
                        <artifactId>bcpkix-jdk15on</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.bouncycastle</groupId>
                        <artifactId>bcprov-jdk15on</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.bouncycastle</groupId>
                        <artifactId>bcutil-jdk15on</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.jfrog.filespecs</groupId>
                <artifactId>file-specs-java</artifactId>
                <version>1.1.2</version>
            </dependency>
            <dependency>
                <groupId>org.apache.ivy</groupId>
                <artifactId>ivy</artifactId>
                <version>2.5.2</version>
            </dependency>
            <dependency>
                <groupId>org.testng</groupId>
                <artifactId>testng</artifactId>
                <version>7.7.0</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.easymock</groupId>
                <artifactId>easymock</artifactId>
                <version>5.2.0</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-compress</artifactId>
                <version>1.28.0</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>commons-fileupload</groupId>
                <artifactId>commons-fileupload</artifactId>
                <version>1.6.0</version>
            </dependency>
            <dependency>
                <groupId>org.freemarker</groupId>
                <artifactId>freemarker</artifactId>
                <version>2.3.33</version>
            </dependency>
            <dependency>
                <groupId>xerces</groupId>
                <artifactId>xercesImpl</artifactId>
                <version>2.12.2</version>
            </dependency>
            <dependency>
                <groupId>xalan</groupId>
                <artifactId>xalan</artifactId>
                <version>2.7.2</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-common</artifactId>
                <version>4.1.125.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec-http</artifactId>
                <version>4.1.125.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-handler</artifactId>
                <version>4.1.125.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec</artifactId>
                <version>4.1.125.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-buffer</artifactId>
                <version>4.1.125.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport</artifactId>
                <version>4.1.125.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-resolver</artifactId>
                <version>4.1.125.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-handler-proxy</artifactId>
                <version>4.1.125.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec-socks</artifactId>
                <version>4.1.125.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport-native-epoll</artifactId>
                <version>4.1.125.Final</version>
                <classifier>linux-x86_64</classifier>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport-native-unix-common</artifactId>
                <version>4.1.125.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport-native-kqueue</artifactId>
                <version>4.1.125.Final</version>
                <classifier>osx-x86_64</classifier>
            </dependency>
            <!-- Override vulnerable OWASP HTML sanitizer -->
            <dependency>
                <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
                <artifactId>owasp-java-html-sanitizer</artifactId>
                <version>20211018.1</version>
            </dependency>
            <!--
                ===================================================================================
                SPRING FRAMEWORK VERSION LIMITATION - CANNOT UPGRADE
                ===================================================================================
                
                Spring Framework 5.3.39 and Spring Security 5.8.16 are the LATEST PUBLICLY 
                AVAILABLE versions. We cannot upgrade further due to TWO constraints:
                
                CONSTRAINT 1: SPRING 5.3.x END-OF-LIFE (Open Source)
                ─────────────────────────────────────────────────────
                - Spring Framework 5.3.x OSS support ENDED on August 31, 2024
                - Version 5.3.39 is the LAST publicly available release on Maven Central
                - Versions 5.3.40+ (including 5.3.42 with CVE fixes) are ONLY available 
                  through VMware/Broadcom commercial support agreements (not public)
                - Same applies to Spring Security 5.8.x (5.8.16 is last public release)
                
                CONSTRAINT 2: TEAMCITY COMPATIBILITY
                ────────────────────────────────────
                - TeamCity (even version 2025.11) bundles Spring 5.3.x and javax.servlet
                - Spring 6.x requires Jakarta EE namespace (jakarta.*) instead of (javax.*)
                - Plugins MUST be compatible with what TeamCity provides at runtime
                - Using Spring 6.x would cause ClassNotFoundException at runtime
                
                UNFIXABLE CVEs (require Spring 6.x or commercial-only 5.3.40+ versions):
                ─────────────────────────────────────────────────────────────────────────
                - CVE-2024-38828 (spring-webmvc) - Fixed in 5.3.42 (commercial only)
                - CVE-2025-22228 (spring-security-crypto) - Fixed in 5.8.18 (commercial only)
                - CVE-2025-41242, CVE-2024-38820, CVE-2025-22233, CVE-2016-1000027
                - CVE-2025-41249, CVE-2024-38819, CVE-2024-38816
                - CVE-2025-41232, CVE-2025-41248 (Spring Security 6.x only)
                
                These CVEs are marked "Not Applicable" by JFrog contextual security analysis.
                
                RESOLUTION OPTIONS:
                ───────────────────
                1. Wait for JetBrains to migrate TeamCity to Spring 6.x / Jakarta EE
                   Track: https://youtrack.jetbrains.com/issues/TW
                2. Purchase VMware/Broadcom Spring commercial support for 5.3.40+ patches
                ===================================================================================
            -->
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-core</artifactId>
                <version>5.3.39</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-beans</artifactId>
                <version>5.3.39</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-context</artifactId>
                <version>5.3.39</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-web</artifactId>
                <version>5.3.39</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-webmvc</artifactId>
                <version>5.3.39</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-expression</artifactId>
                <version>5.3.39</version>
            </dependency>
            <!-- Spring Security 5.8.16 - latest available 5.x release -->
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-core</artifactId>
                <version>5.8.16</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-web</artifactId>
                <version>5.8.16</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-config</artifactId>
                <version>5.8.16</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.security</groupId>
                <artifactId>spring-security-crypto</artifactId>
                <version>5.8.16</version>
            </dependency>
            <!-- Add safer logging alternative -->
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>2.0.16</version>
            </dependency>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-simple</artifactId>
                <version>2.0.16</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-source-plugin</artifactId>
                    <version>3.3.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-clean-plugin</artifactId>
                    <version>3.3.2</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-resources-plugin</artifactId>
                    <version>3.3.1</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.11.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-install-plugin</artifactId>
                    <version>3.1.1</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-deploy-plugin</artifactId>
                    <version>3.1.1</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-jar-plugin</artifactId>
                    <version>3.3.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-assembly-plugin</artifactId>
                    <version>3.6.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-dependency-plugin</artifactId>
                    <version>3.6.1</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>3.2.2</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-report-plugin</artifactId>
                    <version>3.2.2</version>
                </plugin>
            </plugins>
        </pluginManagement>

        <resources>
            <resource>
                <filtering>false</filtering>
                <directory>src/main/java</directory>
                <includes>
                    <include>**/*</include>
                </includes>
                <excludes>
                    <exclude>**/*.java</exclude>
                </excludes>
            </resource>
            <resource>
                <filtering>false</filtering>
                <directory>src/main/resources</directory>
                <includes>
                    <include>**/*</include>
                </includes>
                <excludes>
                    <exclude>**/*.java</exclude>
                </excludes>
            </resource>
            <resource>
                <filtering>true</filtering>
                <directory>src/main/filtered-resources</directory>
            </resource>
        </resources>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.11.0</version>
                <configuration>
                    <release>21</release>
                    <encoding>UTF-8</encoding>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-dependency-plugin</artifactId>
                <version>3.6.1</version>
                <executions>
                    <execution>
                        <id>exclude-vulnerable-deps</id>
                        <goals>
                            <goal>purge-local-repository</goal>
                        </goals>
                        <configuration>
                            <manualIncludes>
                                <manualInclude>log4j:log4j</manualInclude>
                                <manualInclude>dom4j:dom4j</manualInclude>
                                <manualInclude>org.bouncycastle:bcpkix-jdk15on</manualInclude>
                                <manualInclude>org.bouncycastle:bcprov-jdk15on</manualInclude>
                            </manualIncludes>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.4.1</version>
                <executions>
                    <execution>
                        <id>enforce-banned-dependencies</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <bannedDependencies>
                                    <excludes>
                                        <!-- Vulnerable/EOL dependencies banned from final build -->
                                        <exclude>log4j:log4j</exclude>
                                        <exclude>dom4j:dom4j</exclude>
                                        <exclude>org.bouncycastle:bcpkix-jdk15on</exclude>
                                        <exclude>org.bouncycastle:bcprov-jdk15on</exclude>
                                        <exclude>commons-lang:commons-lang</exclude>
                                        <exclude>commons-httpclient:commons-httpclient</exclude>
                                        <exclude>net.i2p.crypto:eddsa</exclude>
                                    </excludes>
                                </bannedDependencies>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <executions>
                    <execution>
                        <id>attach-sources</id>
                        <goals>
                            <goal>jar-no-fork</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <repositories>
        <repository>
            <id>central</id>
            <name>central</name>
            <url>https://repo.maven.apache.org/maven2</url>
        </repository>
        <repository>
            <id>jetbrains-all</id>
            <url>https://download.jetbrains.com/teamcity-repository</url>
        </repository>
        <repository>
            <id>jfrog-oss-releases</id>
            <name>The jfrog repository for 3rd party releases</name>
            <url>https://releases.jfrog.io/artifactory/oss-releases</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
        <repository>
            <id>jfrog-oss-snapshots</id>
            <name>The jfrog repository for 3rd party snapshots</name>
            <url>https://releases.jfrog.io/artifactory/oss-snapshots</url>
            <releases>
                <enabled>false</enabled>
            </releases>
        </repository>
    </repositories>
</project>
