Description

<dependency>
    <groupId>com.github.promregator</groupId>
    <artifactId>promregator</artifactId>
    <version>1.1.6-fix-1146-2</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>

	<groupId>com.github.promregator</groupId>
	<artifactId>promregator</artifactId>
	<version>1.1.6-fix-1146-2</version>
	<packaging>jar</packaging>

	<name>Promregator</name>
	<description>Prometheus/CloudFoundry Metrics Aggregator</description>
	<url>https://github.com/promregator/promregator</url>

	<licenses>
		<license>
			<name>The Apache License, Version 2.0</name>
			<url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
		</license>
	</licenses>

	<developers>
		<developer>
			<name>Nico Schmoigl</name>
			<email>github@schmoigl-online.de</email>
			<organization>n/a</organization>
			<organizationUrl>https://github.com/promregator</organizationUrl>
		</developer>
	</developers>

	<scm>
		<connection>scm:git:https://github.com/promregator/promregator.git</connection>
		<developerConnection>scm:git:ssh://github.com:promregator/promregator.git</developerConnection>
		<url>https://github.com/promregator/promregator/tree/master/</url>
	</scm>

	<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>3.3.10</version> <!-- see also https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-parent -->
		<!-- Warning! On bumping also check guava-version below! -->
		<!-- Note! If you bump this version here, also check the spring-boot CLI version 
		in our integration tests (see Jenkinsfile) -->
		<relativePath /> <!-- lookup parent from repository -->
	</parent>

	<properties>
		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
		<java.version>17</java.version>

		<!-- note: spring-boot.run.fork=false does not work in spring3+ anymore!
		Use spring-boot.run.jvmArguments=-D.... instead! -->

		<spring-cloud.version>2023.0.5</spring-cloud.version>
		<!--  For release information see also https://spring.io/projects/spring-cloud
		and https://github.com/spring-cloud/spring-cloud-release/wiki/Spring-Cloud-2021.0-Release-Notes
		and https://github.com/spring-cloud/spring-cloud-release/wiki/Spring-Cloud-2022.0-Release-Notes
		New versions at https://mvnrepository.com/artifact/org.springframework.cloud/spring-cloud-dependencies -->
		
		<prometheus.version>0.16.0</prometheus.version>
		
		<httpclient4.version>4.5.14</httpclient4.version>

		<!-- https://mvnrepository.com/artifact/org.cloudfoundry/cloudfoundry-client-reactor -->
		<cloudfoundry.client.version>5.15.0.BUILD-fix-1146</cloudfoundry.client.version>
		<!-- see also https://github.com/cloudfoundry/cf-java-client -->
		
		<sonar.projectKey>promregator</sonar.projectKey>
		<sonar.organization>promregator</sonar.organization>
		<sonar.host.url>https://sonarcloud.io</sonar.host.url>
		<sonar.coverage.jacoco.xmlReportPaths>${project.reporting.outputDirectory}/jacoco-ut/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>

		<!-- Warning! This should be in line to what spring-framework uses. Unfortunately, 
			there is no global constant provided by spring-boot for the version. -->
		<guava-version>32.1.2-jre</guava-version>
	</properties>

	<dependencies>
		<dependency>
			<groupId>org.springframework.cloud</groupId>
			<artifactId>spring-cloud-starter</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
		</dependency>

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-security</artifactId>
		</dependency>

		<!-- necessary for showing proper error messages -->
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-thymeleaf</artifactId>
		</dependency>

		<!-- 
		Warning!
		com.sap.cloud.security.xsuaa:token-client declares a (transitive)
		dependency to org.json:json.
		
		org.springframework.boot:spring-boot-starter-test declares a 
		(transitive) dependency to com.vaadin.external.google:android-json
		
		Both org.json:json and com.vaadin.external.google:android-json
		declare classes in the package org.json. In particular, the class
		org.json.JsonObject is declared. However, the variant provided by 
		com.vaadin.external.google:android-json is a significantly reduced
		one, and - for instance - does not provide a method called 
		".toMap()", which org.json:json does.
		
		com.sap.cloud.security.xsuaa:token-client expects to see the org.json:json
		variant - and particular makes use of org.json.JsonObject.toMap().
		
		However, a class is a highlander: There can only be one class being loaded
		under a given name (for the same classloader - Promregator only has
		one classloader in its entire configuration). So, it is important,
		which of the two libraries is stated *first* in the classpath.
		The classpath has the same order as the order of XML dependency 
		declarations in your pom.xml.
		See also https://github.com/SAP/cloud-security-xsuaa-integration/blob/1c133ee17b629b07d58a7aec512daf98b067c031/docs/Troubleshooting_JsonClasspathIssues.md
		
		That is why, the dependency declaration of com.sap.cloud.security.xsuaa:token-client
		should be stated in the pom.xml before the dependency declaration of 
		org.springframework.boot:spring-boot-starter-test takes place.
		Note that the difference in scope does not have any effect in this
		case (i.e. a wrong order will "only" break the execution of the
		unit tests).
		-->
		<dependency>
			<groupId>com.sap.cloud.security.xsuaa</groupId>
			<artifactId>token-client</artifactId>
			<version>2.17.5</version>
			<!--  see also https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/token-client -->
		</dependency>

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
		</dependency>

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-configuration-processor</artifactId>
			<optional>true</optional>
		</dependency>

		<dependency>
			<groupId>org.jetbrains.kotlin</groupId>
			<artifactId>kotlin-reflect</artifactId>
		</dependency>
		<dependency>
			<groupId>org.jetbrains.kotlin</groupId>
			<artifactId>kotlin-stdlib-jdk8</artifactId>
		</dependency>
		<dependency>
			<groupId>org.jetbrains.kotlinx</groupId>
			<artifactId>kotlinx-coroutines-reactor</artifactId>
		</dependency>
		<dependency>
			<groupId>org.jetbrains.kotlinx</groupId>
			<artifactId>kotlinx-coroutines-jdk8</artifactId>
		</dependency>
		<dependency>
			<groupId>org.jetbrains.kotlinx</groupId>
			<artifactId>kotlinx-coroutines-reactive</artifactId>
		</dependency>
		<dependency>
			<groupId>org.jetbrains.kotlinx</groupId>
			<artifactId>kotlinx-coroutines-test</artifactId>
			<scope>test</scope>
		</dependency>

		<dependency>
			<groupId>io.github.microutils</groupId>
			<artifactId>kotlin-logging-jvm</artifactId>
			<version>2.0.11</version>
		</dependency>

		<!-- CF API -->
		<dependency>
			<groupId>org.cloudfoundry</groupId>
			<artifactId>cloudfoundry-client-reactor</artifactId>
			<version>${cloudfoundry.client.version}</version>
		</dependency>

		<dependency>
			<groupId>org.cloudfoundry</groupId>
			<artifactId>cloudfoundry-operations</artifactId>
			<version>${cloudfoundry.client.version}</version>
		</dependency>

		<!-- version should be omitted here, as implicitly provided by cloudfoundry-client-reactor -->
		<dependency>
			<groupId>io.projectreactor.netty</groupId>
			<artifactId>reactor-netty</artifactId>
		</dependency>

		<!-- https://mvnrepository.com/artifact/io.projectreactor/reactor-core -->
		<dependency>
			<groupId>io.projectreactor</groupId>
			<artifactId>reactor-core</artifactId>
		</dependency>

		<!-- https://mvnrepository.com/artifact/org.apache.commons/commons-collections4 -->
		<dependency>
			<groupId>org.apache.commons</groupId>
			<artifactId>commons-collections4</artifactId>
			<version>4.4</version>
		</dependency>

		<!-- see also https://github.com/google/guava/issues/2350#issuecomment-169097253 
			and https://stackoverflow.com/a/52345191 -->
		<dependency>
			<groupId>com.github.ben-manes.caffeine</groupId>
			<artifactId>caffeine</artifactId>
		</dependency>
		<dependency>
			<groupId>com.google.guava</groupId>
			<artifactId>guava-testlib</artifactId>
			<version>${guava-version}</version>
			<scope>test</scope>
			<exclusions>
				<exclusion>
					<groupId>junit</groupId>
					<artifactId>junit</artifactId>
				</exclusion>
			</exclusions>
		</dependency>

		<!-- https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient -->
		<dependency>
			<groupId>org.apache.httpcomponents</groupId>
			<artifactId>httpclient</artifactId>
			<version>${httpclient4.version}</version>
		</dependency>

		<dependency>
			<groupId>org.apache.commons</groupId>
			<artifactId>commons-lang3</artifactId>
		</dependency>

		<!-- https://mvnrepository.com/artifact/com.google.code.gson/gson -->
		<dependency>
			<groupId>com.google.code.gson</groupId>
			<artifactId>gson</artifactId>
		</dependency>

		<dependency>
			<groupId>org.mockito</groupId>
			<artifactId>mockito-core</artifactId>
			<scope>test</scope>
		</dependency>

		<dependency>
			<groupId>com.github.stefanbirkner</groupId>
			<artifactId>system-rules</artifactId>
			<version>1.19.0</version>
			<scope>test</scope>
		</dependency>

		<dependency>
			<groupId>org.awaitility</groupId>
			<artifactId>awaitility</artifactId>
			<scope>test</scope>
		</dependency>

		<!-- Prometheus stuff -->
		<dependency>
			<groupId>io.prometheus</groupId>
			<artifactId>simpleclient</artifactId>
			<version>${prometheus.version}</version>
		</dependency>
		<!-- https://mvnrepository.com/artifact/io.prometheus/simpleclient_common -->
		<dependency>
			<groupId>io.prometheus</groupId>
			<artifactId>simpleclient_common</artifactId>
			<version>${prometheus.version}</version>
		</dependency>
		<!-- Hotspot JVM metrics -->
		<dependency>
			<groupId>io.prometheus</groupId>
			<artifactId>simpleclient_hotspot</artifactId>
			<version>${prometheus.version}</version>
		</dependency>
		<!-- Caffeine metrics -->
		<dependency>
			<groupId>io.prometheus</groupId>
			<artifactId>simpleclient_caffeine</artifactId>
			<version>${prometheus.version}</version>
		</dependency>

		<!-- Findbugs annotations for exemptions -->
		<dependency>
			<groupId>com.google.code.findbugs</groupId>
			<artifactId>annotations</artifactId>
			<version>3.0.1</version>
		</dependency>

		<!-- see also https://github.com/owasp/json-sanitizer - Apache 2.0 license 
		most recent version https://mvnrepository.com/artifact/com.mikesamuel/json-sanitizer -->
		<dependency>
			<groupId>com.mikesamuel</groupId>
			<artifactId>json-sanitizer</artifactId>
			<version>1.2.3</version>
		</dependency>

		<dependency>
			<groupId>com.google.guava</groupId>
			<artifactId>guava</artifactId>
			<version>${guava-version}</version>
		</dependency>
		
		<!-- required to remove CVE-2025-29908; if a higher version gets available, may be removed -->
		<dependency>
			<groupId>io.netty.incubator</groupId>
			<artifactId>netty-incubator-codec-native-quic</artifactId>
			<version>0.0.71.Final</version>
		</dependency>
	</dependencies>

	<dependencyManagement>
		<dependencies>
			<dependency>
				<groupId>org.springframework.cloud</groupId>
				<artifactId>spring-cloud-dependencies</artifactId>
				<version>${spring-cloud.version}</version>
				<type>pom</type>
				<scope>import</scope>
			</dependency>
		</dependencies>
	</dependencyManagement>

	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
			</plugin>

			<!-- see also https://central.sonatype.org/pages/apache-maven.html -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-source-plugin</artifactId>
				<executions>
					<execution>
						<id>attach-sources</id>
						<goals>
							<goal>jar-no-fork</goal>
						</goals>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-javadoc-plugin</artifactId>
				<configuration> <!-- see also https://stackoverflow.com/a/54323506 -->
					<javadocExecutable>${java.home}/bin/javadoc</javadocExecutable>
				</configuration>
				<executions>
					<execution>
						<id>attach-javadocs</id>
						<goals>
							<goal>jar</goal>
						</goals>
					</execution>
				</executions>
			</plugin>


			<plugin>
				<groupId>org.jetbrains.kotlin</groupId>
				<artifactId>kotlin-maven-plugin</artifactId>
				<configuration>
					<args>
						<arg>-Xjsr305=strict -Xopt-in=kotlin.RequiresOptIn</arg>
					</args>
					<compilerPlugins>
						<!-- The kotlin-maven-plugin compiled the Kotlin files. The spring/kotlin-maven-allopen sub-plugin makes Spring annotated
							classes (@Controller, @Service, etc) open (non-final) which is needed by Spring for proxying/APO, etc.

							This is needed since Kotlin makes classes final by default.-->

						<plugin>spring</plugin>
					</compilerPlugins>
				</configuration>

				<dependencies>
					<dependency>
						<groupId>org.jetbrains.kotlin</groupId>
						<artifactId>kotlin-maven-allopen</artifactId>
						<version>${kotlin.version}</version>
					</dependency>
				</dependencies>
				<executions>
					<execution>
						<id>compile</id>
						<goals>
							<goal>compile</goal>
						</goals>
						<configuration>
							<sourceDirs>
								<sourceDir>${project.basedir}/src/main/kotlin</sourceDir>
								<sourceDir>${project.basedir}/src/main/java</sourceDir>
							</sourceDirs>
						</configuration>
					</execution>
					<execution>
						<id>test-compile</id>
						<goals> <goal>test-compile</goal> </goals>
						<configuration>
							<sourceDirs>
								<sourceDir>${project.basedir}/src/test/kotlin</sourceDir>
								<sourceDir>${project.basedir}/src/test/java</sourceDir>
							</sourceDirs>
						</configuration>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-compiler-plugin</artifactId>
				<executions>
					<!-- Replacing default-compile as it is treated specially by maven -->
					<execution>
						<id>default-compile</id>
						<phase>none</phase>
					</execution>
					<!-- Replacing default-testCompile as it is treated specially by maven -->
					<execution>
						<id>default-testCompile</id>
						<phase>none</phase>
					</execution>
					<execution>
						<id>java-compile</id>
						<phase>compile</phase>
						<goals>
							<goal>compile</goal>
						</goals>
					</execution>
					<execution>
						<id>java-test-compile</id>
						<phase>test-compile</phase>
						<goals>
							<goal>testCompile</goal>
						</goals>
					</execution>
				</executions>
			</plugin>
		</plugins>
	</build>

	<profiles>
		<profile>
			<id>withTests</id>
			<build>
				<plugins>
					<plugin>
						<groupId>org.jacoco</groupId>
						<artifactId>jacoco-maven-plugin</artifactId>
						<version>0.8.13</version>
						<executions>
							<!-- Prepares the property pointing to the JaCoCo runtime agent which 
								is passed as VM argument when Maven the Surefire plugin is executed. -->
							<execution>
								<id>pre-unit-test</id>
								<goals>
									<goal>prepare-agent</goal>
								</goals>
								<configuration>
									<!-- Sets the path to the file which contains the execution data. -->
									<destFile>${project.build.directory}/coverage-reports/jacoco-ut.exec</destFile>
									<!-- Sets the name of the property containing the settings for JaCoCo 
										runtime agent. -->
									<propertyName>surefireArgLine</propertyName>
								</configuration>
							</execution>
							<!-- Ensures that the code coverage report for unit tests is created 
								after unit tests have been run. -->
							<execution>
								<id>post-unit-test</id>
								<phase>test</phase>
								<goals>
									<goal>report</goal>
								</goals>
								<configuration>
									<!-- Sets the path to the file which contains the execution data. -->
									<dataFile>${project.build.directory}/coverage-reports/jacoco-ut.exec</dataFile>
									<!-- Sets the output directory for the code coverage report. -->
									<outputDirectory>${project.reporting.outputDirectory}/jacoco-ut</outputDirectory>
								</configuration>
							</execution>
						</executions>
					</plugin>

					<plugin>
						<groupId>org.apache.maven.plugins</groupId>
						<artifactId>maven-surefire-plugin</artifactId>
						<configuration>
							<!-- Sets the VM argument line used when unit tests are run. -->
							<argLine>${surefireArgLine}</argLine>
						</configuration>
					</plugin>

					<plugin>
						<groupId>com.github.spotbugs</groupId>
						<artifactId>spotbugs-maven-plugin</artifactId>
						<version>4.7.3.4</version>
						<executions>
							<execution>
								<phase>verify</phase>
								<goals>
									<goal>spotbugs</goal>
								</goals>
							</execution>
						</executions>
					</plugin>

					<plugin>
						<groupId>org.apache.maven.plugins</groupId>
						<artifactId>maven-pmd-plugin</artifactId>
						<version>3.20.0</version>
						<configuration>
							<linkXRef>false</linkXRef> <!-- see also https://stackoverflow.com/a/18390459 -->
							<!-- see also https://stackoverflow.com/a/38958480 -->
							<rulesets>
								<ruleset>${project.basedir}/test/pmd/pmd-exclude.xml</ruleset>
							</rulesets>
						</configuration>
						<executions>
							<execution>
								<phase>verify</phase>
								<goals>
									<goal>pmd</goal>
									<goal>cpd</goal>
								</goals>
							</execution>
						</executions>
					</plugin>
				</plugins>
			</build>
		</profile>

		<profile>
			<id>release</id>
			<distributionManagement>
				<snapshotRepository>
					<id>ossrh</id>
					<url>https://oss.sonatype.org/content/repositories/snapshots</url>
				</snapshotRepository>
				<repository>
					<id>ossrh</id>
					<url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
				</repository>
			</distributionManagement>
		</profile>

		<profile>
			<id>withDeploy</id>
			<build>
				<plugins>
					<!-- see also https://central.sonatype.org/pages/apache-maven.html -->
					<plugin>
						<groupId>org.apache.maven.plugins</groupId>
						<artifactId>maven-gpg-plugin</artifactId>
						<version>1.6</version>
					</plugin>
					<plugin>
						<groupId>org.sonatype.central</groupId>
						<artifactId>central-publishing-maven-plugin</artifactId>
						<version>0.7.0</version>
						<extensions>true</extensions>
						<configuration>
							<publishingServerId>central</publishingServerId>
							<autoPublish>true</autoPublish>
							<waitUntil>validated</waitUntil>
							<checksums>all</checksums>
						</configuration>
					</plugin>

				</plugins>
			</build>

		</profile>

	</profiles>

</project>