Description

<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-secure-xml</artifactId>
    <version>1.0.0</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements.  See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License.  You may obtain a copy of the License at

     https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-parent</artifactId>
    <version>104</version>
  </parent>
  <artifactId>commons-secure-xml</artifactId>
  <version>1.0.0</version>
  <name>Apache Commons Secure XML</name>
  <url>https://commons.apache.org/proper/commons-secure-xml/</url>
  <inceptionYear>2026</inceptionYear>
  <description>Apache Commons Secure XML provides secure-by-default JAXP factory creation, abstracting over
    implementation-specific XXE securing differences between the stock JDK and external JAXP implementations
    (Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).</description>
  <scm>
    <connection>scm:git:https://gitbox.apache.org/repos/asf/commons-secure-xml.git</connection>
    <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/commons-secure-xml.git</developerConnection>
    <url>https://gitbox.apache.org/repos/asf?p=commons-secure-xml.git</url>
    <tag>rel/commons-secure-xml-${project.version}</tag>
  </scm>
  <properties>
    <!-- Release-related properties -->
    <commons.main.branch>main</commons.main.branch>
    <commons.release.version>1.0.0</commons.release.version>
    <commons.release.desc>(Java 8+)</commons.release.desc>
    <commons.rc.version>RC2</commons.rc.version>
    <!-- japicmp baseline: disable for first release
    <commons.bc.version>1.0.0</commons.bc.version> -->
    <japicmp.skip>true</japicmp.skip>
    <commons.release.next>1.0.1</commons.release.next>
    <commons.componentid>secure-xml</commons.componentid>
    <commons.packageId>secure-xml</commons.packageId>
    <commons.module.name>org.apache.commons.xml.secure</commons.module.name>
    <commons.jira.id>COMMONSXML</commons.jira.id>
    <commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/proper/commons-secure-xml</commons.scmPubUrl>
    <!-- OSGi bundle metadata: override commons-parent's org.apache.commons.* defaults. -->
    <commons.osgi.symbolicName>org.apache.commons.xml.secure</commons.osgi.symbolicName>
    <commons.osgi.export>org.apache.commons.xml.secure.*;version=${project.version};-noimport:=true</commons.osgi.export>
    <!-- The negation drops the JDK-internal package bnd infers from the reflective Java 8 fallback in SecureXMLInputFactory.newDefaultFactory(). -->
    <commons.osgi.import>
      !com.sun.xml.internal.stream,
      net.sf.saxon.*;resolution:=optional,
      org.apache.xerces.*;resolution:=optional,
      *
    </commons.osgi.import>
    <project.build.outputTimestamp>2026-09-02T22:09:38Z</project.build.outputTimestamp>
    <!-- Java baseline -->
    <maven.compiler.source>1.8</maven.compiler.source>
    <maven.compiler.target>1.8</maven.compiler.target>
    <!-- GraalVM native-image tooling; used by the `native-xalan` profile only. -->
    <commons.graalvm.buildtools.version>1.1.11</commons.graalvm.buildtools.version>
    <!-- Optional JAXP implementations used by bundled providers. -->
    <commons.saxon.version>12.9</commons.saxon.version>
    <commons.woodstox.version>7.1.1</commons.woodstox.version>
    <commons.xalan.version>2.7.3</commons.xalan.version>
    <commons.xerces.version>2.12.2</commons.xerces.version>
    <!-- Test-only: computes each secure class' shade closure, mirroring maven-shade minimizeJar, for ShadingFootprintTest. -->
    <commons.jdependency.version>2.16</commons.jdependency.version>
    <!--
      jacoco-maven-plugin: Should only get better.

      A single `mvn -Pjacoco clean verify` run covers less than the project as a whole does.
      These minima need to pass on all JDK versions, in particular JDK 8 and JDK 21.
    -->
    <commons.jacoco.haltOnFailure>true</commons.jacoco.haltOnFailure>
    <commons.jacoco.classRatio>0.96</commons.jacoco.classRatio>
    <commons.jacoco.instructionRatio>0.93</commons.jacoco.instructionRatio>
    <commons.jacoco.methodRatio>0.95</commons.jacoco.methodRatio>
    <commons.jacoco.branchRatio>0.87</commons.jacoco.branchRatio>
    <commons.jacoco.lineRatio>0.93</commons.jacoco.lineRatio>
    <commons.jacoco.complexityRatio>0.92</commons.jacoco.complexityRatio>
  </properties>
  <dependencies>
    <!--
      Saxon-HE supplies types we reference at compile time (the Saxon provider). It is not part of the consumer
      contract: it is declared in provided scope, so callers who want Saxon-HE for XSLT/XPath bring it themselves
      and it is never pulled in transitively.
    -->
    <dependency>
      <groupId>net.sf.saxon</groupId>
      <artifactId>Saxon-HE</artifactId>
      <version>${commons.saxon.version}</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter</artifactId>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.mockito</groupId>
      <artifactId>mockito-core</artifactId>
      <scope>test</scope>
    </dependency>
    <!-- Reads the compiled classes to compute each secure class' transitive class closure (the same computation maven-shade minimizeJar performs). -->
    <dependency>
      <groupId>org.vafer</groupId>
      <artifactId>jdependency</artifactId>
      <version>${commons.jdependency.version}</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
  <build>
    <defaultGoal>clean checkstyle:check spotbugs:check pmd:check javadoc:javadoc verify</defaultGoal>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-checkstyle-plugin</artifactId>
          <configuration>
            <configLocation>${basedir}/src/conf/checkstyle.xml</configLocation>
            <enableRulesSummary>false</enableRulesSummary>
            <!-- Later:
            <includeTestSourceDirectory>true</includeTestSourceDirectory> -->
          </configuration>
        </plugin>
        <plugin>
          <groupId>com.github.spotbugs</groupId>
          <artifactId>spotbugs-maven-plugin</artifactId>
          <configuration>
            <excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-pmd-plugin</artifactId>
          <configuration>
            <rulesets>
              <ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
            </rulesets>
          </configuration>
        </plugin>
        <plugin>
          <!-- TODO Remove when commons-parent 105 is available. -->
          <groupId>org.codehaus.mojo</groupId>
          <artifactId>animal-sniffer-maven-plugin</artifactId>
          <configuration>
            <ignores>
              <!-- MethodHandle.invokeExact is signature-polymorphic: javac records the ad-hoc call-site descriptor, which no signature
                   database lists, so the checker flags a false positive. The method itself exists on every supported runtime (Java 7+);
                   absent *looked-up* methods are handled at runtime by findStatic returning null. -->
              <ignore>java.lang.invoke.MethodHandle</ignore>
            </ignores>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.jacoco</groupId>
          <artifactId>jacoco-maven-plugin</artifactId>
          <configuration>
            <append>true</append>
          </configuration>
        </plugin>	
      </plugins>
    </pluginManagement>
    <plugins>
      <!--
        Run the test suite eight times, each with a distinct JAXP combination:

          - test-jdk-xerces:    stock JDK TrAX and XPath over Apache Xerces SAX/DOM
                                (the only cell where jdk.xml.overrideDefaultParser decides which parser rewrites sources)
          - test-saxon:         Saxon-HE (TrAX, XPath) over stock JDK SAX
          - test-saxon-xerces:  Saxon-HE (TrAX, XPath) over stock JDK SAX or Apache Xerces SAX
                                (Saxon prefers the JDK SAX provider but may resolve to Xerces)
          - test-stockjdk:      stock JDK factories only (every group except xpath3)
          - test-woodstox:      Woodstox (StAX)
          - test-xalan:         Apache Xalan (TrAX, XPath) over stock JDK SAX
          - test-xalan-xerces:  Apache Xalan (TrAX, XPath) over Apache Xerces SAX
          - test-xerces:        Apache Xerces (DOM, SAX, Schema)
      -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <!--
          Make the underlying JAXP factories as permissive as the JDK allows. Secure factories produced by
          org.apache.commons.xml.secure should still block every attack the test suite throws at them; if a test passes only
          because the JDK's defaults intervened, we want it to fail here so the gap shows up.

          Inherited by every execution defined below.
        -->
        <configuration>
          <systemPropertyVariables>
            <!-- Allow all protocols for external DTDs, schemas, and stylesheets. -->
            <javax.xml.accessExternalDTD>all</javax.xml.accessExternalDTD>
            <javax.xml.accessExternalSchema>all</javax.xml.accessExternalSchema>
            <javax.xml.accessExternalStylesheet>all</javax.xml.accessExternalStylesheet>
          </systemPropertyVariables>
        </configuration>
        <executions>
          <execution>
            <id>default-test</id>
            <phase>none</phase>
          </execution>
          <execution>
            <id>test-saxon</id>
            <goals>
              <goal>test</goal>
            </goals>
            <configuration>
              <reportsDirectory>${project.build.directory}/surefire-reports/saxon</reportsDirectory>
              <!-- Saxon contributes TrAX (transformer + stylesheet) and XPath; xpath3 covers Saxon-only XPath 3.1 functions. -->
              <groups>trax,xpath3</groups>
            </configuration>
          </execution>
          <execution>
            <id>test-saxon-xerces</id>
            <goals>
              <goal>test</goal>
            </goals>
            <configuration>
              <reportsDirectory>${project.build.directory}/surefire-reports/saxon-xerces</reportsDirectory>
              <!-- Same groups as test-saxon, but with Apache Xerces also visible to Saxon's SAX-provider lookup. -->
              <groups>trax,xpath3</groups>
              <additionalClasspathDependencies>
                <dependency>
                  <groupId>xerces</groupId>
                  <artifactId>xercesImpl</artifactId>
                  <version>${commons.xerces.version}</version>
                </dependency>
              </additionalClasspathDependencies>
            </configuration>
          </execution>
          <execution>
            <id>test-stockjdk</id>
            <goals>
              <goal>test</goal>
            </goals>
            <configuration>
              <reportsDirectory>${project.build.directory}/surefire-reports/stockjdk</reportsDirectory>
              <!-- Run every tagged and untagged test except xpath3, which needs Saxon on the classpath. -->
              <excludedGroups>xpath3</excludedGroups>
              <classpathDependencyExcludes>
                <exclude>net.sf.saxon:Saxon-HE</exclude>
              </classpathDependencyExcludes>
            </configuration>
          </execution>
          <execution>
            <id>test-woodstox</id>
            <goals>
              <goal>test</goal>
            </goals>
            <configuration>
              <reportsDirectory>${project.build.directory}/surefire-reports/woodstox</reportsDirectory>
              <!-- Woodstox only contributes StAX. -->
              <groups>stax</groups>
              <additionalClasspathDependencies>
                <dependency>
                  <groupId>com.fasterxml.woodstox</groupId>
                  <artifactId>woodstox-core</artifactId>
                  <version>${commons.woodstox.version}</version>
                </dependency>
              </additionalClasspathDependencies>
              <classpathDependencyExcludes>
                <exclude>net.sf.saxon:Saxon-HE</exclude>
              </classpathDependencyExcludes>
            </configuration>
          </execution>
          <execution>
            <id>test-xalan</id>
            <goals>
              <goal>test</goal>
            </goals>
            <configuration>
              <reportsDirectory>${project.build.directory}/surefire-reports/xalan</reportsDirectory>
              <!-- Xalan contributes TrAX and XPath. -->
              <groups>xpath,trax</groups>
              <additionalClasspathDependencies>
                <dependency>
                  <groupId>xalan</groupId>
                  <artifactId>serializer</artifactId>
                  <version>${commons.xalan.version}</version>
                </dependency>
                <dependency>
                  <groupId>xalan</groupId>
                  <artifactId>xalan</artifactId>
                  <version>${commons.xalan.version}</version>
                </dependency>
              </additionalClasspathDependencies>
              <classpathDependencyExcludes>
                <exclude>net.sf.saxon:Saxon-HE</exclude>
              </classpathDependencyExcludes>
            </configuration>
          </execution>
          <execution>
            <id>test-xalan-xerces</id>
            <goals>
              <goal>test</goal>
            </goals>
            <configuration>
              <reportsDirectory>${project.build.directory}/surefire-reports/xalan-xerces</reportsDirectory>
              <!-- Same groups as test-xalan, but with Apache Xerces winning Xalan's internal SAX-provider lookup. -->
              <groups>xpath,trax</groups>
              <additionalClasspathDependencies>
                <dependency>
                  <groupId>xalan</groupId>
                  <artifactId>serializer</artifactId>
                  <version>${commons.xalan.version}</version>
                </dependency>
                <dependency>
                  <groupId>xalan</groupId>
                  <artifactId>xalan</artifactId>
                  <version>${commons.xalan.version}</version>
                </dependency>
                <dependency>
                  <groupId>xerces</groupId>
                  <artifactId>xercesImpl</artifactId>
                  <version>${commons.xerces.version}</version>
                </dependency>
              </additionalClasspathDependencies>
              <classpathDependencyExcludes>
                <exclude>net.sf.saxon:Saxon-HE</exclude>
              </classpathDependencyExcludes>
            </configuration>
          </execution>
          <execution>
            <id>test-xerces</id>
            <goals>
              <goal>test</goal>
            </goals>
            <configuration>
              <reportsDirectory>${project.build.directory}/surefire-reports/xerces</reportsDirectory>
              <!-- Xerces only contributes DOM/SAX/Schema; the rest is JDK-bundled and already covered by test-stockjdk. -->
              <groups>dom,sax,schema</groups>
              <additionalClasspathDependencies>
                <dependency>
                  <groupId>xerces</groupId>
                  <artifactId>xercesImpl</artifactId>
                  <version>${commons.xerces.version}</version>
                </dependency>
              </additionalClasspathDependencies>
              <classpathDependencyExcludes>
                <exclude>net.sf.saxon:Saxon-HE</exclude>
              </classpathDependencyExcludes>
            </configuration>
          </execution>
          <execution>
            <id>test-jdk-xerces</id>
            <goals>
              <goal>test</goal>
            </goals>
            <configuration>
              <reportsDirectory>${project.build.directory}/surefire-reports/jdk-xerces</reportsDirectory>
              <!-- The only cell pairing the JDK TrAX and XPath implementations with a third-party ServiceLoader parser: Xerces resolves the
                   SAXParserFactory/DocumentBuilderFactory lookups (and the SchemaFactory one, which is why the schema-group FODP tests pin the JDK
                   implementation via newDefaultInstance), so jdk.xml.overrideDefaultParser genuinely decides which parser performs the secure
                   source rewrites. -->
              <groups>trax,xpath,schema</groups>
              <additionalClasspathDependencies>
                <dependency>
                  <groupId>xerces</groupId>
                  <artifactId>xercesImpl</artifactId>
                  <version>${commons.xerces.version}</version>
                </dependency>
              </additionalClasspathDependencies>
              <classpathDependencyExcludes>
                <exclude>net.sf.saxon:Saxon-HE</exclude>
              </classpathDependencyExcludes>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <!-- Do not publish a test-jar: the test classes are not part of the consumer contract. -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jar-plugin</artifactId>
        <executions>
          <execution>
            <id>default</id>
            <phase>none</phase>
          </execution>
        </executions>
      </plugin>
      <!--
        commons-parent's create-source-jar execution attaches both the main sources (jar-no-fork) and the test
        sources (test-jar-no-fork) in one execution. Disable it and re-bind a main-sources-only execution, so the
        published artifact keeps the required sources jar but drops the test-sources jar.
      -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-source-plugin</artifactId>
        <executions>
          <execution>
            <id>create-source-jar</id>
            <phase>none</phase>
          </execution>
          <execution>
            <id>create-main-source-jar</id>
            <phase>package</phase>
            <goals>
              <goal>jar-no-fork</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <!-- jdeps makes Saxon.HE a hard requirement; flip it to static (optional). The trailing * keeps the rest. -->
      <plugin>
        <groupId>org.moditect</groupId>
        <artifactId>moditect-maven-plugin</artifactId>
        <executions>
          <execution>
            <id>add-module-infos</id>
            <configuration>
              <module>
                <moduleInfo>
                  <requires>
                    static Saxon.HE;
                    *;
                  </requires>
                </moduleInfo>
              </module>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-checkstyle-plugin</artifactId>
      </plugin>
    </plugins>
  </build>
  <reporting>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-checkstyle-plugin</artifactId>
      </plugin>
      <plugin>
        <groupId>com.github.spotbugs</groupId>
        <artifactId>spotbugs-maven-plugin</artifactId>
        <configuration>
          <excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-pmd-plugin</artifactId>
        <configuration>
          <rulesets>
            <ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
          </rulesets>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-report-plugin</artifactId>
        <reportSets>
          <!-- The `report` and `failsafe-report` goals fork the test phase, running the suite a second time; the `*-only` goals read what the build already produced. -->
          <reportSet>
            <id>surefire</id>
            <reports>
              <report>report-only</report>
            </reports>
            <configuration>
              <!-- The suite runs once per JAXP combination, each execution into its own directory. -->
              <reportsDirectories>
                <reportsDirectory>${project.build.directory}/surefire-reports/jdk-xerces</reportsDirectory>
                <reportsDirectory>${project.build.directory}/surefire-reports/saxon</reportsDirectory>
                <reportsDirectory>${project.build.directory}/surefire-reports/saxon-xerces</reportsDirectory>
                <reportsDirectory>${project.build.directory}/surefire-reports/stockjdk</reportsDirectory>
                <reportsDirectory>${project.build.directory}/surefire-reports/woodstox</reportsDirectory>
                <reportsDirectory>${project.build.directory}/surefire-reports/xalan</reportsDirectory>
                <reportsDirectory>${project.build.directory}/surefire-reports/xalan-xerces</reportsDirectory>
                <reportsDirectory>${project.build.directory}/surefire-reports/xerces</reportsDirectory>
              </reportsDirectories>
            </configuration>
          </reportSet>
          <reportSet>
            <id>failsafe</id>
            <!-- The integration tests keep the plugin's own default, ${project.build.directory}/failsafe-reports. -->
            <reports>
              <report>failsafe-report-only</report>
            </reports>
          </reportSet>
        </reportSets>
      </plugin>
    </plugins>
  </reporting>
  <profiles>
    <!--
      Fold the Android instrumented run into the coverage data.
    -->
    <profile>
      <id>jacoco</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.jacoco</groupId>
            <artifactId>jacoco-maven-plugin</artifactId>
            <executions>
              <execution>
                <id>merge-android</id>
                <phase>pre-site</phase>
                <goals>
                  <goal>merge</goal>
                </goals>
                <configuration>
                  <fileSets>
                    <fileSet>
                      <directory>${project.build.directory}</directory>
                      <includes>
                        <include>jacoco.exec</include>
                      </includes>
                    </fileSet>
                    <fileSet>
                      <directory>${project.basedir}/android-tests/build/outputs/code_coverage</directory>
                      <includes>
                        <include>**/*.ec</include>
                      </includes>
                    </fileSet>
                  </fileSets>
                  <destFile>${project.build.directory}/jacoco.exec</destFile>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
    <!--
      Regression guard for the generated OSGi and JPMS descriptors.
      The JPMS test requires JDK 9+
    -->
    <profile>
      <id>java11-tests</id>
      <activation>
        <jdk>[11,)</jdk>
      </activation>
      <build>
        <plugins>
          <!-- Compile the src/test/java11 source root at release 11; the default test sources stay at release 8. -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-compiler-plugin</artifactId>
            <executions>
              <execution>
                <id>testCompile-java11</id>
                <phase>test-compile</phase>
                <goals>
                  <goal>testCompile</goal>
                </goals>
                <configuration>
                  <release>11</release>
                  <compileSourceRoots>
                    <compileSourceRoot>${project.basedir}/src/test/java11</compileSourceRoot>
                  </compileSourceRoots>
                </configuration>
              </execution>
            </executions>
          </plugin>
          <!-- Run DescriptorIT against the packaged jar; no OSGi framework or separate JPMS module needed. -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-failsafe-plugin</artifactId>
            <executions>
              <execution>
                <id>verify-descriptors</id>
                <goals>
                  <goal>integration-test</goal>
                  <goal>verify</goal>
                </goals>
                <configuration>
                  <systemPropertyVariables>
                    <buildJar>${project.build.directory}/${project.build.finalName}.jar</buildJar>
                  </systemPropertyVariables>
                </configuration>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <artifactId>maven-assembly-plugin</artifactId>
            <configuration>
              <descriptors>
                <descriptor>src/assembly/bin.xml</descriptor>
                <descriptor>src/assembly/src.xml</descriptor>
              </descriptors>
              <tarLongFileMode>gnu</tarLongFileMode>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>

    <!--
      Dependency versions only compatible with JDK 17+.
      -->
    <profile>
      <id>java17-dependencies</id>
      <activation>
        <jdk>[17,)</jdk>
      </activation>

      <properties>
        <commons.saxon.version>13.0</commons.saxon.version>
      </properties>
    </profile>
    <!--
      Runs the test suite as a GraalVM native image; activate with -Pnative-xalan on a GraalVM JDK.

      Worth a job because native-image resolves JAXP providers under the closed-world assumption: the lookup a JVM
      performs at run time through ServiceLoader is decided at build time instead.

      A native binary carries one classpath, so only `test-stockjdk` runs; the other JAXP combinations stay on the
      JVM matrix. Its `xpath3` group is excluded there already, and that group needs Saxon, which is dropped here.
    -->
    <profile>
      <id>native-xalan</id>
      <dependencies>
        <dependency>
          <groupId>org.graalvm.buildtools</groupId>
          <artifactId>junit-platform-native</artifactId>
          <version>${commons.graalvm.buildtools.version}</version>
          <scope>test</scope>
        </dependency>
        <!--
          Apache Xalan supplies TrAX. The stock JDK's XSLTC compiles each stylesheet into translet bytecode and
          defines the class at run time, which a closed-world image cannot do; Xalan interprets instead. Declared as
          project dependencies, not surefire's additionalClasspathDependencies, which native-image never sees.
        -->
        <dependency>
          <groupId>xalan</groupId>
          <artifactId>xalan</artifactId>
          <version>${commons.xalan.version}</version>
          <scope>test</scope>
        </dependency>
        <dependency>
          <groupId>xalan</groupId>
          <artifactId>serializer</artifactId>
          <version>${commons.xalan.version}</version>
          <scope>test</scope>
        </dependency>
      </dependencies>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-surefire-plugin</artifactId>
            <executions>
              <!--
                Only `test-stockjdk` is left running, unconfigured: it registers the tests the native binary replays.
                The profile's Xalan dependencies are on its classpath, so it is Xalan, not XSLTC, that supplies TrAX
                in both the JVM and the native run.

                Every other execution is silenced; their classpath swaps have no native equivalent.
              -->
              <execution>
                <id>test-xalan</id>
                <phase>none</phase>
              </execution>
              <execution>
                <id>test-saxon</id>
                <phase>none</phase>
              </execution>
              <execution>
                <id>test-saxon-xerces</id>
                <phase>none</phase>
              </execution>
              <execution>
                <id>test-woodstox</id>
                <phase>none</phase>
              </execution>
              <execution>
                <id>test-xalan-xerces</id>
                <phase>none</phase>
              </execution>
              <execution>
                <id>test-xerces</id>
                <phase>none</phase>
              </execution>
              <execution>
                <id>test-jdk-xerces</id>
                <phase>none</phase>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.graalvm.buildtools</groupId>
            <artifactId>native-maven-plugin</artifactId>
            <version>${commons.graalvm.buildtools.version}</version>
            <extensions>true</extensions>
            <configuration>
              <!-- The bundled metadata pins older JUnit versions, whose class-initialization directives
                   conflict with the JUnit this project resolves. -->
              <metadataRepository>
                <enabled>false</enabled>
              </metadataRepository>
              <!-- Xalan reflects on org.apache.xalan.templates.* setters and reads its serializer defaults from
                   property files; static analysis sees none of it. The agent records what the JVM run touched, and
                   the native binary replays those same tests, so the metadata covers it by construction. -->
              <agent>
                <enabled>true</enabled>
              </agent>
              <!-- Match `test-stockjdk`, which drops Saxon-HE. Saxon's JAXP entry points carry no reachability
                   metadata, so every ServiceLoader lookup would fail on a missing no-arg constructor. -->
              <exclusions>
                <exclusion>
                  <groupId>net.sf.saxon</groupId>
                  <artifactId>Saxon-HE</artifactId>
                </exclusion>
              </exclusions>
              <buildArgs>
                <!-- The JUnit platform feature discovers tests while the image is built, which initializes TestTag. -->
                <buildArg>--initialize-at-build-time=org.junit.platform.engine.TestTag</buildArg>
                <!-- Embed the fixtures explicitly: the agent records only resources a run actually opened. -->
                <buildArg>-H:IncludeResources=leaked/.*</buildArg>
              </buildArgs>
            </configuration>
            <executions>
              <execution>
                <id>test-native</id>
                <phase>test</phase>
                <goals>
                  <goal>test</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
  <developers>
    <developer>
      <id>pkarwasz</id>
      <name>Piotr P. Karwasz</name>
      <email>pkarwasz-pom@apache.org</email>
    </developer>
    <developer>
      <id>ggregory</id>
      <name>Gary Gregory</name>
      <email>ggregory at apache.org</email>
      <url>https://www.garygregory.com</url>
      <organization>The Apache Software Foundation</organization>
      <organizationUrl>https://www.apache.org/</organizationUrl>
      <roles>
        <role>PMC Member</role>
      </roles>
      <timezone>America/New_York</timezone>
      <properties>
        <picUrl>https://people.apache.org/~ggregory/img/garydgregory80.png</picUrl>
      </properties>
    </developer>
  </developers>
</project>