Description

<dependency>
    <groupId>org.eclipse.pass</groupId>
    <artifactId>pass-nihms-loader</artifactId>
    <version>2.5.1</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <parent>
        <artifactId>pass-support</artifactId>
        <groupId>org.eclipse.pass</groupId>
        <version>2.5.1</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>

    <artifactId>pass-nihms-loader</artifactId>
    <packaging>pom</packaging>

    <name>PASS support-nihms-loader</name>
    <description>PASS NIHMS Loader</description>

    <modules>
        <module>nihms-data-harvest</module>
        <module>nihms-data-transform-load</module>
        <module>nihms-docker</module>
        <module>nihms-token-refresh</module>
        <module>nihms-etl-model</module>
    </modules>

    <properties>
        <!-- Properties for dependency versions -->
        <spring-boot-maven-plugin.version>3.5.11</spring-boot-maven-plugin.version>
        <awsspring.version>3.4.2</awsspring.version>
        <org-json.version>20251224</org-json.version>
        <commons.csv.version>1.14.1</commons.csv.version>
        <args4j.version>2.37</args4j.version>
        <handy-uri-templates.version>2.1.8</handy-uri-templates.version>
        <commons-io.version>2.21.0</commons-io.version>
        <commons-collections4.version>4.5.0</commons-collections4.version>
        <joda-time.version>2.14.1</joda-time.version>
        <commons-lang3.version>3.20.0</commons-lang3.version>
    </properties>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.eclipse.pass</groupId>
                <artifactId>pass-data-client</artifactId>
                <version>${project.version}</version>
            </dependency>

            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-csv</artifactId>
                <version>${commons.csv.version}</version>
            </dependency>

            <dependency>
                <groupId>commons-io</groupId>
                <artifactId>commons-io</artifactId>
                <version>${commons-io.version}</version>
            </dependency>

            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>${spring-boot-maven-plugin.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <dependency>
                <groupId>io.awspring.cloud</groupId>
                <artifactId>spring-cloud-aws-dependencies</artifactId>
                <version>${awsspring.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <dependency>
                <groupId>joda-time</groupId>
                <artifactId>joda-time</artifactId>
                <version>${joda-time.version}</version>
            </dependency>

            <!-- The following deps were declared to resolve CVEs from transitive deps. -->
            <!-- These should all be checked whenever deps are upgraded. Should be removed if possible once parent -->
            <!-- dep updates with fixed version. -->
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-lang3</artifactId>
                <version>${commons-lang3.version}</version>
            </dependency>
            <!-- End of transitive deps with CVE issues. -->

        </dependencies>
    </dependencyManagement>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>build-helper-maven-plugin</artifactId>
                </plugin>

                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                    <version>${spring-boot-maven-plugin.version}</version>
                </plugin>

                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-failsafe-plugin</artifactId>
                    <executions>
                        <execution>
                            <goals>
                                <goal>integration-test</goal>
                                <goal>verify</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <executions>
                    <execution>
                        <id>enforce-dependency-convergence</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <dependencyConvergence/>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-dependency-plugin</artifactId>
                <executions>
                    <execution>
                        <id>analyze-dependencies</id>
                        <goals>
                            <goal>analyze-only</goal>
                        </goals>
                        <phase>test-compile</phase>
                        <configuration>
                            <failOnWarning>true</failOnWarning>
                            <ignoredDependencies>
                                <!-- These come from bundled jars -->
                                <ignoredDependency>org.springframework*::</ignoredDependency>
                                <ignoredDependency>io.awspring.cloud::</ignoredDependency>
                            </ignoredDependencies>
                            <ignoredUsedUndeclaredDependencies>
                                <!-- These both come from junit-jupiter, so version is tied to that direct dependency -->
                                <ignoredUsedUndeclaredDependency>org.junit.jupiter:junit-jupiter-api:</ignoredUsedUndeclaredDependency>
                                <!-- These come from testcontainers junit-jupiter -->
                                <ignoredUsedUndeclaredDependency>org.testcontainers::</ignoredUsedUndeclaredDependency>
                            </ignoredUsedUndeclaredDependencies>
                            <ignoredUnusedDeclaredDependencies>
                                <!-- junit-jupiter is a module containing the junit api jars used directly -->
                                <ignoredUnusedDeclaredDependency>org.junit.jupiter:junit-jupiter</ignoredUnusedDeclaredDependency>
                                <!-- slf4j is the API used in the code, logback is the logging provider not used directly -->
                                <ignoredUnusedDeclaredDependency>ch.qos.logback:logback-classic:</ignoredUnusedDeclaredDependency>
                                <!-- slf4j is the API used in the code, jcl is used by a transitive dep -->
                                <ignoredUnusedDeclaredDependency>org.slf4j:jcl-over-slf4j:</ignoredUnusedDeclaredDependency>
                                <!-- Used by ITs via classpath -->
                                <ignoredUnusedDeclaredDependency>org.eclipse.pass:pass-core-test-config::</ignoredUnusedDeclaredDependency>
                            </ignoredUnusedDeclaredDependencies>
                            <ignoredNonTestScopedDependencies>
                                <!-- junit-jupiter is a module containing the junit api jars used directly -->
                                <ignoredNonTestScopedDependency>org.junit.jupiter:junit-jupiter-api:</ignoredNonTestScopedDependency>
                                <!-- Needed for when data-transform jar is created -->
                                <ignoredNonTestScopedDependency>org.json:json:</ignoredNonTestScopedDependency>
                                <ignoredNonTestScopedDependency>commons-io:commons-io:</ignoredNonTestScopedDependency>
                            </ignoredNonTestScopedDependencies>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-help-plugin</artifactId>
                <version>3.5.1</version>
            </plugin>
        </plugins>
    </build>
</project>