Description

<dependency>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>12.2.1</version>
</dependency>

<!--
This file is part of dependency-check-maven.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Copyright (c) 2013 Jeremy Long. All Rights Reserved.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.owasp</groupId>
        <artifactId>dependency-check-parent</artifactId>
        <version>12.2.1</version>
    </parent>
    <artifactId>dependency-check-maven</artifactId>
    <packaging>maven-plugin</packaging>
    <name>Dependency-Check Maven Plugin</name>
    <description>dependency-check-maven is a Maven Plugin that uses dependency-check-core to detect publicly disclosed vulnerabilities associated with the project's dependencies. The plugin will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries.</description>
    <inceptionYear>2013</inceptionYear>
    <properties>
        <maven.api.version>3.6.3</maven.api.version>

        <version.maven-plugin-plugin>3.15.2</version.maven-plugin-plugin>
        <toolchain.jdk.test.home>${java.home}</toolchain.jdk.test.home>
    </properties>
    <scm>
        <connection>scm:git:https://github.com/dependency-check/DependencyCheck.git</connection>
        <url>https://github.com/dependency-check/DependencyCheck/tree/master/maven</url>
        <developerConnection>scm:git:git@github.com/dependency-check/DependencyCheck.git</developerConnection>
        <tag>v12.2.1</tag>
    </scm>
    <prerequisites>
        <maven>${maven.api.version}</maven>
    </prerequisites>
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.apache.maven</groupId>
                <artifactId>maven-core</artifactId>
                <version>${maven.api.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven</groupId>
                <artifactId>maven-plugin-api</artifactId>
                <version>${maven.api.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven</groupId>
                <artifactId>maven-settings</artifactId>
                <version>${maven.api.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven</groupId>
                <artifactId>maven-model</artifactId>
                <version>${maven.api.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven</groupId>
                <artifactId>maven-artifact</artifactId>
                <version>${maven.api.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven</groupId>
                <artifactId>maven-settings-builder</artifactId>
                <version>${maven.api.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven.plugin-tools</groupId>
                <artifactId>maven-plugin-annotations</artifactId>
                <version>3.15.2</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven.reporting</groupId>
                <artifactId>maven-reporting-api</artifactId>
                <version>4.0.0</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven.doxia</groupId>
                <artifactId>doxia-sink-api</artifactId>
                <version>2.1.0</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven.shared</groupId>
                <artifactId>maven-dependency-tree</artifactId>
                <version>3.3.0</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven.shared</groupId>
                <artifactId>maven-artifact-transfer</artifactId>
                <version>0.13.1</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven.shared</groupId>
                <artifactId>maven-common-artifact-filters</artifactId>
                <version>3.4.0</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven.shared</groupId>
                <artifactId>file-management</artifactId>
                <version>3.2.0</version>
            </dependency>
            <dependency>
                <groupId>org.codehaus.plexus</groupId>
                <artifactId>plexus-utils</artifactId>
                <version>4.0.3</version>
            </dependency>
            <dependency>
                <!--
                    https://github.com/codehaus-plexus/plexus-utils/blob/master/README.md
                    for Maven 3 compatibility plexus-xml should be at version 3.x
                    -->
                <groupId>org.codehaus.plexus</groupId>
                <artifactId>plexus-xml</artifactId>
                <version>3.0.1</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven.plugin-testing</groupId>
                <artifactId>maven-plugin-testing-harness</artifactId>
                <version>3.5.1</version>
                <scope>test</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <build>
        <resources>
            <resource>
                <directory>src/main/resources</directory>
                <includes>
                    <include>**/*.properties</include>
                </includes>
                <filtering>true</filtering>
            </resource>
            <resource>
                <directory>${basedir}</directory>
                <targetPath>META-INF</targetPath>
                <includes>
                    <include>LICENSE.txt</include>
                    <include>NOTICE.txt</include>
                </includes>
            </resource>
        </resources>

        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-plugin-plugin</artifactId>
                <version>${version.maven-plugin-plugin}</version>
                <configuration>
                    <goalPrefix>dependency-check</goalPrefix>
                </configuration>
                <executions>
                    <execution>
                        <id>mojo-descriptor</id>
                        <goals>
                            <goal>descriptor</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>generated-helpmojo</id>
                        <goals>
                            <goal>helpmojo</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>
    <dependencies>
        <dependency>
            <groupId>org.owasp</groupId>
            <artifactId>dependency-check-core</artifactId>
            <version>${project.parent.version}</version>
        </dependency>
        <dependency>
            <groupId>org.owasp</groupId>
            <artifactId>dependency-check-utils</artifactId>
            <version>${project.parent.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-plugin-api</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-settings</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-core</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.plugin-tools</groupId>
            <artifactId>maven-plugin-annotations</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-model</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-artifact</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-settings-builder</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.reporting</groupId>
            <artifactId>maven-reporting-api</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.doxia</groupId>
            <artifactId>doxia-sink-api</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.shared</groupId>
            <artifactId>file-management</artifactId>
        </dependency>
        <dependency>
            <groupId>org.codehaus.plexus</groupId>
            <artifactId>plexus-utils</artifactId>
        </dependency>
        <dependency>
            <groupId>org.codehaus.plexus</groupId>
            <artifactId>plexus-xml</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.shared</groupId>
            <artifactId>maven-dependency-tree</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.shared</groupId>
            <artifactId>maven-artifact-transfer</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.shared</groupId>
            <artifactId>maven-common-artifact-filters</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
        </dependency>
        <dependency>
            <groupId>io.github.jeremylong</groupId>
            <artifactId>open-vulnerability-clients</artifactId>
        </dependency>
        <dependency>
            <groupId>com.github.package-url</groupId>
            <artifactId>packageurl-java</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.plugin-testing</groupId>
            <artifactId>maven-plugin-testing-harness</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>
    <reporting>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-plugin-report-plugin</artifactId>
                <version>${version.maven-plugin-plugin}</version>
            </plugin>
        </plugins>
    </reporting>
    <profiles>
        <profile>
            <id>FullIntegrationTesting</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-surefire-plugin</artifactId>
                        <configuration>
                            <!-- Override any setting from the command line for other projects when running the integration tests to
                            ensure we also run unit tests for maven project only -->
                            <skipTests>false</skipTests>
                        </configuration>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-invoker-plugin</artifactId>
                        <configuration>
                            <!--streamLogs>true</streamLogs-->
                            <parallelThreads>4</parallelThreads>
                            <cloneProjectsTo>${project.build.directory}/it</cloneProjectsTo>
                            <localRepositoryPath>target/local-repo</localRepositoryPath>
                            <properties>
                                <odc.version>${project.version}</odc.version>
                            </properties>
                            <!-- Doesn't seem a way to make this plugin toolchain aware, so have to use a property
                                 or env var to get the JAVA_HOME from to match what surefire/failsafe are using -->
                            <javaHome>${toolchain.jdk.test.home}</javaHome>
                        </configuration>
                        <executions>
                            <execution>
                                <id>integration-test</id>
                                <goals>
                                    <goal>install</goal>
                                    <goal>run</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>