pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ This file is part of Dependency-Track.
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~   http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  ~
  ~ SPDX-License-Identifier: Apache-2.0
  ~ Copyright (c) Steve Springett. All Rights Reserved.
  -->
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <parent>
        <groupId>us.springett</groupId>
        <artifactId>alpine-parent</artifactId>
        <version>2.2.5-SNAPSHOT</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
    <groupId>org.dependencytrack</groupId>
    <artifactId>dependency-track</artifactId>
    <packaging>war</packaging>
    <version>4.11.0-SNAPSHOT</version>

    <name>Dependency-Track</name>
    <url>https://dependencytrack.org/</url>
    <description>Dependency-Track is an intelligent component analysis platform that allows organizations to identify and reduce risk in the software supply chain.</description>
    <inceptionYear>2013</inceptionYear>
    <organization>
        <name>OWASP</name>
    </organization>

    <licenses>
        <license>
            <name>Apache-2.0</name>
            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <developers>
        <developer>
            <name>Steve Springett</name>
            <email>Steve.Springett@owasp.org</email>
            <organization>OWASP</organization>
            <organizationUrl>http://www.owasp.org/</organizationUrl>
            <roles>
                <role>Architect</role>
                <role>Developer</role>
            </roles>
        </developer>
    </developers>

    <scm>
        <connection>scm:git:git@github.com:DependencyTrack/dependency-track.git</connection>
        <url>https://github.com/DependencyTrack/dependency-track.git</url>
        <developerConnection>scm:git:git@github.com:DependencyTrack/dependency-track.git</developerConnection>
        <tag>HEAD</tag>
    </scm>

    <issueManagement>
        <system>github</system>
        <url>https://github.com/DependencyTrack/dependency-track/issues</url>
    </issueManagement>

    <ciManagement>
        <system>github-actions</system>
        <url>https://github.com/DependencyTrack/dependency-track/actions</url>
    </ciManagement>

    <properties>
        <!-- Dependency Versions -->
        <frontend.version>4.10.0</frontend.version>
        <lib.alpine.version>${project.parent.version}</lib.alpine.version>
        <lib.awaitility.version>4.2.0</lib.awaitility.version>
        <lib.cloud-sql-connector-jdbc-sqlserver.version>1.15.2</lib.cloud-sql-connector-jdbc-sqlserver.version>
        <lib.cloud-sql-mysql-socket-factory-connector-j-8.version>1.15.0</lib.cloud-sql-mysql-socket-factory-connector-j-8.version>
        <lib.cloud-sql-postgres-socket-factory.version>1.15.0</lib.cloud-sql-postgres-socket-factory.version>
        <lib.cpe-parser.version>2.1.0</lib.cpe-parser.version>
        <lib.cvss-calculator.version>1.4.2</lib.cvss-calculator.version>
        <lib.owasp-rr-calculator.version>1.0.1</lib.owasp-rr-calculator.version>
        <lib.cyclonedx-java.version>8.0.3</lib.cyclonedx-java.version>
        <lib.greenmail.version>1.6.14</lib.greenmail.version>
        <lib.jaxb.runtime.version>2.3.8</lib.jaxb.runtime.version>
        <lib.json-unit.version>3.2.2</lib.json-unit.version>
        <!--
          Overriding logstash-logback-encoder version as a temporary workaround until
          https://github.com/stevespringett/Alpine/pull/517 is merged and released.
        -->
        <lib.logstash-logback-encoder.version>7.3</lib.logstash-logback-encoder.version>
        <lib.lucene.version>8.11.2</lib.lucene.version>
        <lib.open-vulnerability-clients.version>5.1.1</lib.open-vulnerability-clients.version>
        <lib.packageurl.version>1.4.1</lib.packageurl.version>
        <lib.pebble.version>3.2.0</lib.pebble.version>
        <lib.resilience4j.version>2.1.0</lib.resilience4j.version>
        <lib.woodstox.version>6.5.1</lib.woodstox.version>
        <lib.junit-params.version>1.1.1</lib.junit-params.version>
        <lib.signpost-core.version>2.1.1</lib.signpost-core.version>
        <lib.httpclient.version>4.5.14</lib.httpclient.version>
        <lib.httpclient5.version>5.3.1</lib.httpclient5.version>
        <lib.log4j-over-slf4j.version>2.0.11</lib.log4j-over-slf4j.version>
        <lib.org-kohsuke-github-api.version>1.318</lib.org-kohsuke-github-api.version>
        <!-- JDBC Drivers -->
        <lib.jdbc-driver.mssql.version>12.6.0.jre11</lib.jdbc-driver.mssql.version>
        <!-- Upgrading to 8.0.33 as https://github.com/datanucleus/datanucleus-rdbms/issues/446 is resolved! -->
        <lib.jdbc-driver.mysql.version>8.0.33</lib.jdbc-driver.mysql.version>
        <lib.jdbc-driver.postgresql.version>42.6.0</lib.jdbc-driver.postgresql.version>
        <!-- Maven Plugin Properties -->
        <plugin.cyclonedx.projectType>application</plugin.cyclonedx.projectType>
        <plugin.cyclonedx.outputFormat>json</plugin.cyclonedx.outputFormat>
        <plugin.retirejs.breakOnFailure>false</plugin.retirejs.breakOnFailure>
        <!-- Keep Jetty at 10.0.15 until migration plan is planned/resolved per Steve in https://github.com/DependencyTrack/dependency-track/pull/2725#issuecomment-1532417022! -->
        <plugin.jetty.version>10.0.20</plugin.jetty.version>
        <!-- SonarCloud properties -->
        <sonar.exclusions>src/main/webapp/**</sonar.exclusions>
        <!-- CycloneDX CLI -->
        <cyclonedx-cli.path>cyclonedx</cyclonedx-cli.path>
        <services.bom.merge.skip>true</services.bom.merge.skip>
    </properties>

    <repositories>
        <repository>
            <id>ossrh-snapshot</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
            <snapshots>
                <updatePolicy>always</updatePolicy>
                <enabled>true</enabled>
            </snapshots>
        </repository>
    </repositories>

    <dependencies>
        <!-- Alpine -->
        <dependency>
            <groupId>us.springett</groupId>
            <artifactId>alpine-common</artifactId>
            <version>${lib.alpine.version}</version>
        </dependency>
        <dependency>
            <groupId>us.springett</groupId>
            <artifactId>alpine-model</artifactId>
            <version>${lib.alpine.version}</version>
        </dependency>
        <dependency>
            <groupId>us.springett</groupId>
            <artifactId>alpine-infra</artifactId>
            <version>${lib.alpine.version}</version>
        </dependency>
        <dependency>
            <groupId>us.springett</groupId>
            <artifactId>alpine-server</artifactId>
            <version>${lib.alpine.version}</version>
        </dependency>
        <!-- CVSS Calculator -->
        <dependency>
            <groupId>us.springett</groupId>
            <artifactId>cvss-calculator</artifactId>
            <version>${lib.cvss-calculator.version}</version>
        </dependency>
        <!-- OWASP Risk Rating calculator -->
        <dependency>
            <groupId>us.springett</groupId>
            <artifactId>owasp-risk-rating-calculator</artifactId>
            <version>${lib.owasp-rr-calculator.version}</version>
        </dependency>
        <!-- CPE Parser -->
        <dependency>
            <groupId>us.springett</groupId>
            <artifactId>cpe-parser</artifactId>
            <version>${lib.cpe-parser.version}</version>
        </dependency>
        <!-- CycloneDX -->
        <dependency>
            <groupId>org.cyclonedx</groupId>
            <artifactId>cyclonedx-core-java</artifactId>
            <version>${lib.cyclonedx-java.version}</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jaxb</groupId>
            <artifactId>jaxb-runtime</artifactId>
            <version>${lib.jaxb.runtime.version}</version>
        </dependency>
        <dependency>
            <groupId>javax.activation</groupId>
            <artifactId>javax.activation-api</artifactId>
            <version>1.2.0</version>
        </dependency>
        <!-- org.json
        This was previously transitively included with Unirest. However, Unirest v3.x removed reliance on org.json
        in favor of their own API compatible replacement. Therefore, it was necessary to directly include org.json.
        Removal of org.json is documented in https://github.com/DependencyTrack/dependency-track/issues/1113 -->
        <dependency>
            <groupId>org.json</groupId>
            <artifactId>json</artifactId>
            <version>20231013</version>
        </dependency>
        <!-- Package URL -->
        <dependency>
            <groupId>com.github.package-url</groupId>
            <artifactId>packageurl-java</artifactId>
            <version>${lib.packageurl.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.lucene</groupId>
            <artifactId>lucene-core</artifactId>
            <version>${lib.lucene.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.lucene</groupId>
            <artifactId>lucene-analyzers-common</artifactId>
            <version>${lib.lucene.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.lucene</groupId>
            <artifactId>lucene-queryparser</artifactId>
            <version>${lib.lucene.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.lucene</groupId>
            <artifactId>lucene-queries</artifactId>
            <version>${lib.lucene.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.lucene</groupId>
            <artifactId>lucene-sandbox</artifactId>
            <version>${lib.lucene.version}</version>
        </dependency>

        <dependency>
            <groupId>io.github.jeremylong</groupId>
            <artifactId>open-vulnerability-clients</artifactId>
            <version>${lib.open-vulnerability-clients.version}</version>
        </dependency>

        <!-- Pebble templating engine -->
        <dependency>
            <groupId>io.pebbletemplates</groupId>
            <artifactId>pebble</artifactId>
            <version>${lib.pebble.version}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
            <artifactId>httpclient</artifactId>
            <version>${lib.httpclient.version}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.httpcomponents.client5</groupId>
            <artifactId>httpclient5</artifactId>
            <version>${lib.httpclient5.version}</version>
        </dependency>

        <dependency>
            <groupId>oauth.signpost</groupId>
            <artifactId>signpost-core</artifactId>
            <version>${lib.signpost-core.version}</version>
            <scope>compile</scope>
        </dependency>

        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
            <artifactId>httpmime</artifactId>
            <version>${lib.httpclient.version}</version>
        </dependency>


        <dependency>
            <groupId>com.fasterxml.woodstox</groupId>
            <artifactId>woodstox-core</artifactId>
            <version>${lib.woodstox.version}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-artifact</artifactId>
            <version>3.9.6</version>
        </dependency>
        <!-- Bundle JDBC drivers -->
        <dependency>
            <groupId>com.microsoft.sqlserver</groupId>
            <artifactId>mssql-jdbc</artifactId>
            <version>${lib.jdbc-driver.mssql.version}</version>
        </dependency>
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <version>${lib.jdbc-driver.mysql.version}</version>
            <exclusions>
                <!--
                    Protobuf is only required for MySQL X DevAPI, which we do not use.
                    https://dev.mysql.com/doc/connector-j/8.0/en/connector-j-installing-maven.html
                -->
                <exclusion>
                    <groupId>com.google.protobuf</groupId>
                    <artifactId>protobuf-java</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.postgresql</groupId>
            <artifactId>postgresql</artifactId>
            <version>${lib.jdbc-driver.postgresql.version}</version>
        </dependency>
        <dependency>
            <groupId>com.google.cloud.sql</groupId>
            <artifactId>mysql-socket-factory-connector-j-8</artifactId>
            <version>${lib.cloud-sql-mysql-socket-factory-connector-j-8.version}</version>
        </dependency>
        <dependency>
            <groupId>com.google.cloud.sql</groupId>
            <artifactId>postgres-socket-factory</artifactId>
            <version>${lib.cloud-sql-postgres-socket-factory.version}</version>
        </dependency>
        <dependency>
            <groupId>com.google.cloud.sql</groupId>
            <artifactId>cloud-sql-connector-jdbc-sqlserver</artifactId>
            <version>${lib.cloud-sql-connector-jdbc-sqlserver.version}</version>
        </dependency>
        <!-- Xerces -->
        <dependency>
            <groupId>xerces</groupId>
            <artifactId>xercesImpl</artifactId>
            <version>2.12.2</version>
            <exclusions>
                <exclusion>
                    <groupId>xml-apis</groupId>
                    <artifactId>xml-apis</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <!-- Commons Compress -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-compress</artifactId>
            <version>1.25.0</version>
        </dependency>
        <!-- Resilience4J -->
        <dependency>
            <groupId>io.github.resilience4j</groupId>
            <artifactId>resilience4j-retry</artifactId>
            <version>${lib.resilience4j.version}</version>
        </dependency>
        <dependency>
            <groupId>io.github.resilience4j</groupId>
            <artifactId>resilience4j-ratelimiter</artifactId>
            <version>${lib.resilience4j.version}</version>
        </dependency>
        <dependency>
            <groupId>io.github.resilience4j</groupId>
            <artifactId>resilience4j-micrometer</artifactId>
            <version>${lib.resilience4j.version}</version>
        </dependency>

        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>log4j-over-slf4j</artifactId>
            <version>${lib.log4j-over-slf4j.version}</version>
        </dependency>

        <dependency>
            <groupId>org.kohsuke</groupId>
            <artifactId>github-api</artifactId>
            <version>${lib.org-kohsuke-github-api.version}</version>
        </dependency>

        <!-- Test Dependencies -->
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>${lib.junit.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>pl.pragmatists</groupId>
            <artifactId>JUnitParams</artifactId>
            <version>${lib.junit-params.version}</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jersey.test-framework.providers</groupId>
            <artifactId>jersey-test-framework-provider-grizzly2</artifactId>
            <version>${lib.jersey.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jersey.connectors</groupId>
            <artifactId>jersey-grizzly-connector</artifactId>
            <version>${lib.jersey.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>${lib.mockito.version}</version>
            <scope>test</scope>

        </dependency>
        <dependency>
            <groupId>com.github.tomakehurst</groupId>
            <artifactId>wiremock-jre8</artifactId>
            <version>2.35.1</version>
            <scope>test</scope>
        </dependency>


        <dependency>
            <groupId>com.github.stefanbirkner</groupId>
            <artifactId>system-rules</artifactId>
            <version>1.19.0</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.assertj</groupId>
            <artifactId>assertj-core</artifactId>
            <version>${lib.assertj.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>net.javacrumbs.json-unit</groupId>
            <artifactId>json-unit-assertj</artifactId>
            <version>${lib.json-unit.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mock-server</groupId>
            <artifactId>mockserver-netty</artifactId>
            <version>5.15.0</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.awaitility</groupId>
            <artifactId>awaitility</artifactId>
            <version>${lib.awaitility.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>com.icegreen</groupId>
            <artifactId>greenmail-junit4</artifactId>
            <version>${lib.greenmail.version}</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <finalName>${project.artifactId}</finalName>
        <resources>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>false</filtering>
            </resource>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>true</filtering>
                <includes>
                    <include>application.version</include>
                </includes>
            </resource>
        </resources>
        <testResources>
            <testResource>
                <directory>src/test/resources</directory>
                <filtering>false</filtering>
            </testResource>
        </testResources>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>3.3.1</version>
                <configuration>
                    <configLocation>${project.basedir}/.checkstyle.xml</configLocation>
                    <includeResources>false</includeResources>
                    <includeTestResources>false</includeTestResources>
                </configuration>
                <executions>
                    <execution>
                        <phase>validate</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
                <dependencies>
                    <dependency>
                        <groupId>com.puppycrawl.tools</groupId>
                        <artifactId>checkstyle</artifactId>
                        <version>10.12.5</version>
                    </dependency>
                </dependencies>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <dependencies>
                    <dependency>
                        <groupId>org.apache.maven.surefire</groupId>
                        <artifactId>surefire-junit4</artifactId>
                        <version>${maven.surefire.plugin.version}</version>
                    </dependency>
                </dependencies>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>exec-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <id>merge-services-bom</id>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>exec</goal>
                        </goals>
                        <configuration>
                            <executable>${cyclonedx-cli.path}</executable>
                            <arguments>
                                <argument>merge</argument>
                                <argument>--input-files</argument>
                                <argument>${project.build.directory}/bom.json</argument>
                                <argument>${project.basedir}/src/main/resources/services.bom.json</argument>
                                <argument>--output-file</argument>
                                <argument>${project.build.directory}/bom.json</argument>
                            </arguments>
                            <skip>${services.bom.merge.skip}</skip>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <artifactId>maven-antrun-plugin</artifactId>
                <version>3.1.0</version>
                <executions>
                    <execution>
                        <id>deploy-bom</id>
                        <phase>prepare-package</phase>
                        <configuration>
                            <target>
                                <copy file="${project.build.directory}/bom.json"
                                      tofile="${project.build.directory}/${project.artifactId}/.well-known/sbom"/>
                            </target>
                        </configuration>
                        <goals>
                            <goal>run</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.eclipse.jetty</groupId>
                <artifactId>jetty-maven-plugin</artifactId>
                <version>${plugin.jetty.version}</version>
                <configuration>
                    <webApp>
                        <contextPath>/</contextPath>
                    </webApp>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <profile>
            <id>clean-exclude-wars</id>
            <build>
                <pluginManagement>
                    <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-clean-plugin</artifactId>
                        <version>3.3.2</version>
                        <configuration>
                            <excludeDefaultDirectories>true</excludeDefaultDirectories>
                            <filesets>
                                <fileset>
                                    <directory>target</directory>
                                    <followSymlinks>false</followSymlinks>
                                    <useDefaultExcludes>false</useDefaultExcludes>
                                    <includes>
                                        <include>*/</include>
                                    </includes>
                                    <excludes>
                                        <exclude>dependency-track*.jar</exclude>
                                    </excludes>
                                </fileset>
                            </filesets>
                        </configuration>
                    </plugin>
                    </plugins>
                </pluginManagement>
            </build>
        </profile>
        <profile>
            <id>embedded-jetty</id>
            <activation>
                <property>
                    <name>env.ACTIVATE_EMBEDDED_JETTY</name>
                    <value>true</value>
                </property>
            </activation>
            <properties>
                <war-embedded-finalname>${project.build.finalName}-apiserver</war-embedded-finalname>
            </properties>
        </profile>
        <profile>
            <id>h2-console</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.eclipse.jetty</groupId>
                        <artifactId>jetty-maven-plugin</artifactId>
                        <version>${plugin.jetty.version}</version>
                        <configuration>
                            <webApp>
                                <contextPath>/</contextPath>
                            </webApp>
                            <contextXml>src/test/webapp/WEB-INF/h2-console-activation.xml</contextXml>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>bundle-ui</id>
            <activation>
                <property>
                    <name>env.ACTIVATE_BUNDLE_UI</name>
                    <value>true</value>
                </property>
            </activation>
            <properties>
                <war-embedded-finalname>${project.build.finalName}-bundled</war-embedded-finalname>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <artifactId>maven-antrun-plugin</artifactId>
                        <version>3.1.0</version>
                        <executions>
                            <execution>
                                <id>frontend-download</id>
                                <phase>prepare-package</phase>
                                <configuration>
                                    <target>
                                        <get src="https://github.com/DependencyTrack/frontend/releases/download/${frontend.version}/frontend-dist.zip" dest="${project.build.directory}" verbose="true"/>
                                    </target>
                                </configuration>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                            </execution>
                            <execution>
                                <id>frontend-extract</id>
                                <phase>prepare-package</phase>
                                <configuration>
                                    <target>
                                        <unzip src="${project.build.directory}/frontend-dist.zip" dest="${project.build.directory}/frontend">
                                        </unzip>
                                    </target>
                                </configuration>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                            </execution>
                            <execution>
                                <id>frontend-resource-deploy</id>
                                <phase>prepare-package</phase>
                                <configuration>
                                    <target>
                                        <copy todir="${project.build.directory}/${project.artifactId}">
                                            <fileset dir="${project.build.directory}/frontend/dist">
                                                <include name="**/*"/>
                                            </fileset>
                                        </copy>
                                    </target>
                                </configuration>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>

</project>