pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>io.bastillion</groupId>
    <artifactId>bastillion</artifactId>
    <version>5.1.1-SNAPSHOT</version>
    <packaging>jar</packaging>
    <name>Bastillion</name>

    <licenses>
        <license>
            <name>The Prosperity Public License 3.0.0</name>
            <url>https://prosperitylicense.com/versions/3.0.0.html</url>
        </license>
    </licenses>

    <developers>
        <developer>
            <name>Sean Kavanagh</name>
            <email>sean.p.kavanagh6@gmail.com</email>
            <organization>Loophole, LLC</organization>
            <organizationUrl>https://www.bastillion.io</organizationUrl>
        </developer>
    </developers>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.source>21</maven.compiler.source>
        <maven.compiler.target>21</maven.compiler.target>
        <!-- Default for exec:java; override with -Dexec.mainClass=... -->
        <exec.mainClass>io.bastillion.Main</exec.mainClass>
    </properties>

    <repositories>
        <repository>
            <id>apache.snapshots</id>
            <name>Apache Snapshots</name>
            <url>https://repository.apache.org/content/repositories/snapshots/</url>
            <releases><enabled>false</enabled></releases>
            <snapshots><enabled>true</enabled></snapshots>
        </repository>
    </repositories>

    <!-- Pins transitive dependencies pulled in with known CVEs where the parent (here,
         jetty-jaas -> api-ldap-model) hasn't bumped its own declared version yet. -->
    <dependencyManagement>
        <dependencies>
            <!-- mina-core 2.2.3 (via jetty-jaas's LDAP JAAS module) has several CVEs around
                 deserialization of untrusted data in its object serialization codec, patched
                 (and re-patched after incomplete fixes) across 2.2.4-2.2.9. -->
            <dependency>
                <groupId>org.apache.mina</groupId>
                <artifactId>mina-core</artifactId>
                <version>2.2.9</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <!-- MVC framework (formerly the io.bastillion:lmvc artifact; merged directly into
             src/main/java/loophole/mvc so the whole app builds from this one pom) -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.20.0</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>2.0.18</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-slf4j2-impl</artifactId>
            <version>2.26.1</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>2.26.1</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.26.1</version>
        </dependency>
        <dependency>
            <groupId>org.thymeleaf</groupId>
            <artifactId>thymeleaf</artifactId>
            <version>3.1.5.RELEASE</version>
        </dependency>

        <!-- MVC framework tests -->
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>6.1.2</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>5.23.0</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-junit-jupiter</artifactId>
            <version>5.23.0</version>
            <scope>test</scope>
        </dependency>

        <!-- Database -->
        <dependency>
            <groupId>com.h2database</groupId>
            <artifactId>h2</artifactId>
            <version>2.4.240</version>
        </dependency>

        <!-- SSH -->
        <dependency>
            <groupId>com.github.mwiede</groupId>
            <artifactId>jsch</artifactId>
            <version>2.28.5</version>
        </dependency>
        <!-- jsch needs BouncyCastle at runtime for Ed25519/Ed448 key generation
             (com.jcraft.jsch.bc.KeyPairGenEdDSA); not a transitive dependency of jsch
             itself, so it has to be declared explicitly. -->
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk18on</artifactId>
            <version>1.85</version>
        </dependency>

        <!-- JSON -->
        <dependency>
            <groupId>com.google.code.gson</groupId>
            <artifactId>gson</artifactId>
            <version>2.14.0</version>
        </dependency>

        <!-- Commons -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-fileupload2-jakarta</artifactId>
            <version>2.0.0-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>commons-codec</groupId>
            <artifactId>commons-codec</artifactId>
            <version>1.22.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-dbcp2</artifactId>
            <version>2.14.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-configuration2</artifactId>
            <version>2.15.1</version>
        </dependency>
        <dependency>
            <groupId>commons-beanutils</groupId>
            <artifactId>commons-beanutils</artifactId>
            <version>1.11.0</version>
        </dependency>

        <!-- QR / 2FA -->
        <dependency>
            <groupId>com.google.zxing</groupId>
            <artifactId>core</artifactId>
            <version>3.5.4</version>
        </dependency>

        <!-- Jetty 11 (Jakarta EE 9), embedded - the app is its own server now (see
             io.bastillion.Main), not a WAR deployed into an external container, so these
             are compile-scope (bundled into the runnable jar) rather than provided. -->
        <dependency>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>jetty-server</artifactId>
            <version>11.0.26</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>jetty-webapp</artifactId>
            <version>11.0.26</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>jetty-jaas</artifactId>
            <version>11.0.26</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.jetty.websocket</groupId>
            <artifactId>websocket-jakarta-server</artifactId>
            <version>11.0.26</version>
        </dependency>

        <!-- Jakarta Servlet API -->
        <dependency>
            <groupId>org.eclipse.jetty.toolchain</groupId>
            <artifactId>jetty-jakarta-servlet-api</artifactId>
            <version>5.0.2</version>
        </dependency>
    </dependencies>

    <build>
        <resources>
            <resource>
                <directory>src/main/resources</directory>
                <includes>
                    <include>VERSION.txt</include>
                </includes>
                <filtering>true</filtering>
            </resource>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>false</filtering>
            </resource>
            <!-- Served by io.bastillion.Main's embedded Jetty (WebAppContext resource base
                 resolved from this classpath root), not a WAR - see that class for why. -->
            <resource>
                <directory>src/main/webapp</directory>
                <targetPath>webapp</targetPath>
            </resource>
        </resources>

        <plugins>
            <!-- Frontend -->
            <plugin>
                <groupId>com.github.eirslett</groupId>
                <artifactId>frontend-maven-plugin</artifactId>
                <version>2.0.2</version>
                <executions>
                    <execution>
                        <id>install-node-and-npm</id>
                        <phase>generate-resources</phase>
                        <goals>
                            <goal>install-node-and-npm</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>npm-install</id>
                        <phase>generate-resources</phase>
                        <goals>
                            <goal>npm</goal>
                        </goals>
                        <configuration>
                            <arguments>clean-install</arguments>
                        </configuration>
                    </execution>
                    <execution>
                        <id>grunt-build</id>
                        <phase>generate-resources</phase>
                        <goals>
                            <goal>grunt</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <nodeVersion>v16.13.1</nodeVersion>
                </configuration>
            </plugin>

            <!-- Compiler -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.15.0</version>
                <configuration>
                    <compilerArgs>
                        <arg>-Xlint:-options</arg>
                    </compilerArgs>
                </configuration>
            </plugin>

            <!-- Unit tests -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.5.6</version>
                <configuration>
                    <systemPropertyVariables>
                        <MVC_CONTROLLER_PKGS>loophole.mvc.testctrl</MVC_CONTROLLER_PKGS>
                        <!-- AppConfig.CONFIG_DIR is a static final field resolved at class-load
                             time; setting it here (rather than in a test's @BeforeAll) makes
                             it deterministic regardless of which test class first touches
                             AppConfig/EncryptionUtil/KeyStoreUtil in the shared surefire JVM. -->
                        <CONFIG_DIR>${project.build.directory}/test-config/</CONFIG_DIR>
                    </systemPropertyVariables>
                </configuration>
            </plugin>

            <!-- Bundles all dependencies + io.bastillion.Main into one runnable jar, which
                 is what `java -jar` (and Google Cloud Buildpacks) expect to run. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-shade-plugin</artifactId>
                <version>3.6.2</version>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>shade</goal>
                        </goals>
                        <configuration>
                            <transformers>
                                <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                                    <mainClass>io.bastillion.Main</mainClass>
                                </transformer>
                                <!-- Jetty's Configuration classes are discovered via
                                     META-INF/services; without this transformer, shading
                                     would let one dependency's services file clobber another's. -->
                                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
                            </transformers>
                            <filters>
                                <filter>
                                    <artifact>*:*</artifact>
                                    <excludes>
                                        <exclude>META-INF/*.SF</exclude>
                                        <exclude>META-INF/*.DSA</exclude>
                                        <exclude>META-INF/*.RSA</exclude>
                                    </excludes>
                                </filter>
                            </filters>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!-- mvn compile exec:java — runs io.bastillion.Main directly for local dev, the
                 same embedded-Jetty code path used in the packaged jar. -->
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>exec-maven-plugin</artifactId>
                <version>3.6.3</version>
                <configuration>
                    <mainClass>${exec.mainClass}</mainClass>
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>