<?xml version="1.0" encoding="UTF-8"?>
<!--
    Copyright © 2021-present Arcade Data Ltd (info@arcadedata.com)

    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at

        http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.

    SPDX-FileCopyrightText: 2021-present Arcade Data Ltd (info@arcadedata.com)
    SPDX-License-Identifier: Apache-2.0
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>com.arcadedb</groupId>
        <artifactId>arcadedb-parent</artifactId>
        <version>26.8.1</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

    <artifactId>arcadedb-gremlin</artifactId>
    <packaging>jar</packaging>
    <name>ArcadeDB Gremlin</name>

    <properties>
        <!-- gremlin.version is defined in the parent pom so arcadedb-gremlin-it can share it -->
        <translation.version>1.0.4</translation.version>
        <snakeyaml.version>2.6</snakeyaml.version>
        <netty.version>4.2.16.Final</netty.version>
        <commons-configuration2.version>2.15.1</commons-configuration2.version>
        <commons-beanutils.version>1.11.0</commons-beanutils.version>
        <commons-lang3.version>3.20.0</commons-lang3.version>
        <ivy.version>2.6.0</ivy.version>
        <!-- Both properties below are dictated by TinkerPop, not chosen by ArcadeDB.
             Do not raise either one without upgrading gremlin.version first; see #5535. -->

        <!-- Pinned to the 4.0.x line because gremlin-groovy is built against it
             (TinkerPop 3.8.1 itself declares groovy.version 4.0.25). Groovy 5 is a
             major break and cannot be adopted until TinkerPop moves.
             4.0.x patch and minor updates ARE wanted, and the value deliberately runs
             ahead of TinkerPop's own 4.0.25. Dependabot enforces exactly that split:
             .github/dependabot.yml ignores org.apache.groovy majors only. -->
        <groovy.version>4.0.33</groovy.version>

        <!-- Pinned to 4.9.1 because gremlin-language ships a Gremlin grammar parser
             generated by the ANTLR 4.9.1 tool, and ANTLR 4.10 changed the serialized
             ATN format: the BASE_SERIALIZED_UUID field present in 4.9.1's
             ATNDeserializer does not exist in 4.13.2, so a 4.13 runtime cannot
             deserialize a 4.9.1-generated parser. The antlr4-runtime dependency below
             is additionally marked optional=true for shading reasons (#5216 / #5217),
             which assumes this pinned version.

             This property is module-local and intentionally diverges from
             engine/pom.xml, which tracks the latest ANTLR (4.13.2) for the engine's
             own grammar. There is deliberately NO Dependabot ignore rule for ANTLR:
             ignore rules match dependency coordinates rather than modules, and 4.9.1
             sits below the engine's 4.13.2, so any blocking range would freeze the
             engine too. Gremlin ANTLR bump PRs are closed by hand instead. -->
        <antlr4.version>4.9.1</antlr4.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>com.arcadedb</groupId>
            <artifactId>arcadedb-server</artifactId>
            <version>${project.parent.version}</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>com.arcadedb</groupId>
            <artifactId>arcadedb-server</artifactId>
            <version>${project.parent.version}</version>
            <scope>test</scope>
            <type>test-jar</type>
        </dependency>
        <dependency>
            <groupId>com.arcadedb</groupId>
            <artifactId>arcadedb-integration</artifactId>
            <version>${project.parent.version}</version>
            <scope>compile</scope>
        </dependency>

        <!-- Explicit ANTLR runtime to ensure consistent version across legacy and native Cypher.
             optional=true: keeps antlr 4.9.1 on gremlin's own classpath and bundled+relocated in
             the shaded uber-jar (maven-shade includes optional deps), but does NOT export it to
             Maven-coordinate consumers. A both-modules consumer therefore resolves antlr to the
             engine's 4.13.2 only, and consumes the arcadedb-gremlin:shaded classifier at runtime
             (issue #5217). Must NOT be <scope>provided</scope>: shade drops provided deps, which
             would strip the relocated antlr from the shaded jar and regress #5216. -->
        <dependency>
            <groupId>org.antlr</groupId>
            <artifactId>antlr4-runtime</artifactId>
            <version>${antlr4.version}</version>
            <optional>true</optional>
        </dependency>

        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-all</artifactId>
            <version>${netty.version}</version>
        </dependency>
        <!-- explicit import to solve CVE-2025-48924-->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>${commons-lang3.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-configuration2</artifactId>
            <version>${commons-configuration2.version}</version>
        </dependency>
        <dependency>
            <groupId>commons-beanutils</groupId>
            <artifactId>commons-beanutils</artifactId>
            <version>${commons-beanutils.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.groovy</groupId>
            <artifactId>groovy</artifactId>
            <version>${groovy.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.tinkerpop</groupId>
            <artifactId>gremlin-core</artifactId>
            <version>${gremlin.version}</version>
            <exclusions>
                <exclusion>
                    <groupId>commons-beanutils</groupId>
                    <artifactId>commons-beanutils</artifactId>
                </exclusion>
                <!-- gremlin-core pulls antlr4-runtime 4.9.1 transitively via gremlin-language,
                     independently of and in addition to the explicit (optional) antlr4-runtime
                     dependency declared above. That transitive edge is not optional and is not
                     affected by marking our own duplicate declaration optional, so it still leaks
                     4.9.1 to Maven-coordinate consumers (issue #5217) unless excluded here. The
                     explicit optional dependency above continues to supply antlr4-runtime for
                     gremlin's own compilation and for bundling+relocation in the shaded jar. -->
                <exclusion>
                    <groupId>org.antlr</groupId>
                    <artifactId>antlr4-runtime</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.apache.tinkerpop</groupId>
            <artifactId>gremlin-server</artifactId>
            <version>${gremlin.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.tinkerpop</groupId>
            <artifactId>gremlin-driver</artifactId>
            <version>${gremlin.version}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.tinkerpop</groupId>
            <artifactId>gremlin-util</artifactId>
            <version>${gremlin.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.tinkerpop</groupId>
            <artifactId>gremlin-groovy</artifactId>
            <version>${gremlin.version}</version>
            <exclusions>
                <exclusion>
                    <groupId>jline</groupId>
                    <artifactId>jline</artifactId>
                </exclusion>
            </exclusions>
        </dependency>


        <!-- ARCADEDB DOES NOT USE THIS LIBRARY BUT GREMLIN DOES. REPLACING IT WITH THE LAST RELEASE BECAUSE OF THE SECURITY ISSUE
         https://nvd.nist.gov/vuln/detail/CVE-2022-1471 -->
        <dependency>
            <groupId>org.yaml</groupId>
            <artifactId>snakeyaml</artifactId>
            <version>${snakeyaml.version}</version>
        </dependency>

        <!-- ARCADEDB DOES NOT USE THIS LIBRARY BUT GREMLIN DOES: gremlin-groovy pulls Ivy in to
             back Groovy's Grape dependency loader. TinkerPop 3.8.1 resolves 2.5.3, which is
             affected by the PackagerResolver path traversal
             https://nvd.nist.gov/vuln/detail/CVE-2026-26032 -->
        <dependency>
            <groupId>org.apache.ivy</groupId>
            <artifactId>ivy</artifactId>
            <version>${ivy.version}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.tinkerpop</groupId>
            <artifactId>gremlin-test</artifactId>
            <version>${gremlin.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.junit.vintage</groupId>
            <artifactId>junit-vintage-engine</artifactId>
            <version>${junit.jupiter.version}</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <executions>
                    <execution>
                        <goals>
                            <goal>test-jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <configuration>
                    <!-- Gremlin's tests exercise BOTH the engine SQL/Cypher parser (antlr 4.13.2)
                         and TinkerPop's parser (antlr 4.9.1); those cannot coexist on the
                         unshaded test classpath. They run in the arcadedb-gremlin-it module
                         against the shaded jar instead. Test sources still compile here so the
                         test-jar is produced. To run a single gremlin test, target gremlin-it, e.g.
                         mvn -pl gremlin-it test -Dtest=GremlinTest (or -Dit.test=... for *IT). -->
                    <skipTests>true</skipTests>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
                <configuration>
                    <!-- Same rationale as the surefire skip above: the *IT classes inherited from
                         the parent failsafe config would otherwise run on the unshaded classpath
                         (engine antlr 4.13.2 vs gremlin antlr 4.9.1) under -Pintegration, which CI
                         uses. They run in arcadedb-gremlin-it against the shaded jar instead. -->
                    <skipTests>true</skipTests>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-shade-plugin</artifactId>
                <configuration>
                    <!-- Relocate ANTLR 4.9.1 (TinkerPop's precompiled parser needs the v3 ATN
                         format) into a private package so it never collides with the engine's
                         org.antlr 4.13.2 on a shared classpath. -->
                    <relocations>
                        <relocation>
                            <pattern>org.antlr</pattern>
                            <shadedPattern>com.arcadedb.gremlin.shaded.org.antlr</shadedPattern>
                        </relocation>
                    </relocations>
                    <artifactSet>
                        <excludes>
                            <!-- Do NOT bundle the engine: its SQL/Cypher parsers are v4-ATN (antlr 4.13.2) and the
                                 org.antlr relocation above would rewrite them onto the bundled 4.9.1 runtime, making
                                 them undeserializable. The engine ships as its own plain jar (distribution lib/ and
                                 the arcadedb-gremlin-it module both provide it), so the relocation must touch only
                                 TinkerPop's own 4.9.1 parser. -->
                            <exclude>com.arcadedb:arcadedb-engine</exclude>
                        </excludes>
                    </artifactSet>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>
