<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.tiatesting</groupId>
    <artifactId>tia-maven-plugin</artifactId>
    <version>0.1.18</version>
    <packaging>jar</packaging>

    <name>Tia Maven Plugin</name>
    <description>The Tia Testing Maven Plugin provides the Tia Testing runtime agent to your tests.</description>
    <url>github.com/mtgleeson/tiatesting</url>

    <licenses>
        <license>
            <name>The Apache License, Version 2.0</name>
            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
        </license>
    </licenses>

    <developers>
        <developer>
            <id>mtgleeson</id>
            <name>Matt Gleeson</name>
        </developer>
    </developers>

    <scm>
        <connection>scm:git:git://github.com/mtgleeson/tiatesting.git</connection>
        <developerConnection>scm:git:ssh://github.com/mtgleeson/tiatesting.git</developerConnection>
        <url>github.com/mtgleeson/tiatesting</url>
    </scm>

    <properties>
        <tia.version>0.1.18</tia.version>
        <maven.compiler.target>1.8</maven.compiler.target>
        <maven.compiler.source>1.8</maven.compiler.source>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <gpg.skip>true</gpg.skip>
    </properties>

    <!--
        No <prerequisites> here: it only enforces a Maven floor for maven-plugin packaging,
        and this module is packaging=jar (a shared library used by the wrapper plugins).
        The Maven 3.8.1+ floor for CVE-2021-26291 is enforced on the wrapper plugins, which
        is what end users actually invoke; this module is never used as a plugin directly.
    -->

    <!--
        These transitive deps of maven-core (provided scope) are flagged by vulnerability
        scanners against their default versions shipped with Maven 3.6.x. At runtime the
        user's Maven supplies the actual classes, so the real protection comes from the
        <prerequisites> floor above; pinning here keeps tia's declared dependency tree
        clean for static analysis tools (Mend, Snyk, Dependabot, etc.) and avoids shipping
        stale transitive artifacts when one of these is ever resolved at compile scope.
    -->
    <dependencyManagement>
        <dependencies>
            <!-- CVE-2025-48924 — pin to latest 3.x (Java 8 compatible). -->
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-lang3</artifactId>
                <version>3.18.0</version>
            </dependency>
            <!-- CVE-2025-67030 — Mend "Insufficient Information" entry; pin to latest available 4.0.x line. -->
            <dependency>
                <groupId>org.codehaus.plexus</groupId>
                <artifactId>plexus-utils</artifactId>
                <version>4.0.3</version>
            </dependency>
            <!-- CVE-2022-29599 — command injection; fixed in 3.3.0+. -->
            <dependency>
                <groupId>org.apache.maven.shared</groupId>
                <artifactId>maven-shared-utils</artifactId>
                <version>3.3.4</version>
            </dependency>
            <!-- CVE-2021-29425, CVE-2024-47554 — both fixed by 2.14.0+. -->
            <dependency>
                <groupId>commons-io</groupId>
                <artifactId>commons-io</artifactId>
                <version>2.18.0</version>
            </dependency>
            <!-- CVE-2023-2976, CVE-2020-8908 — fixed in 32.0.0-jre+. -->
            <dependency>
                <groupId>com.google.guava</groupId>
                <artifactId>guava</artifactId>
                <version>33.4.0-jre</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <dependency>
            <groupId>org.tiatesting</groupId>
            <artifactId>tia-core</artifactId>
            <version>${tia.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-plugin-api</artifactId>
            <version>3.8.1</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.plugin-tools</groupId>
            <artifactId>maven-plugin-annotations</artifactId>
            <version>3.6.0</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-core</artifactId>
            <version>3.8.1</version>
            <scope>provided</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <version>3.3.1</version>
                <executions>
                    <execution>
                        <id>attach-sources</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>3.6.3</version>
                <executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-gpg-plugin</artifactId>
                <version>1.5</version>
                <configuration>
                    <gpgArguments>
                        <arg>--pinentry-mode</arg>
                        <arg>loopback</arg>
                    </gpgArguments>
                </configuration>
                <executions>
                    <execution>
                        <id>sign-artifacts</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>sign</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.sonatype.central</groupId>
                <artifactId>central-publishing-maven-plugin</artifactId>
                <version>0.10.0</version>
                <extensions>true</extensions>
                <configuration>
                    <publishingServerId>central</publishingServerId>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <profile>
            <id>release</id>
            <properties>
                <gpg.skip>false</gpg.skip>
            </properties>
        </profile>
    </profiles>
</project>