<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.squashtest.tm</groupId>
    <artifactId>squash-tm</artifactId>
    <version>15.0.0-20260702.IT1</version>
  </parent>

  <artifactId>squash-tm-bom</artifactId>
  <packaging>pom</packaging>

  <description>This module defines the preferred dependencies and their version to be used throughout the project. To
    declare a dependency, another module should :
    1. include this artifact in the dependencyManagement section with the "import" scope
    2. declare the required dependency in the dependencies section **without** a version number</description>

  <properties>

    <!-- Other dependencies -->
    <archunit.version>1.4.2</archunit.version>
    <axis.version>1.4</axis.version>
    <cglib-nodep.version>3.3.0</cglib-nodep.version>
    <commons-beanutils.version>1.11.0</commons-beanutils.version>
    <commons-cli.version>1.11.0</commons-cli.version>
    <commons-collections.version>3.2.2</commons-collections.version>
    <commons-collections4.version>4.5.0</commons-collections4.version>
    <commons-compress.version>1.26.2</commons-compress.version>
    <commons-csv.version>1.14.1</commons-csv.version>
    <commons-fileupload.version>2.0.0-M5</commons-fileupload.version>
    <commons-io.version>2.22.0</commons-io.version>
    <commons-text.version>1.15.0</commons-text.version>
    <commons-validator.version>1.10.1</commons-validator.version>
    <datasource-proxy.version>1.11.0</datasource-proxy.version>
    <dbunit.version>2.8.0</dbunit.version>
    <dom4j.version>2.2.0</dom4j.version>

    <!-- ecj : Java compiler used at runtime by JasperReports, declared by core.report.api
         (formerly pulled transitively by tomcat-embed-jasper, since removed from tm.web) -->
    <ecj.version>3.46.0</ecj.version>
    <encoder-esapi.version>1.4.0</encoder-esapi.version>
    <esapi.version>2.7.0.0</esapi.version>
    <gherkin.version>5.0.0</gherkin.version>
    <google.http.client.version>1.47.1</google.http.client.version>
    <google.http.oauth.version>1.39.0</google.http.oauth.version>
    <guava.version>33.6.0-jre</guava.version>
    <handlebars.version>4.5.1</handlebars.version>
    <inscriptis.version>1.0</inscriptis.version>
    <jericho-html.version>3.4</jericho-html.version>
    <jjwt.version>0.13.0</jjwt.version>
    <joda-time.version>2.14.2</joda-time.version>
    <jsoup.version>1.18.1</jsoup.version>
    <langchain4j.version>1.15.0</langchain4j.version>
    <openfeign.querydsl.version>7.1</openfeign.querydsl.version>
    <poi.version>5.5.1</poi.version>
    <reflections.version>0.10.2</reflections.version>
    <spock.version>2.4-groovy-5.0</spock.version>
    <!-- Squash orchestrator library to transmit automated case, updated with squash orchestrator releases -->
    <tm.testplan.library.version>1.14.0</tm.testplan.library.version>
    <vertex-ai-gemini.version>1.15.0-beta25</vertex-ai-gemini.version>
    <xml-resolver.version>1.2</xml-resolver.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.apache.groovy</groupId>
        <artifactId>groovy-bom</artifactId>
        <version>${groovy.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-dependencies</artifactId>
        <version>${spring.boot.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <dependency>
        <groupId>com.tngtech.archunit</groupId>
        <artifactId>archunit-junit5</artifactId>
        <version>${archunit.version}</version>
      </dependency>

      <dependency>
        <groupId>axis</groupId>
        <artifactId>axis</artifactId>
        <version>${axis.version}</version>
      </dependency>

      <dependency>
        <groupId>cglib</groupId>
        <artifactId>cglib-nodep</artifactId>
        <version>${cglib-nodep.version}</version>
      </dependency>

      <dependency>
        <groupId>commons-beanutils</groupId>
        <artifactId>commons-beanutils</artifactId>
        <version>${commons-beanutils.version}</version>
        <exclusions>
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>commons-cli</groupId>
        <artifactId>commons-cli</artifactId>
        <version>${commons-cli.version}</version>
      </dependency>

      <dependency>
        <groupId>commons-collections</groupId>
        <artifactId>commons-collections</artifactId>
        <version>${commons-collections.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-collections4</artifactId>
        <version>${commons-collections4.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-compress</artifactId>
        <version>${commons-compress.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-csv</artifactId>
        <version>${commons-csv.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-fileupload2-jakarta-servlet6</artifactId>
        <version>${commons-fileupload.version}</version>
      </dependency>

      <dependency>
        <groupId>commons-io</groupId>
        <artifactId>commons-io</artifactId>
        <version>${commons-io.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-text</artifactId>
        <version>${commons-text.version}</version>
      </dependency>

      <dependency>
        <groupId>commons-validator</groupId>
        <artifactId>commons-validator</artifactId>
        <version>${commons-validator.version}</version>
        <exclusions>
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>net.ttddyy</groupId>
        <artifactId>datasource-proxy</artifactId>
        <version>${datasource-proxy.version}</version>
      </dependency>

      <dependency>
        <groupId>org.dbunit</groupId>
        <artifactId>dbunit</artifactId>
        <version>${dbunit.version}</version>
      </dependency>

      <dependency>
        <groupId>org.dom4j</groupId>
        <artifactId>dom4j</artifactId>
        <version>${dom4j.version}</version>
      </dependency>

      <dependency>
        <!-- see comment in the exlude section of net.sf.jasperreports:jasperreports -->
        <groupId>org.eclipse.jdt</groupId>
        <artifactId>ecj</artifactId>
        <version>${ecj.version}</version>
      </dependency>

      <dependency>
        <groupId>org.owasp.encoder</groupId>
        <artifactId>encoder-esapi</artifactId>
        <version>${encoder-esapi.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.owasp.esapi</groupId>
            <artifactId>esapi</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-simple</artifactId>
          </exclusion>
          <exclusion>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <!-- esapi dependency in encoder-esapi still uses javax.servlet,
           remove this dependency when upgrading encoder-esapi and its exclusion -->
      <dependency>
        <groupId>org.owasp.esapi</groupId>
        <artifactId>esapi</artifactId>
        <version>${esapi.version}</version>
        <classifier>jakarta</classifier>
      </dependency>

      <dependency>
        <groupId>io.cucumber</groupId>
        <artifactId>gherkin</artifactId>
        <version>${gherkin.version}</version>
      </dependency>

      <dependency>
        <groupId>com.google.http-client</groupId>
        <artifactId>google-http-client</artifactId>
        <version>${google.http.client.version}</version>
      </dependency>

      <dependency>
        <groupId>com.google.oauth-client</groupId>
        <artifactId>google-oauth-client</artifactId>
        <version>${google.http.oauth.version}</version>
        <exclusions>
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>${guava.version}</version>
      </dependency>

      <dependency>
        <groupId>com.github.jknack</groupId>
        <artifactId>handlebars</artifactId>
        <version>${handlebars.version}</version>
      </dependency>

      <dependency>
        <groupId>ch.x28.inscriptis</groupId>
        <artifactId>inscriptis</artifactId>
        <version>${inscriptis.version}</version>
      </dependency>

      <dependency>
        <groupId>net.sf.jasperreports</groupId>
        <artifactId>jasperreports</artifactId>
        <version>${jasperreports.version}</version>

        <exclusions>
          <!--
        		Some dependencies of Jasperreports are a mess (not jasper reports itself
        		though) : itext and castor-xml. Their own dependencies must also be
        		managed here.

        		Note that the version of itext here has been slightly modified by the JR
        		team and is served by their own maven repository.

        		Note: no wild card used here for duplicate dependencies because maven-enforcer-plugin
        		doesn't handle them well (see https://issues.apache.org/jira/browse/MENFORCER-195).
        		Each offending dependency will be listed explicitly instead.
        	 -->

          <!--
		  		Bouncycastle is pulled by itext. But no we wont do xmlsecurity in our documents
		  		so we just exclude them.
		  		Beside the lib changed its groupid from 'bouncycastle' to 'org.bouncycastle',
		  		which effectively allows Maven to pull both set of bouncycastle artifacts (as shown by
		  		dependency:tree -Dverbose) with no regard for the Shrödinbugs it induces at runtime.

		  		Note : we don't use the wildcard notation here because maven-enforcer-plugin
		  		cant handle it properly (see https://issues.apache.org/jira/browse/MENFORCER-195)
		  		so we explicitly declare the three of them.
		  	-->
          <exclusion>
            <groupId>bouncycastle</groupId>
            <artifactId>bcmail-jdk14</artifactId>
          </exclusion>

          <exclusion>
            <groupId>bouncycastle</groupId>
            <artifactId>bcprov-jdk14</artifactId>
          </exclusion>

          <exclusion>
            <groupId>bouncycastle</groupId>
            <artifactId>bctsp-jdk14</artifactId>
          </exclusion>

          <!--
        		I could argue how castor-xml pulls both
        		stax:stax-api:1.0.1 and javax:xml:stream:stax-api:1.0-2
        		but since stax-api is now part of java rt since 1.6
        		we just remove both altogether.
        	 -->
          <exclusion>
            <groupId>stax</groupId>
            <artifactId>stax-api</artifactId>
          </exclusion>

          <exclusion>
            <groupId>javax.xml.stream</groupId>
            <artifactId>stax-api</artifactId>
          </exclusion>

          <!--  we don't do report on lucene indexes -->
          <exclusion>
            <groupId>org.apache.lucene</groupId>
            <artifactId>lucene-core</artifactId>
          </exclusion>

          <exclusion>
            <groupId>org.apache.lucene</groupId>
            <artifactId>lucene-analyzers-common</artifactId>
          </exclusion>

          <exclusion>
            <groupId>org.apache.lucene</groupId>
            <artifactId>lucene-queryparser</artifactId>
          </exclusion>

          <!-- xml-api part of the java runtime already -->
          <exclusion>
            <groupId>xml-apis</groupId>
            <artifactId>xml-apis</artifactId>
          </exclusion>

          <!-- no, we don't do BI either -->
          <exclusion>
            <groupId>org.olap4j</groupId>
            <artifactId>olap4j</artifactId>
          </exclusion>

          <!-- no commons logging -->
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>

          <!--
          	Jasper Reports compiles java with
          	org.eclipse.jdt.core.compiler:ecj, which is a subset
          	of the broader org.eclipse.jdt:ecj. We exclude the
          	core.compiler variant here so only org.eclipse.jdt:ecj
          	ends up in the assembly (avoiding two ecj jars).

          	org.eclipse.jdt:ecj used to be pulled transitively by
          	tomcat-embed-jasper in tm.web, but jasper has been
          	removed (no JSP in the product). It is therefore
          	declared explicitly by org.squashtest.tm:core.report.api.

          	Projects that pull jasperreports as configured by
          	this bom should be aware of this : they should
          	add org.eclipse.jdt:ecj to their dependencies.

          	Even better, they should simply depend on
          	org.squashtest.tm:core.report.api and not worry
          	about this.
            -->

          <exclusion>
            <groupId>org.eclipse.jdt.core.compiler</groupId>
            <artifactId>ecj</artifactId>
          </exclusion>

        </exclusions>

      </dependency>

      <dependency>
        <groupId>net.sf.jasperreports</groupId>
        <artifactId>jasperreports-excel-poi</artifactId>
        <version>${jasperreports.version}</version>
        <exclusions>
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>net.sf.jasperreports</groupId>
        <artifactId>jasperreports-pdf</artifactId>
        <version>${jasperreports.version}</version>
        <exclusions>
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>net.htmlparser.jericho</groupId>
        <artifactId>jericho-html</artifactId>
        <version>${jericho-html.version}</version>
      </dependency>

      <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-api</artifactId>
        <version>${jjwt.version}</version>
      </dependency>

      <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>${jjwt.version}</version>
      </dependency>

      <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>${jjwt.version}</version>
      </dependency>

      <dependency>
        <groupId>joda-time</groupId>
        <artifactId>joda-time</artifactId>
        <version>${joda-time.version}</version>
      </dependency>

      <dependency>
        <groupId>org.jsoup</groupId>
        <artifactId>jsoup</artifactId>
        <version>${jsoup.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-anthropic</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-azure-open-ai</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-http-client-jdk</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-mistral-ai</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>
      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-open-ai</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-vertex-ai-gemini</artifactId>
        <version>${vertex-ai-gemini.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.poi</groupId>
        <artifactId>poi</artifactId>
        <version>${poi.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.poi</groupId>
        <artifactId>poi-ooxml</artifactId>
        <version>${poi.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.poi</groupId>
        <artifactId>poi-ooxml-schemas</artifactId>
        <version>${poi.version}</version>
        <exclusions>
          <exclusion>
            <!-- part of the jdk since 1.6 -->
            <groupId>stax</groupId>
            <artifactId>stax-api</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <!--  com.querydsl seems to be abandoned, and not compatible with hibernate 6,
      openfeign is the fork we chose  -->
      <dependency>
        <groupId>io.github.openfeign.querydsl</groupId>
        <artifactId>querydsl-jpa-spring</artifactId>
        <version>${openfeign.querydsl.version}</version>
      </dependency>

      <dependency>
        <groupId>org.reflections</groupId>
        <artifactId>reflections</artifactId>
        <version>${reflections.version}</version>
      </dependency>

      <dependency>
        <!-- This is useful for IDEs to generate some metadata. Do not remove -->
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-configuration-processor</artifactId>
        <version>${spring.boot.version}</version>
        <optional>true</optional>
      </dependency>

      <dependency>
        <!-- Configuring logging : we have to exclude default (logback) and explicitly include log4j -->
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter</artifactId>
        <version>${spring.boot.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>org.squashtest.squash.automation</groupId>
        <artifactId>tm-testplan-library</artifactId>
        <version>${tm.testplan.library.version}</version>
        <exclusions>
          <exclusion>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
          </exclusion>
          <exclusion>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
          </exclusion>
          <exclusion>
            <groupId>jakarta.platform</groupId>
            <artifactId>jakarta.jakartaee-api</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>io.github.openfeign.querydsl</groupId>
        <artifactId>querydsl-apt</artifactId>
        <version>${openfeign.querydsl.version}</version>
        <scope>provided</scope>
        <exclusions>
          <exclusion>
            <groupId>javax.jdo</groupId>
            <artifactId>jdo-api</artifactId>
          </exclusion>
          <exclusion>
            <!--
              Querydsl-codegen uses an obsolete version of eclipse ecj (org.eclipse.jdt.core.compiler:ecj).
              We need it at compile time only (not runtime). Still at runtime, when running in Eclipse IDE it will
              be loaded in place of the good one (org.eclipse.jdt:ecj) which entails JSP compilation failures
              (see https://github.com/spring-projects/spring-boot/issues/14398).

              This is very annoying because the final Maven dependencies are correct and a distro would run
              without problem because only ecj:${ecj.version} would be loaded.

              The solution here is to forcibly ban org.eclipse.jdt.core.compiler just because of that, and
              Querydsl-s apt-maven-plugin will have to settle for the jdk compiler instead.
            -->
            <groupId>org.eclipse.jdt.core.compiler</groupId>
            <artifactId>ecj</artifactId>

          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>org.beanshell</groupId>
        <artifactId>bsh</artifactId>
        <version>${bsh.version}</version>
        <scope>runtime</scope>
      </dependency>

      <dependency>
        <groupId>com.h2database</groupId>
        <artifactId>h2</artifactId>
        <version>${h2.version}</version>
        <scope>runtime</scope>
      </dependency>

      <dependency>
        <groupId>xml-resolver</groupId>
        <artifactId>xml-resolver</artifactId>
        <version>${xml-resolver.version}</version>
        <scope>runtime</scope>
      </dependency>

      <dependency>
        <groupId>org.spockframework</groupId>
        <artifactId>spock-core</artifactId>
        <version>${spock.version}</version>
        <scope>test</scope>
      </dependency>

      <dependency>
        <groupId>org.spockframework</groupId>
        <artifactId>spock-spring</artifactId>
        <version>${spock.version}</version>
        <scope>test</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

</project>
