<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.squashtest.tm</groupId>
    <artifactId>squash-tm</artifactId>
    <version>15.0.0-springboot4.IT2</version>
  </parent>

  <artifactId>squash-tm-bom</artifactId>
  <packaging>pom</packaging>

  <description>This module defines the preferred dependencies and their version to be used throughout the project. To
    declare a dependency, another module should :
    1. include this artifact in the dependencyManagement section with the "import" scope
    2. declare the required dependency in the dependencies section **without** a version number</description>

  <properties>

    <!-- Other dependencies -->
    <archunit.version>1.4.1</archunit.version>
    <axis.version>1.4</axis.version>
    <cglib-nodep.version>3.3.0</cglib-nodep.version>
    <commons-beanutils.version>1.9.4</commons-beanutils.version>
    <commons-collections.version>3.2.2</commons-collections.version>
    <commons-compress.version>1.26.2</commons-compress.version>
    <commons-csv.version>1.14.1</commons-csv.version>
    <commons-fileupload.version>2.0.0-M4</commons-fileupload.version>
    <commons-io.version>2.16.0</commons-io.version>
    <commons-text.version>1.12.0</commons-text.version>
    <commons-validator.version>1.9.0</commons-validator.version>
    <datasource-proxy.version>1.10</datasource-proxy.version>
    <dom4j.version>2.1.4</dom4j.version>

    <!-- ecj.version should match that pulled by org.apache.tomcat.embed:tomcat-embed-jasper -->
    <ecj.version>3.33.0</ecj.version>
    <encoder-esapi.version>1.3.1</encoder-esapi.version>
    <esapi.version>2.5.5.0</esapi.version>
    <gherkin.version>5.0.0</gherkin.version>
    <google.http.client.version>1.43.3</google.http.client.version>
    <google.http.oauth.version>1.36.0</google.http.oauth.version>
    <guava.version>33.2.1-jre</guava.version>
    <handlebars.version>4.4.0</handlebars.version>
    <inscriptis.version>1.0</inscriptis.version>
    <jericho-html.version>3.4</jericho-html.version>
    <jjwt.version>0.12.6</jjwt.version>
    <joda-time.version>2.12.7</joda-time.version>
    <jsoup.version>1.18.1</jsoup.version>
    <langchain4j.version>1.12.1</langchain4j.version>
    <openfeign.querydsl.version>7.1</openfeign.querydsl.version>
    <poi.version>5.3.0</poi.version>
    <spock.version>2.4-groovy-5.0</spock.version>
    <!-- Squash orchestrator library to transmit automated case, updated with squash orchestrator releases -->
    <tm.testplan.library.version>1.14.0</tm.testplan.library.version>
    <unitils.version>3.4.3</unitils.version>
    <vertex-ai-gemini.version>1.12.1-beta21</vertex-ai-gemini.version>
    <xml-resolver.version>1.2</xml-resolver.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.apache.groovy</groupId>
        <artifactId>groovy-bom</artifactId>
        <version>${groovy.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-dependencies</artifactId>
        <version>${spring.boot.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <dependency>
        <groupId>com.tngtech.archunit</groupId>
        <artifactId>archunit-junit5</artifactId>
        <version>${archunit.version}</version>
      </dependency>

      <dependency>
        <groupId>axis</groupId>
        <artifactId>axis</artifactId>
        <version>${axis.version}</version>
      </dependency>

      <dependency>
        <groupId>cglib</groupId>
        <artifactId>cglib-nodep</artifactId>
        <version>${cglib-nodep.version}</version>
      </dependency>

      <dependency>
        <groupId>commons-beanutils</groupId>
        <artifactId>commons-beanutils</artifactId>
        <version>${commons-beanutils.version}</version>
        <exclusions>
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>commons-collections</groupId>
        <artifactId>commons-collections</artifactId>
        <version>${commons-collections.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-compress</artifactId>
        <version>${commons-compress.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-csv</artifactId>
        <version>${commons-csv.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-fileupload2-jakarta-servlet6</artifactId>
        <version>${commons-fileupload.version}</version>
      </dependency>

      <dependency>
        <groupId>commons-io</groupId>
        <artifactId>commons-io</artifactId>
        <version>${commons-io.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-text</artifactId>
        <version>${commons-text.version}</version>
      </dependency>

      <dependency>
        <groupId>commons-validator</groupId>
        <artifactId>commons-validator</artifactId>
        <version>${commons-validator.version}</version>
        <exclusions>
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>net.ttddyy</groupId>
        <artifactId>datasource-proxy</artifactId>
        <version>${datasource-proxy.version}</version>
      </dependency>

      <dependency>
        <groupId>org.dom4j</groupId>
        <artifactId>dom4j</artifactId>
        <version>${dom4j.version}</version>
      </dependency>

      <dependency>
        <!-- see comment in the exlude section of net.sf.jasperreports:jasperreports -->
        <groupId>org.eclipse.jdt</groupId>
        <artifactId>ecj</artifactId>
        <version>${ecj.version}</version>
      </dependency>

      <dependency>
        <groupId>org.owasp.encoder</groupId>
        <artifactId>encoder-esapi</artifactId>
        <version>${encoder-esapi.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.owasp.esapi</groupId>
            <artifactId>esapi</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-simple</artifactId>
          </exclusion>
          <exclusion>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <!-- esapi dependency in encoder-esapi still uses javax.servlet,
           remove this dependency when upgrading encoder-esapi and its exclusion -->
      <dependency>
        <groupId>org.owasp.esapi</groupId>
        <artifactId>esapi</artifactId>
        <version>${esapi.version}</version>
        <classifier>jakarta</classifier>
      </dependency>

      <dependency>
        <groupId>io.cucumber</groupId>
        <artifactId>gherkin</artifactId>
        <version>${gherkin.version}</version>
      </dependency>

      <dependency>
        <groupId>com.google.http-client</groupId>
        <artifactId>google-http-client</artifactId>
        <version>${google.http.client.version}</version>
      </dependency>

      <dependency>
        <groupId>com.google.oauth-client</groupId>
        <artifactId>google-oauth-client</artifactId>
        <version>${google.http.oauth.version}</version>
        <exclusions>
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>${guava.version}</version>
      </dependency>

      <dependency>
        <groupId>com.github.jknack</groupId>
        <artifactId>handlebars</artifactId>
        <version>${handlebars.version}</version>
      </dependency>

      <dependency>
        <groupId>ch.x28.inscriptis</groupId>
        <artifactId>inscriptis</artifactId>
        <version>${inscriptis.version}</version>
      </dependency>

      <dependency>
        <groupId>net.sf.jasperreports</groupId>
        <artifactId>jasperreports</artifactId>
        <version>${jasperreports.version}</version>

        <exclusions>
          <!--
        		Some dependencies of Jasperreports are a mess (not jasper reports itself
        		though) : itext and castor-xml. Their own dependencies must also be
        		managed here.

        		Note that the version of itext here has been slightly modified by the JR
        		team and is served by their own maven repository.

        		Note: no wild card used here for duplicate dependencies because maven-enforcer-plugin
        		doesn't handle them well (see https://issues.apache.org/jira/browse/MENFORCER-195).
        		Each offending dependency will be listed explicitly instead.
        	 -->

          <!--
		  		Bouncycastle is pulled by itext. But no we wont do xmlsecurity in our documents
		  		so we just exclude them.
		  		Beside the lib changed its groupid from 'bouncycastle' to 'org.bouncycastle',
		  		which effectively allows Maven to pull both set of bouncycastle artifacts (as shown by
		  		dependency:tree -Dverbose) with no regard for the Shrödinbugs it induces at runtime.

		  		Note : we don't use the wildcard notation here because maven-enforcer-plugin
		  		cant handle it properly (see https://issues.apache.org/jira/browse/MENFORCER-195)
		  		so we explicitly declare the three of them.
		  	-->
          <exclusion>
            <groupId>bouncycastle</groupId>
            <artifactId>bcmail-jdk14</artifactId>
          </exclusion>

          <exclusion>
            <groupId>bouncycastle</groupId>
            <artifactId>bcprov-jdk14</artifactId>
          </exclusion>

          <exclusion>
            <groupId>bouncycastle</groupId>
            <artifactId>bctsp-jdk14</artifactId>
          </exclusion>

          <!--
        		I could argue how castor-xml pulls both
        		stax:stax-api:1.0.1 and javax:xml:stream:stax-api:1.0-2
        		but since stax-api is now part of java rt since 1.6
        		we just remove both altogether.
        	 -->
          <exclusion>
            <groupId>stax</groupId>
            <artifactId>stax-api</artifactId>
          </exclusion>

          <exclusion>
            <groupId>javax.xml.stream</groupId>
            <artifactId>stax-api</artifactId>
          </exclusion>

          <!--  we don't do report on lucene indexes -->
          <exclusion>
            <groupId>org.apache.lucene</groupId>
            <artifactId>lucene-core</artifactId>
          </exclusion>

          <exclusion>
            <groupId>org.apache.lucene</groupId>
            <artifactId>lucene-analyzers-common</artifactId>
          </exclusion>

          <exclusion>
            <groupId>org.apache.lucene</groupId>
            <artifactId>lucene-queryparser</artifactId>
          </exclusion>

          <!-- xml-api part of the java runtime already -->
          <exclusion>
            <groupId>xml-apis</groupId>
            <artifactId>xml-apis</artifactId>
          </exclusion>

          <!-- no, we don't do BI either -->
          <exclusion>
            <groupId>org.olap4j</groupId>
            <artifactId>olap4j</artifactId>
          </exclusion>

          <!-- no commons logging -->
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>

          <!--
          	Jasper Reports compiles java with
          	org.eclipse.jdt.core.compiler:ecj, which is a subset
          	of the broader org.eclipse.jdt:ecj pulled
          	by tomcat-embed-jasper in the tm.web project.

          	Previous versions of tomcat-embed-jasper also
          	ran using the core.compiler ecj variant but as
          	of 8.5.31 (and probably earlier)
          	the later is used. In order to avoid ending
          	with both jars in the final assembly we now
          	wire Jasper Reports with org.eclipse.jdt:ecj.

          	Projects that pull jasperreports as configured by
          	this bom should be aware of this : they should
          	add org.eclipse.jdt:ecj to their dependencies.

          	Even better, they should simply depend on
          	org.squashtest.tm:core.report.api and not worry
          	about this.
            -->

          <exclusion>
            <groupId>org.eclipse.jdt.core.compiler</groupId>
            <artifactId>ecj</artifactId>
          </exclusion>

        </exclusions>

      </dependency>

      <dependency>
        <groupId>net.htmlparser.jericho</groupId>
        <artifactId>jericho-html</artifactId>
        <version>${jericho-html.version}</version>
      </dependency>

      <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-api</artifactId>
        <version>${jjwt.version}</version>
      </dependency>

      <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>${jjwt.version}</version>
      </dependency>

      <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>${jjwt.version}</version>
      </dependency>

      <dependency>
        <groupId>joda-time</groupId>
        <artifactId>joda-time</artifactId>
        <version>${joda-time.version}</version>
      </dependency>

      <dependency>
        <groupId>org.jsoup</groupId>
        <artifactId>jsoup</artifactId>
        <version>${jsoup.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-anthropic</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-azure-open-ai</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-http-client-jdk</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-mistral-ai</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>
      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-open-ai</artifactId>
        <version>${langchain4j.version}</version>
      </dependency>

      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-vertex-ai-gemini</artifactId>
        <version>${vertex-ai-gemini.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.poi</groupId>
        <artifactId>poi</artifactId>
        <version>${poi.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.poi</groupId>
        <artifactId>poi-ooxml</artifactId>
        <version>${poi.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.poi</groupId>
        <artifactId>poi-ooxml-schemas</artifactId>
        <version>${poi.version}</version>
        <exclusions>
          <exclusion>
            <!-- part of the jdk since 1.6 -->
            <groupId>stax</groupId>
            <artifactId>stax-api</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <!--  com.querydsl seems to be abandoned, and not compatible with hibernate 6,
      openfeign is the fork we chose  -->
      <dependency>
        <groupId>io.github.openfeign.querydsl</groupId>
        <artifactId>querydsl-jpa-spring</artifactId>
        <version>${openfeign.querydsl.version}</version>
      </dependency>

      <dependency>
        <!-- This is useful for IDEs to generate some metadata. Do not remove -->
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-configuration-processor</artifactId>
        <version>${spring.boot.version}</version>
        <optional>true</optional>
      </dependency>

      <dependency>
        <!-- Configuring logging : we have to exclude default (logback) and explicitly include log4j -->
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter</artifactId>
        <version>${spring.boot.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>org.squashtest.squash.automation</groupId>
        <artifactId>tm-testplan-library</artifactId>
        <version>${tm.testplan.library.version}</version>
        <exclusions>
          <exclusion>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
          </exclusion>
          <exclusion>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
          </exclusion>
          <exclusion>
            <groupId>jakarta.platform</groupId>
            <artifactId>jakarta.jakartaee-api</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>org.unitils</groupId>
        <artifactId>unitils-core</artifactId>
        <version>${unitils.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>org.unitils</groupId>
        <artifactId>unitils-database</artifactId>
        <version>${unitils.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-nop</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>org.unitils</groupId>
        <artifactId>unitils-dbunit</artifactId>
        <version>${unitils.version}</version>
      </dependency>

      <dependency>
        <groupId>org.unitils</groupId>
        <artifactId>unitils-spring</artifactId>
        <version>${unitils.version}</version>
      </dependency>

      <dependency>
        <groupId>io.github.openfeign.querydsl</groupId>
        <artifactId>querydsl-apt</artifactId>
        <version>${openfeign.querydsl.version}</version>
        <scope>provided</scope>
        <exclusions>
          <exclusion>
            <groupId>javax.jdo</groupId>
            <artifactId>jdo-api</artifactId>
          </exclusion>
          <exclusion>
            <!--
              Querydsl-codegen uses an obsolete version of eclipse ecj (org.eclipse.jdt.core.compiler:ecj).
              We need it at compile time only (not runtime). Still at runtime, when running in Eclipse IDE it will
              be loaded in place of the good one (org.eclipse.jdt:ecj) which entails JSP compilation failures
              (see https://github.com/spring-projects/spring-boot/issues/14398).

              This is very annoying because the final Maven dependencies are correct and a distro would run
              without problem because only ecj:${ecj.version} would be loaded.

              The solution here is to forcibly ban org.eclipse.jdt.core.compiler just because of that, and
              Querydsl-s apt-maven-plugin will have to settle for the jdk compiler instead.
            -->
            <groupId>org.eclipse.jdt.core.compiler</groupId>
            <artifactId>ecj</artifactId>

          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>org.beanshell</groupId>
        <artifactId>bsh</artifactId>
        <version>${bsh.version}</version>
        <scope>runtime</scope>
      </dependency>

      <dependency>
        <groupId>com.h2database</groupId>
        <artifactId>h2</artifactId>
        <version>${h2.version}</version>
        <scope>runtime</scope>
      </dependency>

      <dependency>
        <groupId>xml-resolver</groupId>
        <artifactId>xml-resolver</artifactId>
        <version>${xml-resolver.version}</version>
        <scope>runtime</scope>
      </dependency>

      <dependency>
        <groupId>org.spockframework</groupId>
        <artifactId>spock-core</artifactId>
        <version>${spock.version}</version>
        <scope>test</scope>
      </dependency>

      <dependency>
        <groupId>org.spockframework</groupId>
        <artifactId>spock-spring</artifactId>
        <version>${spock.version}</version>
        <scope>test</scope>
      </dependency>

      <dependency>
        <groupId>org.spockframework</groupId>
        <artifactId>spock-unitils</artifactId>
        <version>${spock.version}</version>
        <scope>test</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

</project>
