<?xml version="1.0" encoding="UTF-8"?>
<!--

    Copyright (C) 2014-2026 Philip Helger (www.helger.com)
    philip[at]helger[dot]com

    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at

            http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.

-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.helger</groupId>
  <artifactId>parent-pom</artifactId>
  <version>3.1.0</version>
  <packaging>pom</packaging>
  <name>ph-parent-pom</name>
  <description>Generic parent POM for Java 17+ applications</description>
  <url>https://github.com/phax/ph-parent-pom</url>
  <inceptionYear>2014</inceptionYear>
  
  <licenses>
    <license>
      <name>Apache 2</name>
      <url>https://www.apache.org/licenses/LICENSE-2.0</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <scm>
    <connection>scm:git:https://github.com/phax/ph-parent-pom.git</connection>
    <developerConnection>scm:git:https://github.com/phax/ph-parent-pom.git</developerConnection>
    <url>https://github.com/phax/ph-parent-pom</url>
    <tag>parent-pom-3.1.0</tag>
  </scm>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <java.version>17</java.version>
    <junit4.version>4.13.2</junit4.version>
    <!--
    <junit.platform.version>1.13.4</junit.platform.version>
    <junit.jupiter.version>5.13.4</junit.jupiter.version>
    <junit.vintage.version>${junit.jupiter.version}</junit.vintage.version>
    -->
    <slf4j.version>2.0.18</slf4j.version>
    <!--
    JakartaEE 9:  5.0
    JakartaEE 10: 6.0
    JakartaEE 11: 6.1
    JakartaEE 12: 6.2
    -->
    <jakarta.servlet-api.version>6.0.0</jakarta.servlet-api.version>
    <!--
    JakartaEE 9:  3.0
    JakartaEE 10: 3.1
    JakartaEE 11: 4.0
    JakartaEE 12: 4.1
    -->
    <jakarta.servlet.jsp-api.version>3.1.1</jakarta.servlet.jsp-api.version>
    
    <!-- Use properties for forbiddenapis integration -->
    <maven.compiler.source>${java.version}</maven.compiler.source>
    <maven.compiler.target>${java.version}</maven.compiler.target>
    <!-- Ensure the Java API baseline is checked at compile time, even when building with a newer JDK -->
    <maven.compiler.release>${java.version}</maven.compiler.release>
    
    <!-- For Reproducible Builds; automatically updated by the maven-release-plugin on release -->
    <project.build.outputTimestamp>2026-07-14T12:05:00Z</project.build.outputTimestamp>
    
    <!-- Eclipse Maven integration settings -->
    <m2e.jaxrs.activation>false</m2e.jaxrs.activation>
    <m2e.jpa.activation>false</m2e.jpa.activation>
    <m2e.jsf.activation>false</m2e.jsf.activation>
  </properties>

  <!-- Who are we? -->
  <organization>
    <name>Philip Helger</name>
    <url>https://www.helger.com</url>
  </organization>

  <!-- Who are we? -->
  <developers>
    <developer>
      <id>phax</id>
      <name>Philip Helger</name>
      <email>philip(at)helger.com</email>
      <url>https://www.helger.com</url>
    </developer>
  </developers>

  <!-- Note: these snapshot repositories are intentionally inherited by all child
       projects, because they are required during the development phase to consume
       SNAPSHOT builds of the ph-* stack. Release artifacts are never resolved from
       here, as "releases" are disabled. -->
  <repositories>
    <repository>
      <name>Central Portal Snapshots</name>
      <id>central-portal-snapshots</id>
      <url>https://central.sonatype.com/repository/maven-snapshots/</url>
      <releases>
        <enabled>false</enabled>
      </releases>
      <snapshots>
        <enabled>true</enabled>
      </snapshots>
    </repository>
  </repositories>

  <pluginRepositories>
    <pluginRepository>
      <name>Central Portal Snapshots</name>
      <id>central-portal-snapshots</id>
      <url>https://central.sonatype.com/repository/maven-snapshots/</url>
      <releases>
        <enabled>false</enabled>
      </releases>
      <snapshots>
        <enabled>true</enabled>
      </snapshots>
    </pluginRepository>
  </pluginRepositories>

  <profiles>
    <profile>
      <id>release</id>
      <build>
        <plugins>
          <!-- Until v3.0.5 the maven-compiler-plugin was configured here with
               "debug=false" and "optimize=true". "debug=false" was removed, so that
               released artifacts keep line numbers and parameter names for easier
               debugging by consumers; "optimize" was removed because it is ignored
               by current maven-compiler-plugin versions. -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
              </execution>
            </executions>
            <configuration>
              <!-- useAgent must be true for gpg2 -->
              <!-- This implies, that the password MUST be entered manually once per session -->
              <!-- Stuff like https://stackoverflow.com/a/14245913/15254 only works, when useAgent is false -->
              <useAgent>true</useAgent>
            </configuration>
          </plugin>
          <plugin>
            <groupId>org.sonatype.central</groupId>
            <artifactId>central-publishing-maven-plugin</artifactId>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>release-snapshot</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.sonatype.central</groupId>
            <artifactId>central-publishing-maven-plugin</artifactId>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>jdeps</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-jdeps-plugin</artifactId>
            <executions>
              <execution>
                <goals>
                  <!-- verify main + test classes -->
                  <goal>jdkinternals</goal>
                  <goal>test-jdkinternals</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>coverage</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.jacoco</groupId>
            <artifactId>jacoco-maven-plugin</artifactId>
            <version>0.8.15</version>
            <configuration>
              <excludes>
                <!-- JavaCC generated token manager may contain too large method -->
                <exclude>**/*TokenManager</exclude>
              </excludes>
            </configuration>
            <executions>
              <execution>
                <goals>
                  <goal>prepare-agent</goal>
                </goals>
              </execution>
              <execution>
                <id>report</id>
                <phase>test</phase>
                <goals>
                  <goal>report</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
    <!-- Only pass the NVD API key to dependency-check-maven when the environment
         variable is present. Otherwise the unresolved expression would be used as
         the literal API key, leading to confusing NVD errors. -->
    <profile>
      <id>nvd-api-key</id>
      <activation>
        <property>
          <name>env.NVDAPIKEY</name>
        </property>
      </activation>
      <build>
        <pluginManagement>
          <plugins>
            <plugin>
              <groupId>org.owasp</groupId>
              <artifactId>dependency-check-maven</artifactId>
              <configuration>
                <nvdApiKey>${env.NVDAPIKEY}</nvdApiKey>
              </configuration>
            </plugin>
          </plugins>
        </pluginManagement>
      </build>
    </profile>
  </profiles>

  <dependencyManagement>
    <dependencies>
      <!-- JUnit 4 -->
      <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
        <version>${junit4.version}</version>
      </dependency>
      
      <!-- JUnit 5 -->
      <!-- Commented out, because it may create unwanted conflicts -->
      <!--
      <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter-api</artifactId>
        <version>${junit.jupiter.version}</version>
      </dependency>
      <dependency>
        <groupId>org.junit.platform</groupId>
        <artifactId>junit-platform-launcher</artifactId>
        <version>${junit.platform.version}</version>
      </dependency>
      <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter-engine</artifactId>
        <version>${junit.jupiter.version}</version>
      </dependency>
      <dependency>
        <groupId>org.junit.vintage</groupId>
        <artifactId>junit-vintage-engine</artifactId>
        <version>${junit.vintage.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apiguardian</groupId>
        <artifactId>apiguardian-api</artifactId>
        <version>1.1.2</version>
      </dependency>
      -->
      
      <!-- Jakarta EE -->
      <dependency>
        <groupId>jakarta.servlet</groupId>
        <artifactId>jakarta.servlet-api</artifactId>
        <version>${jakarta.servlet-api.version}</version>
      </dependency>
      <dependency>
        <groupId>jakarta.servlet.jsp</groupId>
        <artifactId>jakarta.servlet.jsp-api</artifactId>
        <version>${jakarta.servlet.jsp-api.version}</version>
      </dependency>
      
      <!-- SLF4J -->
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-api</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-simple</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>jul-to-slf4j</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>jcl-over-slf4j</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>log4j-over-slf4j</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-jdk-platform-logging</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <!-- Dependencies automatically included - none! -->
  <dependencies>
  </dependencies>

  <!-- Build plugins -->
  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>com.mycila</groupId>
          <artifactId>license-maven-plugin</artifactId>
          <version>5.0.0</version>
          <configuration>
            <strictCheck>true</strictCheck>
            <encoding>${project.build.sourceEncoding}</encoding>
            <mapping>
              <!-- OASIS Content Value Association -->
              <cva>XML_STYLE</cva>
              <!-- JAXB episode files -->
              <episode>XML_STYLE</episode>
              <!-- OASIS GeneriCode -->
              <gc>XML_STYLE</gc>
              <!-- Java files -->
              <jav>SLASHSTAR_STYLE</jav>
              <!-- Java Domain Model stuff (JSON) -->
              <jdm>SLASHSTAR_STYLE</jdm>
              <!-- JavaCC source files -->
              <jj>SLASHSTAR_STYLE</jj>
              <!-- JavaCC JJTree source files -->
              <jjt>SLASHSTAR_STYLE</jjt>
              <!-- Proxy stuff (like JS) -->
              <pac>SLASHSTAR_STYLE</pac>
              <!-- RelaxNG XML images -->
              <rng>XML_STYLE</rng>
              <!-- Schematron files -->
              <sch>XML_STYLE</sch>
              <!-- SVG images -->
              <svg>XML_STYLE</svg>
              <!-- SVRL images -->
              <svrl>XML_STYLE</svrl>
              <!-- WebService WSDL -->
              <wsdl>XML_STYLE</wsdl>
              <!-- JAXB Binding Files -->
              <xjb>XML_STYLE</xjb>
              <!-- XQuery Files -->
              <!-- 
              <xq>XML_STYLE</xq>
               -->
              <!-- XSLT files -->
              <xslt>XML_STYLE</xslt>
            </mapping>
            <licenseSets>
              <licenseSet>
                <header>src/etc/license-template.txt</header>
                <excludes>
                  <!-- Adobe font metric file -->
                  <exclude>**/*.afm</exclude>
                  <!-- Base64 encoded file -->
                  <exclude>**/*.b64</exclude>
                  <!-- (JAXB) catalog file -->
                  <exclude>**/*.cat</exclude>
                  <!-- Certificate file -->
                  <exclude>**/*.cer</exclude>
                  <!-- CRL file -->
                  <exclude>**/*.crl</exclude>
                  <!-- CSV files -->
                  <exclude>**/*.csv</exclude>
                  <!-- Generic DAT files -->
                  <exclude>**/*.dat</exclude>
                  <!-- Certificate file -->
                  <exclude>**/*.der</exclude>
                  <!-- Dictionary file -->
                  <exclude>**/*.dict</exclude>
                  <!-- Binary word documents -->
                  <exclude>**/*.doc*</exclude>
                  <!-- Font files -->
                  <exclude>**/*.eot</exclude>
                  <!-- Eclipse preference files -->
                  <exclude>**/*.epf</exclude>
                  <!-- JAXB episode files -->
                  <exclude>**/*.episode</exclude>
                  <!-- Icon files -->
                  <exclude>**/*.ico</exclude>
                  <!-- Image files -->
                  <exclude>**/*.gif</exclude>
                  <!-- IntelliJ Idea project files -->
                  <exclude>**/*.iml</exclude>
                  <!-- JavaCC input files -->
                  <exclude>**/*.jj</exclude>
                  <!-- JavaCC JJTree input files -->
                  <exclude>**/*.jjt</exclude>
                  <!-- Java KeyStore files -->
                  <exclude>**/*.jks</exclude>
                  <!-- Image files -->
                  <exclude>**/*.jpg*</exclude>
                  <!-- Log files -->
                  <exclude>**/*.log</exclude>
                  <!-- Automatically created mapping files -->
                  <exclude>**/*.map</exclude>
                  <!-- MD5 hash files -->
                  <exclude>**/*.md5</exclude>
                  <!-- MIME encoded file -->
                  <exclude>**/*.mime</exclude>
                  <!-- Minified CSS/JS files - usually generated -->
                  <exclude>**/*.min.css</exclude>
                  <exclude>**/*.min.js</exclude>
                  <!-- Open Document file -->
                  <exclude>**/*.ods</exclude>
                  <!-- OpenType fonts -->
                  <exclude>**/*.otf</exclude>
                  <!-- Certificate file -->
                  <exclude>**/*.p12</exclude>
                  <!-- Patch file -->
                  <exclude>**/*.patch</exclude>
                  <!-- PDF file -->
                  <exclude>**/*.pdf</exclude>
                  <!-- PEM certificate file -->
                  <exclude>**/*.pem</exclude>
                  <!-- PMD configuration file -->
                  <exclude>**/*.pmd</exclude>
                  <!-- Image files -->
                  <exclude>**/*.png</exclude>
                  <!-- Policy file -->
                  <exclude>**/*.policy</exclude>
                  <!-- Powerpoint files -->
                  <exclude>**/*.ppt*</exclude>
                  <!-- RelaxNG compact files -->
                  <exclude>**/*.rnc</exclude>
                  <!-- SHA1 hash files -->
                  <exclude>**/*.sha1</exclude>
                  <!-- SHA256 hash files -->
                  <exclude>**/*.sha256</exclude>
                  <!-- SHA384 hash files -->
                  <exclude>**/*.sha384</exclude>
                  <!-- SHA512 hash files -->
                  <exclude>**/*.sha512</exclude>
                  <!-- Binary Flash files -->
                  <exclude>**/*.swf</exclude>
                  <!-- Files marked as test -->
                  <exclude>**/*.test</exclude>
                  <!-- Image files -->
                  <exclude>**/*.tif*</exclude>
                  <!-- TrueType fonts -->
                  <exclude>**/*.ttf</exclude>
                  <!-- Generic text file -->
                  <exclude>**/*.txt</exclude>
                  <!-- Wiki source files -->
                  <exclude>**/*.wiki</exclude>
                  <!-- Font files -->
                  <exclude>**/*.woff*</exclude>
                  <!-- Excel files -->
                  <exclude>**/*.xls*</exclude>
                  
                  <!-- All local git files -->
                  <exclude>**/.git*</exclude>
                  <!-- Special PMD config file -->
                  <exclude>**/.pmd</exclude>
                  <!-- Special license files without extension -->
                  <exclude>**/NOTICE</exclude>
                  <exclude>**/LICENSE</exclude>
                  <exclude>**/LICENSE2</exclude>
                  <!-- Google page index files -->
                  <exclude>**/google*.html</exclude>
                  <!-- Special temp files -->
                  <exclude>**/zz</exclude>
                  
                  <!-- Special files not to be formatted -->
                  <exclude>src/raw/**</exclude>
                  <!-- Special index file which requires special formatting! -->
                  <exclude>src/main/webapp/**/*.jsp</exclude>
                  <!-- WSDL files are usually exclusive -->
                  <exclude>src/main/resources/WEB-INF/wsdl/**</exclude>
                  <!-- External resources -->
                  <exclude>src/main/resources/**/external/**</exclude>
                  <!-- External test resources -->
                  <exclude>src/test/resources/**/external/**</exclude>
                  <!-- SPI files -->
                  <exclude>src/main/resources/META-INF/services/**</exclude>
                  <exclude>src/test/resources/META-INF/services/**</exclude>
                  <!-- Documentation files -->
                  <exclude>docs/**</exclude>
                  <!-- Generated files -->
                  <exclude>generated/**</exclude>
                </excludes>
              </licenseSet>
            </licenseSets>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.felix</groupId>
          <artifactId>maven-bundle-plugin</artifactId>
          <version>6.0.2</version>
          <extensions>true</extensions>
          <configuration>
            <supportedProjectTypes>
              <supportedProjectType>jar</supportedProjectType>
              <supportedProjectType>bundle</supportedProjectType>
              <supportedProjectType>war</supportedProjectType>
            </supportedProjectTypes>          
            <supportIncrementalBuild>true</supportIncrementalBuild>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-acr-plugin</artifactId>
          <version>3.2.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-antrun-plugin</artifactId>
          <version>3.2.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-assembly-plugin</artifactId>
          <version>3.8.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-checkstyle-plugin</artifactId>
          <version>3.6.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-clean-plugin</artifactId>
          <version>3.5.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>3.15.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-dependency-plugin</artifactId>
          <version>3.11.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-deploy-plugin</artifactId>
          <version>3.1.4</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-ear-plugin</artifactId>
          <version>3.4.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-ejb-plugin</artifactId>
          <version>3.3.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-enforcer-plugin</artifactId>
          <version>3.6.3</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-gpg-plugin</artifactId>
          <version>3.2.8</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-install-plugin</artifactId>
          <version>3.1.4</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jar-plugin</artifactId>
          <version>3.5.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jarsigner-plugin</artifactId>
          <version>3.1.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-javadoc-plugin</artifactId>
          <version>3.12.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jdeps-plugin</artifactId>
          <version>3.2.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jxr-plugin</artifactId>
          <version>3.6.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-plugin-plugin</artifactId>
          <version>3.15.2</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-pmd-plugin</artifactId>
          <version>3.28.0</version>
        </plugin>  
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-project-info-reports-plugin</artifactId>
          <version>3.9.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-rar-plugin</artifactId>
          <version>3.1.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-release-plugin</artifactId>
          <version>3.3.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-resources-plugin</artifactId>
          <version>3.5.0</version>
          <configuration>
            <encoding>${project.build.sourceEncoding}</encoding>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-shade-plugin</artifactId>
          <version>3.6.2</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-site-plugin</artifactId>
          <version>3.22.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-source-plugin</artifactId>
          <version>3.4.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-surefire-plugin</artifactId>
          <version>3.5.6</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-surefire-report-plugin</artifactId>
          <version>3.5.6</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-failsafe-plugin</artifactId>
          <version>3.5.6</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-war-plugin</artifactId>
          <version>3.5.1</version>
        </plugin>
        <plugin>
          <groupId>com.github.spotbugs</groupId>
          <artifactId>spotbugs-maven-plugin</artifactId>
          <version>4.10.3.0</version>
        </plugin>
        <plugin>
          <groupId>org.codehaus.mojo</groupId>
          <artifactId>taglist-maven-plugin</artifactId>
          <version>3.2.2</version>
        </plugin>
        <plugin>
          <groupId>org.owasp</groupId>
          <artifactId>dependency-check-maven</artifactId>
          <version>12.2.2</version>
        </plugin>
        <plugin>
          <groupId>com.helger.maven</groupId>
          <artifactId>ph-buildinfo-maven-plugin</artifactId>
          <version>5.0.1</version>
        </plugin>
        <plugin>
          <groupId>com.helger.maven</groupId>
          <artifactId>ph-jscompress-maven-plugin</artifactId>
          <version>3.1.1</version>
          <configuration>
            <forceCreation>false</forceCreation>
            <recursive>true</recursive>
          </configuration>
        </plugin>
        <plugin>
          <groupId>com.helger.maven</groupId>
          <artifactId>ph-csscompress-maven-plugin</artifactId>
          <version>8.2.1</version>
          <configuration>
            <forceCompress>false</forceCompress>
            <removeUnnecessaryCode>true</removeUnnecessaryCode>
            <quoteURLs>true</quoteURLs>
            <verbose>false</verbose>
          </configuration>
        </plugin>
        <plugin>
          <groupId>de.thetaphi</groupId>
          <artifactId>forbiddenapis</artifactId>
          <version>3.10</version>
          <configuration>
            <!-- if the used Java version is too new,
                don't fail, just do nothing:  -->
            <failOnUnsupportedJava>false</failOnUnsupportedJava>
            <bundledSignatures>
              <!-- Choose the right signatures based on 'maven.compiler.target': -->
              <bundledSignature>jdk-unsafe</bundledSignature>
              <bundledSignature>jdk-deprecated</bundledSignature>
              <!-- start 2.1 -->
              <bundledSignature>jdk-internal</bundledSignature>
              <bundledSignature>jdk-non-portable</bundledSignature>
              <!-- end 2.1 -->
              <bundledSignature>jdk-system-out</bundledSignature>
              <bundledSignature>jdk-reflection</bundledSignature>
            </bundledSignatures>
          </configuration>
          <executions>
            <execution>
              <goals>
                <goal>check</goal>
                <goal>testCheck</goal>
              </goals>
            </execution>
          </executions>
        </plugin>
        <plugin>
          <groupId>org.sonatype.central</groupId>
          <artifactId>central-publishing-maven-plugin</artifactId>
          <version>0.11.0</version>
          <extensions>true</extensions>
          <configuration>
            <publishingServerId>central</publishingServerId>
            <autoPublish>true</autoPublish>
          </configuration>
        </plugin>
      </plugins>
    </pluginManagement>

    <plugins>
      <!-- Enforce the minimum requirements documented in the README (lifecycle: validate) -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <executions>
          <execution>
            <id>enforce-versions</id>
            <goals>
              <goal>enforce</goal>
            </goals>
            <configuration>
              <rules>
                <requireMavenVersion>
                  <version>[3.8.2,)</version>
                </requireMavenVersion>
                <requireJavaVersion>
                  <version>[17,)</version>
                </requireJavaVersion>
                <banDuplicatePomDependencyVersions />
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <!-- Compile as Java 17 code (lifecycle: compile) -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <configuration>
          <!-- fork needs to be false to compile JAXB resources. Otherwise
            the problem with the forward slash in package-info.java on Windows occurs! -->
          <fork>false</fork>
          <showWarnings>true</showWarnings>
          <showDeprecation>true</showDeprecation>
          <encoding>${project.build.sourceEncoding}</encoding>
          <!-- "release" takes precedence over "source" and "target"; those stay for forbiddenapis -->
          <release>${java.version}</release>
          <source>${java.version}</source>
          <target>${java.version}</target>
        </configuration>
      </plugin>
      <!-- Build JAR file from source (lifecycle: package) -->
      <!-- Based on: http://maven.apache.org/plugins/maven-source-plugin/usage.html -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-source-plugin</artifactId>
        <executions>
          <execution>
            <id>attach-sources</id>
            <phase>verify</phase>
            <goals>
              <goal>jar-no-fork</goal>
            </goals>
          </execution>
          <execution>
            <id>attach-test-sources</id>
            <phase>verify</phase>
            <goals>
              <goal>test-jar-no-fork</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <!-- Create JAR files -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jar-plugin</artifactId>
        <configuration>
          <archive>
            <manifest>
              <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
            </manifest>
          </archive>
        </configuration>
      </plugin>
      <!-- Create WAR files -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-war-plugin</artifactId>
        <configuration>
          <archive>
            <manifest>
              <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
            </manifest>
          </archive>
        </configuration>
      </plugin>
      <plugin>
        <groupId>com.mycila</groupId>
        <artifactId>license-maven-plugin</artifactId>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-release-plugin</artifactId>
        <configuration>
          <autoVersionSubmodules>false</autoVersionSubmodules>
          <mavenExecutorId>forked-path</mavenExecutorId>
          <useReleaseProfile>false</useReleaseProfile>
          <releaseProfiles>release</releaseProfiles>
          <goals>process-resources javadoc:jar deploy</goals>
          <!-- Custom prefix to easily skip CI -->
          <scmCommentPrefix>[maven-release-plugin] [skip ci] </scmCommentPrefix>
        </configuration>
      </plugin>
      <!-- Create build information for all artefacts -->
      <plugin>
        <groupId>com.helger.maven</groupId>
        <artifactId>ph-buildinfo-maven-plugin</artifactId>
        <executions>
          <execution>
            <goals>
              <goal>generate-buildinfo</goal>
            </goals>
          </execution>
        </executions>
        <configuration>
          <formatProperties>false</formatProperties>
          <formatXML>true</formatXML>
          <!-- Emit only an allowlist of non-sensitive system properties and environment
               variables, to avoid leaking local paths, user names or credentials (e.g.
               passed via "-D" or MAVEN_OPTS) into published artifacts -->
          <selectedSystemProperties>
            <param>java.version</param>
            <param>java.vendor</param>
            <param>java.vm.name</param>
            <param>java.vm.version</param>
            <param>os.arch</param>
            <param>os.name</param>
            <param>os.version</param>
          </selectedSystemProperties>
          <selectedEnvVars>
            <!-- Windows hardware/OS information -->
            <param>NUMBER_OF_PROCESSORS</param>
            <param>OS</param>
            <param>PROCESSOR_.*</param>
            <!-- Unix locale - frequent root cause of encoding differences -->
            <param>LANG</param>
            <param>LC_ALL</param>
            <param>LC_CTYPE</param>
            <!-- CI provenance (GitHub Actions); explicit names instead of "GITHUB_.*"
                 to never pick up a mapped GITHUB_TOKEN or runner-internal paths -->
            <param>CI</param>
            <param>GITHUB_ACTIONS</param>
            <param>GITHUB_REPOSITORY</param>
            <param>GITHUB_WORKFLOW</param>
            <param>GITHUB_RUN_ID</param>
            <param>GITHUB_RUN_NUMBER</param>
            <param>GITHUB_SHA</param>
            <param>GITHUB_REF_NAME</param>
            <param>RUNNER_OS</param>
            <param>RUNNER_ARCH</param>
            <param>ImageOS</param>
            <param>ImageVersion</param>
          </selectedEnvVars>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-site-plugin</artifactId>
        <configuration>
          <generateSitemap>true</generateSitemap>
        </configuration>
      </plugin>
      <!-- for JUnit5 only
      <plugin>
        <artifactId>maven-surefire-plugin</artifactId>
        <dependencies>
          <dependency>
            <groupId>org.junit.platform</groupId>
            <artifactId>junit-platform-surefire-provider</artifactId>
            <version>${junit.platform.version}</version>
          </dependency>
          <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter-engine</artifactId>
            <version>${junit.jupiter.version}</version>
          </dependency>
        </dependencies>
      </plugin>
       -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-javadoc-plugin</artifactId>
        <configuration>
          <encoding>${project.build.sourceEncoding}</encoding>
          <links>
            <link>https://docs.oracle.com/en/java/javase/17/docs/api/</link>
          </links>
          <quiet>true</quiet>
          <!--
          Circumvent the following problem when running "javadoc:javadoc" 
            when using the "bundle" packaging
                     
[ERROR] Exit code: 1 - error: [dash][dash]add-modules ALL-MODULE-PATH can only be used when compiling the unnamed module
[ERROR] error: module not found: com.helger.collection
          -->
          <source>${java.version}</source>
          <verbose>false</verbose>
          <!--
          Even though it is the default, it is e.g. required for ph-annotations
          
          Source: https://stackoverflow.com/questions/37958104/maven-javadoc-no-source-files-for-package 
          -->
          <sourcepath>src/main/java</sourcepath>
        </configuration>
      </plugin>
      <!-- SBOM creation -->
      <plugin>
        <groupId>org.cyclonedx</groupId>
        <artifactId>cyclonedx-maven-plugin</artifactId>
        <version>2.9.2</version>
        <executions>
          <!--
          <execution>
            <id>aggregate</id>
            <inherited>false</inherited>
            <phase>package</phase>
            <goals>
              <goal>makeAggregateBom</goal>
            </goals>
          </execution>
          -->
          <execution>
            <id>embed-bom</id>
            <phase>prepare-package</phase>
            <goals>
              <goal>makeBom</goal>
            </goals>
            <configuration>
              <outputDirectory>${project.build.outputDirectory}/META-INF/sbom</outputDirectory>
              <skipAttach>true</skipAttach>
              <outputFormat>xml</outputFormat>
            </configuration>
          </execution>          
        </executions>
        <configuration>
          <!-- Pin the CycloneDX spec version so it doesn't silently move with plugin upgrades -->
          <schemaVersion>1.6</schemaVersion>
      
          <!-- Default for the parent. Override to "application" in child modules that build deployable apps -->
          <projectType>library</projectType>
      
          <outputFormat>xml</outputFormat>
          <outputName>bom</outputName>
      
          <!-- Traceability -->
          <includeBomSerialNumber>true</includeBomSerialNumber>
          <outputReactorProjects>true</outputReactorProjects>
      
          <!-- Scopes: include everything that ends up on the runtime classpath -->
          <includeCompileScope>true</includeCompileScope>
          <includeProvidedScope>true</includeProvidedScope>
          <includeRuntimeScope>true</includeRuntimeScope>
          <includeSystemScope>true</includeSystemScope>
          <includeTestScope>false</includeTestScope>
      
          <!-- Keep SBOM compact; flip to true only if legal review requires embedded license texts -->
          <includeLicenseText>false</includeLicenseText>
      
          <!-- Don't skip any modules for Maven releases -->
          <skipNotDeployed>false</skipNotDeployed>
      
          <!-- Detect runtime-only / classpath-bound dependencies the analyzer can't see by bytecode scan -->
          <detectUnusedForOptionalScope>true</detectUnusedForOptionalScope>
        </configuration>
      </plugin>
    </plugins>
  </build>
  
  <reporting>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-project-info-reports-plugin</artifactId>
        <!-- As suggested in https://maven.apache.org/plugins/maven-site-plugin/maven-3.html -->
        <!-- 
        <configuration>
          <dependencyDetailsEnabled>false</dependencyDetailsEnabled>
          <dependencyLocationsEnabled>false</dependencyLocationsEnabled>
        </configuration>
           -->
        <reportSets>
          <reportSet>
            <reports>
              <report>index</report>
              <report>ci-management</report>
              <report>dependencies</report>
              <report>dependency-convergence</report>
              <report>dependency-info</report>
              <report>dependency-management</report>
              <report>distribution-management</report>
              <report>issue-management</report>
              <report>licenses</report>
              <report>mailing-lists</report>
              <report>modules</report>
              <report>plugin-management</report>
              <report>plugins</report>
              <report>scm</report>
              <report>summary</report>
              <report>team</report>
            </reports>
          </reportSet>
        </reportSets>
      </plugin>
      <!-- JavaDOC report -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-javadoc-plugin</artifactId>
        <!--
        Leave out the aggregated report:
        
[ERROR] Creating an aggregated report for both named and unnamed modules is not possible.
[ERROR] Ensure that every module has a module descriptor or is a jar with a MANIFEST.MF containing an Automatic-Module-Name.
        -->
        <reportSets>
          <reportSet>
            <reports>
              <report>javadoc</report>
              <report>test-javadoc</report>
            </reports>
          </reportSet>
        </reportSets>
      </plugin>
      <!-- JXR source cross reference report -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jxr-plugin</artifactId>
        <configuration>
          <inputEncoding>${project.build.sourceEncoding}</inputEncoding>
        </configuration>
      </plugin>
      <!-- Unittest result report -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-report-plugin</artifactId>
        <configuration>
          <aggregate>true</aggregate>
        </configuration>
      </plugin>
      <!-- Generates TODO list for the project -->
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>taglist-maven-plugin</artifactId>
        <configuration>
          <tagListOptions>
            <tagClasses>
              <tagClass>
                <displayName>Todo Work</displayName>
                <tags>
                  <tag>
                    <matchString>TODO</matchString>
                    <matchType>exact</matchType>
                  </tag>
                  <tag>
                    <matchString>FIXME</matchString>
                    <matchType>exact</matchType>
                  </tag>
                  <tag>
                    <matchString>@todo</matchString>
                    <matchType>ignoreCase</matchType>
                  </tag>
                </tags>
              </tagClass>  
              <tagClass>
                <displayName>Deprecation</displayName>
                <tags>
                  <tag>
                    <matchString>@deprecated</matchString>
                    <matchType>ignoreCase</matchType>
                  </tag>
                </tags>
              </tagClass>
            </tagClasses>
          </tagListOptions>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-pmd-plugin</artifactId>
        <configuration>
          <linkXRef>true</linkXRef>
          <minimumTokens>30</minimumTokens>
          <targetJdk>${maven.compiler.source}</targetJdk>
        </configuration>
      </plugin>
      <!-- Generate a FindBugs report. May require the environment variable 
           MAVEN_OPTS=-Xmx512M to be set -->
      <plugin>
        <groupId>com.github.spotbugs</groupId>
        <artifactId>spotbugs-maven-plugin</artifactId>
        <configuration>
          <effort>Max</effort>
        </configuration>
      </plugin>
      <!-- For plugins -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-plugin-plugin</artifactId>
      </plugin>
      <plugin>
        <groupId>org.owasp</groupId>
        <artifactId>dependency-check-maven</artifactId>
        <reportSets>
          <reportSet>
            <reports>
              <report>aggregate</report>
            </reports>
          </reportSet>
        </reportSets>
      </plugin>      
    </plugins>
  </reporting>
</project>
