<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ The OWASP CSRFGuard Project, BSD License
  ~ Copyright (c) 2011, Eric Sheridan (eric@infraredsecurity.com)
  ~ All rights reserved.
  ~
  ~ Redistribution and use in source and binary forms, with or without
  ~ modification, are permitted provided that the following conditions are met:
  ~
  ~     1. Redistributions of source code must retain the above copyright notice,
  ~        this list of conditions and the following disclaimer.
  ~     2. Redistributions in binary form must reproduce the above copyright
  ~        notice, this list of conditions and the following disclaimer in the
  ~        documentation and/or other materials provided with the distribution.
  ~     3. Neither the name of OWASP nor the names of its contributors may be used
  ~        to endorse or promote products derived from this software without specific
  ~        prior written permission.
  ~
  ~ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  ~ AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  ~ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  ~ ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  ~ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  ~ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  ~ LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
  ~ ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  ~ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  ~ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  -->

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.owasp</groupId>
    <artifactId>csrfguard-parent</artifactId>
    <version>4.3.0</version>
    <packaging>pom</packaging>

    <name>OWASP CSRFGuard Parent POM</name>
    <description>OWASP CSRFGuard is a library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks.
    </description>
    <url>https://owasp.org/www-project-csrfguard/</url>

    <organization>
        <name>OWASP</name>
        <url>https://www.owasp.org</url>
    </organization>
    <licenses>
        <license>
            <name>BSD License</name>
            <url>https://www.opensource.org/licenses/bsd-license.php</url>
        </license>
    </licenses>
    <developers>
        <developer>
            <id>esheri3</id>
            <name>Eric Sheridan</name>
            <email>eric@infraredsecurity.com</email>
            <roles>
                <role>Project Inventor</role>
            </roles>
        </developer>
        <developer>
            <id>aramrami</id>
            <name>Azzeddine Ramrami</name>
            <email>azzeddine.ramrami@owasp.org</email>
            <roles>
                <role>Project Co-leader</role>
            </roles>
        </developer>
        <developer>
            <name>Istvan Albert-Toth</name>
            <email>istvan.alberttoth@owasp.org</email>
            <roles>
                <role>Project Co-leader</role>
                <role>Creator of major release v4.0</role>
            </roles>
        </developer>
    </developers>

    <modules>
        <module>csrfguard</module>
        <module>csrfguard-extensions</module>
        <module>csrfguard-test</module>
    </modules>

    <scm>
        <connection>scm:git:git://github.com/OWASP/www-project-csrfguard.git</connection>
        <developerConnection>scm:git:git@github.com:OWASP/www-project-csrfguard.git</developerConnection>
        <url>https://github.com/OWASP/www-project-csrfguard</url>
        <tag>4.3.0</tag>
    </scm>

    <issueManagement>
        <system>GitHub Issue Tracking</system>
        <url>https://github.com/OWASP/www-project-csrfguard/issues</url>
    </issueManagement>

    <distributionManagement>
        <snapshotRepository>
            <id>ossrh</id> <!-- Must match the serverId from the settings.xml -->
            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
        </snapshotRepository>
        <repository>
            <id>ossrh</id> <!-- Must match the serverId from the settings.xml -->
            <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
        </repository>
    </distributionManagement>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

        <java.version>1.8</java.version>

        <maven.compiler.source>${java.version}</maven.compiler.source>
        <maven.compiler.target>${java.version}</maven.compiler.target>

        <servlet-api.version>2.5</servlet-api.version>
        <jsp-api.version>2.2</jsp-api.version>
        <jstl.version>1.2</jstl.version>

        <maven-surefire-plugin.version>3.1.0</maven-surefire-plugin.version>
        <maven-jar-plugin.version>3.3.0</maven-jar-plugin.version>
        <maven-source-plugin.version>3.3.0</maven-source-plugin.version>
        <maven-compiler-plugin.version>3.11.0</maven-compiler-plugin.version>
        <maven-javadoc-plugin.version>3.5.0</maven-javadoc-plugin.version>
        <maven-war-plugin.version>3.3.2</maven-war-plugin.version>
        <maven-scm-plugin.version>2.0.1</maven-scm-plugin.version>
        <maven-release-plugin.version>3.0.0-M7</maven-release-plugin.version>
        <maven-deploy-plugin.version>3.1.1</maven-deploy-plugin.version>

        <nexus-staging-maven-plugin.version>1.6.13</nexus-staging-maven-plugin.version>
        <maven-gpg-plugin.version>3.1.0</maven-gpg-plugin.version>

        <commons-lang3.version>3.12.0</commons-lang3.version>
        <commons-io.version>2.12.0</commons-io.version>
        <gson.version>2.10.1</gson.version>
        <slf4j-api.version>2.0.6</slf4j-api.version>

        <junit.version>5.9.3</junit.version>
        <mockito.version>4.11.0</mockito.version>
        <logback.version>1.3.5</logback.version> <!--versions starting from 1.4.x were compiled with Java 11-->

        <dependency-check-maven.version>8.2.1</dependency-check-maven.version>
    </properties>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>javax.servlet</groupId>
                <artifactId>servlet-api</artifactId>
                <version>${servlet-api.version}</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>javax.servlet.jsp</groupId>
                <artifactId>jsp-api</artifactId>
                <version>${jsp-api.version}</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>javax.servlet.jsp.jstl</groupId>
                <artifactId>jstl-api</artifactId>
                <version>${jstl.version}</version>
                <scope>provided</scope>
            </dependency>

            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-lang3</artifactId>
                <version>${commons-lang3.version}</version>
            </dependency>
            <dependency>
                <groupId>commons-io</groupId>
                <artifactId>commons-io</artifactId>
                <version>${commons-io.version}</version>
            </dependency>
            <dependency>
                <groupId>com.google.code.gson</groupId>
                <artifactId>gson</artifactId>
                <version>${gson.version}</version>
            </dependency>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>${slf4j-api.version}</version>
            </dependency>

            <dependency>
                <groupId>org.junit.jupiter</groupId>
                <artifactId>junit-jupiter-api</artifactId>
                <version>${junit.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.junit.jupiter</groupId>
                <artifactId>junit-jupiter-engine</artifactId>
                <version>${junit.version}</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>org.mockito</groupId>
                <artifactId>mockito-junit-jupiter</artifactId>
                <version>${mockito.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.mockito</groupId>
                <artifactId>mockito-inline</artifactId>
                <version>${mockito.version}</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-classic</artifactId>
                <version>${logback.version}</version>
                <scope>test</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>${maven-compiler-plugin.version}</version>
                    <configuration>
                        <fork>true</fork>
                        <optimize>true</optimize>
                        <showDeprecation>true</showDeprecation>
                        <source>${java.version}</source>
                        <target>${java.version}</target>
                        <verbose>true</verbose>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-source-plugin</artifactId>
                    <version>${maven-source-plugin.version}</version>
                    <configuration>
                        <encoding>UTF-8</encoding>
                        <charset>UTF-8</charset>
                        <attach>true</attach>
                        <archive>
                            <manifest>
                                <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
                                <addDefaultSpecificationEntries>false</addDefaultSpecificationEntries>
                            </manifest>
                            <manifestEntries>
                                <Url>${project.url}</Url>
                            </manifestEntries>
                        </archive>
                    </configuration>
                    <executions>
                        <execution>
                            <id>attach-sources</id>
                            <phase>package</phase>
                            <goals>
                                <goal>jar-no-fork</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-javadoc-plugin</artifactId>
                    <version>${maven-javadoc-plugin.version}</version>
                    <executions>
                        <execution>
                            <id>javadoc-jar</id>
                            <phase>package</phase>
                            <goals>
                                <goal>jar</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-jar-plugin</artifactId>
                    <version>${maven-jar-plugin.version}</version>
                    <configuration>
                        <archive>
                            <manifest>
                                <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
                                <addDefaultSpecificationEntries>false</addDefaultSpecificationEntries>
                            </manifest>
                            <manifestEntries>
                                <Url>${project.url}</Url>
                            </manifestEntries>
                        </archive>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-war-plugin</artifactId>
                    <version>${maven-war-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-scm-plugin</artifactId>
                    <version>${maven-scm-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-release-plugin</artifactId>
                    <version>${maven-release-plugin.version}</version>
                    <configuration>
                        <autoVersionSubmodules>true</autoVersionSubmodules>
                        <localCheckout>true</localCheckout>
                        <pushChanges>false</pushChanges>
                        <mavenExecutorId>forked-path</mavenExecutorId>
                        <releaseProfiles>sign-artifacts</releaseProfiles> <!-- Activate GPG signing profile on release -->
                        <arguments>-Dgpg.passphrase=${gpg.passphrase}</arguments>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.sonatype.plugins</groupId>
                    <artifactId>nexus-staging-maven-plugin</artifactId>
                    <version>${nexus-staging-maven-plugin.version}</version>
                    <extensions>true</extensions>
                    <executions>
                        <execution>
                            <id>default-deploy</id>
                            <phase>deploy</phase>
                            <goals>
                                <goal>deploy</goal>
                            </goals>
                        </execution>
                    </executions>
                    <configuration>
                        <serverId>ossrh</serverId> <!-- Must match the serverId from the settings.xml -->
                        <nexusUrl>https://oss.sonatype.org/</nexusUrl>
                        <autoReleaseAfterClose>true</autoReleaseAfterClose>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-deploy-plugin</artifactId>
                    <version>${maven-deploy-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>${maven-surefire-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.owasp</groupId>
                    <artifactId>dependency-check-maven</artifactId>
                    <version>${dependency-check-maven.version}</version>
                    <configuration>
                        <failBuildOnCVSS>7</failBuildOnCVSS>
                    </configuration>
                </plugin>
            </plugins>
        </pluginManagement>
    </build>

    <profiles>
        <!-- GPG Signature on release -->
        <profile>
            <id>sign-artifacts</id> <!-- referred in maven-release-plugin/releaseProfiles -->
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>${maven-gpg-plugin.version}</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>dependency-check</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <executions>
                            <execution>
                                <goals>
                                    <goal>aggregate</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>
