pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.broadinstitute</groupId>
  <artifactId>consent</artifactId>
  <version>1.0.1</version>
  <packaging>jar</packaging>
  <name>Consent Management Services</name>

  <properties>
    <java.version>21</java.version>
    <maven.compiler.source>21</maven.compiler.source>
    <maven.compiler.target>21</maven.compiler.target>
    <liquibase.version>4.30.0</liquibase.version>
    <dropwizard.version>4.0.11</dropwizard.version>
    <logback.version>1.5.16</logback.version>
    <pact.version>4.6.16</pact.version>
    <postgres.version>42.7.5</postgres.version>
    <surefire.version>3.5.2</surefire.version>
    <swagger.ui.version>5.18.2</swagger.ui.version>
    <swagger.ui.path>META-INF/resources/webjars/swagger-ui/${swagger.ui.version}/</swagger.ui.path>
    <mockserver.version>5.15.0</mockserver.version>
    <junit.version>5.11.4</junit.version>
    <io.grpc.version>1.58.0</io.grpc.version>
    <mockito.version>5.15.2</mockito.version>

    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
  </properties>

  <profiles>
    <profile>
      <id>all-tests</id>
      <activation>
        <activeByDefault>true</activeByDefault>
      </activation>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-surefire-plugin</artifactId>
            <version>${surefire.version}</version>
            <configuration>
              <!-- @{argLine} is necessary here so that the jacoco:prepare-agent output is included for tests -->
              <argLine>@{argLine} -Xmx1024m -XX:TieredStopAtLevel=1</argLine>
              <systemPropertyVariables>
                <pact.rootDir>target/pacts</pact.rootDir>
              </systemPropertyVariables>
              <includes>**/*.java</includes>
              <excludes>**/integration/**/*.java</excludes>
            </configuration>
            <dependencies>
              <dependency>
                <groupId>org.junit.jupiter</groupId>
                <artifactId>junit-jupiter</artifactId>
                <version>${junit.version}</version>
              </dependency>
            </dependencies>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>pact-tests</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-surefire-plugin</artifactId>
            <version>${surefire.version}</version>
            <configuration>
              <systemPropertyVariables>
                <pact.rootDir>target/pacts</pact.rootDir>
              </systemPropertyVariables>
              <includes>**/pact/**/*.java</includes>
            </configuration>
            <dependencies>
              <dependency>
                <groupId>org.junit.jupiter</groupId>
                <artifactId>junit-jupiter</artifactId>
                <version>${junit.version}</version>
              </dependency>
            </dependencies>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>integration-tests</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-surefire-plugin</artifactId>
            <version>${surefire.version}</version>
            <configuration>
              <includes>**/integration/**/*.java</includes>
            </configuration>
            <dependencies>
              <dependency>
                <groupId>org.junit.jupiter</groupId>
                <artifactId>junit-jupiter</artifactId>
                <version>${junit.version}</version>
              </dependency>
            </dependencies>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>

  <build>
    <testResources>
      <testResource>
        <directory>src/test/resources</directory>
        <filtering>true</filtering>
      </testResource>
      <testResource>
        <directory>src/main/resources</directory>
        <excludes>
          <exclude>changesets/*</exclude>
          <exclude>changelog-master.xml</exclude>
          <exclude>migrations.xml</exclude>
        </excludes>
      </testResource>
    </testResources>

    <plugins>

      <plugin>
        <groupId>org.owasp</groupId>
        <artifactId>dependency-check-maven</artifactId>
        <configuration>
          <failBuildOnCVSS>1</failBuildOnCVSS>
          <suppressionFiles>
            <suppressionFile>owaspSuppression.xml</suppressionFile>
          </suppressionFiles>
        </configuration>
        <version>12.0.1</version>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <version>3.5.0</version>
        <executions>
          <execution>
            <id>enforce-versions</id>
            <goals>
              <goal>enforce</goal>
            </goals>
            <configuration>
              <rules>
                <requireMavenVersion>
                  <version>3.5.0</version>
                </requireMavenVersion>
                <requireJavaVersion>
                  <version>{java.version}</version>
                </requireJavaVersion>
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>

      <plugin>
        <groupId>pl.project13.maven</groupId>
        <artifactId>git-commit-id-plugin</artifactId>
        <!-- 4.0.1 seems to break when formatted as json -->
        <version>4.9.10</version>
        <executions>
          <execution>
            <id>get-the-git-infos</id>
            <goals>
              <goal>revision</goal>
            </goals>
            <phase>compile</phase>
          </execution>
          <execution>
            <id>validate-the-git-infos</id>
            <goals>
              <goal>validateRevision</goal>
            </goals>
            <phase>package</phase>
          </execution>
        </executions>
        <configuration>
          <dotGitDirectory>${project.basedir}/.git</dotGitDirectory>
          <prefix>git</prefix>
          <verbose>false</verbose>
          <generateGitPropertiesFile>true</generateGitPropertiesFile>
          <generateGitPropertiesFilename>${project.build.outputDirectory}/git.properties
          </generateGitPropertiesFilename>
          <format>json</format>
          <gitDescribe>
            <skip>true</skip>
            <always>false</always>
            <dirty>-dirty</dirty>
          </gitDescribe>
        </configuration>
      </plugin>

      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>properties-maven-plugin</artifactId>
        <version>1.2.1</version>
        <executions>
          <execution>
            <id>buildClassesOutput</id>
            <phase>generate-resources</phase>
            <goals>
              <goal>write-project-properties</goal>
            </goals>
            <configuration>
              <outputFile>${project.build.outputDirectory}/mvn.properties</outputFile>
            </configuration>
          </execution>
          <!-- This second execution regenerates the full properties file in test classes -->
          <execution>
            <id>testClassesOutput</id>
            <phase>generate-resources</phase>
            <goals>
              <goal>write-project-properties</goal>
            </goals>
            <configuration>
              <outputFile>${project.build.testOutputDirectory}/mvn.properties</outputFile>
            </configuration>
          </execution>
        </executions>
      </plugin>

      <plugin>
        <groupId>org.eluder.coveralls</groupId>
        <artifactId>coveralls-maven-plugin</artifactId>
        <version>4.3.0</version>
        <!-- java 11 requirement for coveralls support-->
        <dependencies>
          <dependency>
            <groupId>javax.xml.bind</groupId>
            <artifactId>jaxb-api</artifactId>
            <version>2.3.1</version>
          </dependency>
        </dependencies>
      </plugin>

      <plugin>
        <groupId>org.jacoco</groupId>
        <artifactId>jacoco-maven-plugin</artifactId>
        <version>0.8.12</version>
        <executions>
          <execution>
            <id>prepare-agent</id>
            <goals>
              <goal>prepare-agent</goal>
            </goals>
          </execution>
          <execution>
            <id>report</id>
            <phase>test</phase>
            <goals>
              <goal>report</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>3.13.0</version>
        <configuration>
          <release>17</release>
        </configuration>
      </plugin>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-dependency-plugin</artifactId>
        <version>3.8.1</version>
        <executions>
          <execution>
            <id>copy-dependencies</id>
            <phase>compile</phase>
            <goals>
              <goal>copy-dependencies</goal>
            </goals>
            <configuration>
              <outputDirectory>${project.build.directory}/lib</outputDirectory>
              <overWriteReleases>false</overWriteReleases>
              <overWriteSnapshots>false</overWriteSnapshots>
              <overWriteIfNewer>true</overWriteIfNewer>
            </configuration>
          </execution>
        </executions>
      </plugin>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-shade-plugin</artifactId>
        <version>3.6.0</version>
        <configuration>
          <finalName>consent</finalName>
          <createDependencyReducedPom>true</createDependencyReducedPom>
          <filters>
            <filter>
              <artifact>*:*</artifact>
              <excludes>
                <exclude>about.html</exclude>
                <exclude>**/LICENSE*</exclude>
                <exclude>**/pom.properties</exclude>
                <exclude>**/pom.xml</exclude>
                <exclude>**/module-info.class</exclude>
                <exclude>META-INF/DEPENDENCIES</exclude>
                <exclude>META-INF/license</exclude>
                <exclude>META-INF/MANIFEST*</exclude>
                <exclude>META-INF/NOTICE*</exclude>
                <exclude>META-INF/*.SF</exclude>
                <exclude>META-INF/*.DSA</exclude>
                <exclude>META-INF/*.RSA</exclude>
              </excludes>
            </filter>
          </filters>
        </configuration>
        <executions>
          <execution>
            <phase>package</phase>
            <goals>
              <goal>shade</goal>
            </goals>
            <configuration>
              <transformers>
                <transformer
                  implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                  <mainClass>org.broadinstitute.consent.http.ConsentApplication</mainClass>
                </transformer>
                <transformer
                  implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
              </transformers>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.jdbi</groupId>
        <artifactId>jdbi3-bom</artifactId>
        <type>pom</type>
        <version>3.47.0</version>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <dependencies>

    <!-- json-schema-validator 1.0.83 -> 1.0.84 introduced a breaking dependency change, it now requires jackson core -->
    <dependency>
      <groupId>com.networknt</groupId>
      <artifactId>json-schema-validator</artifactId>
      <version>1.5.5</version>
    </dependency>
    <dependency>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-core</artifactId>
      <version>2.18.2</version>
    </dependency>

    <dependency>
      <groupId>net.gcardone.junidecode</groupId>
      <artifactId>junidecode</artifactId>
      <version>0.5.2</version>
    </dependency>


    <dependency>
      <groupId>org.owasp</groupId>
      <artifactId>java-file-io</artifactId>
      <version>1.0.0</version>
    </dependency>

    <dependency>
      <groupId>org.jdbi</groupId>
      <artifactId>jdbi3-core</artifactId>
    </dependency>

    <dependency>
      <groupId>org.jdbi</groupId>
      <artifactId>jdbi3-sqlobject</artifactId>
    </dependency>

    <dependency>
      <groupId>org.jdbi</groupId>
      <artifactId>jdbi3-gson2</artifactId>
    </dependency>

    <dependency>
      <groupId>org.jdbi</groupId>
      <artifactId>jdbi3-guava</artifactId>
    </dependency>

    <dependency>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-annotations</artifactId>
      <version>2.18.2</version>
    </dependency>

    <!-- https://mvnrepository.com/artifact/org.parboiled/parboiled-java -->
    <dependency>
      <groupId>org.parboiled</groupId>
      <artifactId>parboiled-java</artifactId>
      <version>1.4.1</version>
    </dependency>

    <!--
     See
     https://broadworkbench.atlassian.net/browse/DCJ-274
     org.bouncycastle:bcprov-jdk18on:jar:1.76 is vulnerable
    -->
    <dependency>
      <groupId>com.sendgrid</groupId>
      <artifactId>sendgrid-java</artifactId>
      <version>4.10.3</version>
      <exclusions>
        <exclusion>
          <groupId>org.bouncycastle</groupId>
          <artifactId>bcprov-jdk18on</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <!--
     See
     https://broadworkbench.atlassian.net/browse/DCJ-274
     org.bouncycastle:bcprov-jdk18on:jar:1.76 is vulnerable
    -->
    <dependency>
      <groupId>org.bouncycastle</groupId>
      <artifactId>bcprov-jdk18on</artifactId>
      <version>1.80</version>
    </dependency>

    <dependency>
      <groupId>org.apache.httpcomponents.client5</groupId>
      <artifactId>httpclient5</artifactId>
      <version>5.4.1</version>
    </dependency>

    <dependency>
      <groupId>com.sendgrid</groupId>
      <artifactId>java-http-client</artifactId>
      <version>4.5.1</version>
    </dependency>

    <dependency>
      <groupId>io.sentry</groupId>
      <artifactId>sentry</artifactId>
      <version>8.0.0</version>
    </dependency>

    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>slf4j-api</artifactId>
      <version>2.0.16</version>
    </dependency>

    <!-- Support for JSON logging -->
    <dependency>
      <groupId>io.dropwizard</groupId>
      <artifactId>dropwizard-json-logging</artifactId>
      <version>${dropwizard.version}</version>
    </dependency>

    <dependency>
      <groupId>io.dropwizard</groupId>
      <artifactId>dropwizard-dependencies</artifactId>
      <version>${dropwizard.version}</version>
      <type>pom</type>
      <scope>compile</scope>
    </dependency>

    <dependency>
      <groupId>io.dropwizard</groupId>
      <artifactId>dropwizard-auth</artifactId>
      <version>${dropwizard.version}</version>
    </dependency>

    <dependency>
      <groupId>io.dropwizard</groupId>
      <artifactId>dropwizard-assets</artifactId>
      <version>${dropwizard.version}</version>
    </dependency>

    <dependency>
      <groupId>io.dropwizard</groupId>
      <artifactId>dropwizard-http2</artifactId>
      <version>${dropwizard.version}</version>
      <exclusions>
        <exclusion>
          <groupId>org.eclipse.jetty.http2</groupId>
          <artifactId>http2-common</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <!-- OWASP dependency vulnerability: http2-common-11.0.16.jar 10/12/2023 -->
    <dependency>
      <groupId>org.eclipse.jetty.http2</groupId>
      <artifactId>http2-common</artifactId>
      <version>11.0.24</version>
    </dependency>

    <dependency>
      <groupId>io.dropwizard</groupId>
      <artifactId>dropwizard-client</artifactId>
      <version>${dropwizard.version}</version>
    </dependency>

    <dependency>
      <groupId>io.dropwizard</groupId>
      <artifactId>dropwizard-core</artifactId>
      <version>${dropwizard.version}</version>
    </dependency>

    <dependency>
      <groupId>io.dropwizard</groupId>
      <artifactId>dropwizard-jdbi3</artifactId>
      <version>${dropwizard.version}</version>
    </dependency>

    <dependency>
      <groupId>io.dropwizard</groupId>
      <artifactId>dropwizard-forms</artifactId>
      <version>${dropwizard.version}</version>
    </dependency>

    <!-- Security update. See https://broadworkbench.atlassian.net/browse/DUOS-2826 -->
    <!-- Logback Access module moved to new location. See https://logback.qos.ch/news.html -->
    <dependency>
        <groupId>ch.qos.logback.access</groupId>
        <artifactId>common</artifactId>
        <version>2.0.3</version>
    </dependency>
    <!-- Security update. See https://broadworkbench.atlassian.net/browse/DUOS-2826 -->
    <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-classic</artifactId>
        <version>${logback.version}</version>
    </dependency>
    <!-- Security update. See https://broadworkbench.atlassian.net/browse/DUOS-2826 -->
    <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-core</artifactId>
        <version>${logback.version}</version>
    </dependency>

    <!--suppress VulnerableLibrariesLocal -->
    <dependency>
      <groupId>au.com.dius.pact</groupId>
      <artifactId>consumer</artifactId>
      <version>${pact.version}</version>
      <!-- See comments re: CVE-2023-33953 for google-cloud-storage -->
      <exclusions>
        <exclusion>
          <groupId>io.grpc</groupId>
          <artifactId>grpc-netty</artifactId>
        </exclusion>
      </exclusions>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>au.com.dius.pact</groupId>
      <artifactId>provider</artifactId>
      <version>${pact.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>au.com.dius.pact.consumer</groupId>
      <artifactId>junit5</artifactId>
      <version>${pact.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>io.dropwizard</groupId>
      <artifactId>dropwizard-testing</artifactId>
      <version>${dropwizard.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter</artifactId>
      <version>${junit.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter-api</artifactId>
      <version>${junit.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.mockito</groupId>
      <artifactId>mockito-core</artifactId>
      <version>${mockito.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.mockito</groupId>
      <artifactId>mockito-junit-jupiter</artifactId>
      <version>${mockito.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.liquibase</groupId>
      <artifactId>liquibase-core</artifactId>
      <version>${liquibase.version}</version>
    </dependency>

    <dependency>
      <groupId>com.sun.mail</groupId>
      <artifactId>javax.mail</artifactId>
      <version>1.6.2</version>
    </dependency>

    <dependency>
      <groupId>org.freemarker</groupId>
      <artifactId>freemarker</artifactId>
      <version>2.3.34</version>
    </dependency>

    <dependency>
      <groupId>org.jsoup</groupId>
      <artifactId>jsoup</artifactId>
      <version>1.18.3</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>com.google.guava</groupId>
      <artifactId>guava</artifactId>
      <version>33.4.0-jre</version>
    </dependency>

    <dependency>
      <groupId>org.postgresql</groupId>
      <artifactId>postgresql</artifactId>
      <version>${postgres.version}</version>
    </dependency>

    <dependency>
      <groupId>org.testcontainers</groupId>
      <artifactId>postgresql</artifactId>
      <version>1.20.4</version>
      <scope>test</scope>
    </dependency>

    <!-- Required for mocking ontology and elastic search instances -->
    <dependency>
      <groupId>org.testcontainers</groupId>
      <artifactId>mockserver</artifactId>
      <version>1.20.4</version>
      <scope>test</scope>
    </dependency>


    <!-- Required for mocking client calls against ontology and elastic search -->
    <!--suppress VulnerableLibrariesLocal -->
    <dependency>
      <groupId>org.mock-server</groupId>
      <artifactId>mockserver-client-java</artifactId>
      <version>${mockserver.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>com.google.api-client</groupId>
      <artifactId>google-api-client</artifactId>
      <version>2.7.2</version>
    </dependency>

    <dependency>
      <groupId>com.google.cloud</groupId>
      <artifactId>google-cloud-storage</artifactId>
      <version>2.47.0</version>
    </dependency>

    <dependency>
      <groupId>commons-io</groupId>
      <artifactId>commons-io</artifactId>
      <version>2.18.0</version>
    </dependency>

    <dependency>
      <groupId>com.google.apis</groupId>
      <artifactId>google-api-services-oauth2</artifactId>
      <version>v2-rev20200213-2.0.0</version>
    </dependency>

    <dependency>
      <groupId>com.google.inject</groupId>
      <artifactId>guice</artifactId>
      <version>7.0.0</version>
    </dependency>

    <dependency>
      <groupId>com.google.code.gson</groupId>
      <artifactId>gson</artifactId>
      <version>2.11.0</version>
    </dependency>

    <dependency>
      <groupId>org.apache.commons</groupId>
      <artifactId>commons-collections4</artifactId>
      <version>4.4</version>
    </dependency>

    <dependency>
      <groupId>org.apache.commons</groupId>
      <artifactId>commons-lang3</artifactId>
      <version>3.17.0</version>
    </dependency>

    <dependency>
      <groupId>org.elasticsearch.client</groupId>
      <artifactId>elasticsearch-rest-client</artifactId>
      <version>8.17.1</version>
    </dependency>

    <dependency>
      <groupId>org.webjars</groupId>
      <artifactId>swagger-ui</artifactId>
      <version>${swagger.ui.version}</version>
    </dependency>

    <!-- https://mvnrepository.com/artifact/commons-validator/commons-validator -->
    <dependency>
      <groupId>commons-validator</groupId>
      <artifactId>commons-validator</artifactId>
      <version>1.9.0</version>
    </dependency>

    <!-- https://mvnrepository.com/artifact/com.cloudbees.thirdparty/zendesk-java-client -->
    <dependency>
      <groupId>com.cloudbees.thirdparty</groupId>
      <artifactId>zendesk-java-client</artifactId>
      <version>1.1.1</version>
    </dependency>

  </dependencies>

</project>