pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>4.1.1</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <groupId>de.uni_passau.fim.se2</groupId>
    <artifactId>scratchlog</artifactId>
    <version>1.1.0</version>
    <name>ScratchLog</name>

    <properties>
        <!-- Compiler and Source settings -->
        <java.version>21</java.version>
        <maven.compiler.release>${java.version}</maven.compiler.release>
        <!--
            Annotation processing is off by default from JDK 23 onward. Without this, Lombok silently does not run
            on a newer JDK and the build fails with hundreds of misleading "cannot find symbol" errors.
        -->
        <maven.compiler.proc>full</maven.compiler.proc>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

        <!-- Library versions -->
        <bouncycastle.version>1.86</bouncycastle.version>
        <checkstyle.version>14.1.0</checkstyle.version>
        <codec.version>1.22.1</codec.version>
        <commonmark.version>0.30.0</commonmark.version>
        <glassfish-jaxb.version>4.0.9</glassfish-jaxb.version>
        <h2.version>2.3.232</h2.version>
        <jacoco.version>0.8.15</jacoco.version>
        <!-- Clean-suite baseline (2026-08-13): 81.77% line, 71.02% branch. -->
        <!-- Initial coverage floor; raise these values as coverage improves. -->
        <jacoco.minimum.line.coverage>0.50</jacoco.minimum.line.coverage>
        <jacoco.minimum.branch.coverage>0.30</jacoco.minimum.branch.coverage>
        <jakarta.validation.version>3.1.1</jakarta.validation.version>
        <jaxb.version>4.0.5</jaxb.version>
        <json.version>20260814</json.version>
        <!-- check https://gitlab.infosun.fim.uni-passau.de/se2/litterbox/-/packages/ for available versions -->
        <litterbox.version>1.12</litterbox.version>
        <lombok.version>1.18.48</lombok.version>
        <maven.checkstyle.version>3.6.0</maven.checkstyle.version>
        <maven.surefire.version>3.6.0</maven.surefire.version>
        <mockito-inline.version>5.2.0</mockito-inline.version>
        <mockito.version>5.23.0</mockito.version>
        <mycila.version>4.2</mycila.version>
        <opencsv.version>5.12.0</opencsv.version>
        <passay.version>2.0.0</passay.version>
        <findsecbugs.version>1.14.0</findsecbugs.version>
        <spotbugs.version>4.10.4</spotbugs.version>
        <spotbugs.maven.version>4.10.4.1</spotbugs.maven.version>
        <maven.pmd.version>3.28.0</maven.pmd.version>
        <pmd.version>7.27.0</pmd.version>

        <!-- webjars versions -->
        <!-- might have to deploy new versions on https://www.webjars.org/ first when updating -->
        <webjars.locator.version>1.1.5</webjars.locator.version>
        <webjars.bootstrap.version>5.3.8</webjars.bootstrap.version>
        <webjars.chartjs.version>4.5.1</webjars.chartjs.version>
        <webjars.chartjs-plugin-zoom.version>2.2.0</webjars.chartjs-plugin-zoom.version>
        <webjars.fontawesome.version>7.3.0</webjars.fontawesome.version>
        <webjars.jquery.version>4.0.0</webjars.jquery.version>
        <webjars.nouislider.version>15.8.1</webjars.nouislider.version>
        <webjars.simplemde.version>1.11.2</webjars.simplemde.version>
        <webjars.tom-select.version>2.6.2</webjars.tom-select.version>
    </properties>

    <dependencies>
        <!-- Spring -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-tomcat</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-mail</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-validation</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.session</groupId>
            <artifactId>spring-session-jdbc</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
            <exclusions>
                <exclusion>
                    <groupId>com.vaadin.external.google</groupId>
                    <artifactId>android-json</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webmvc-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-flyway-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security-test</artifactId>
            <scope>test</scope>
        </dependency>

        <!-- Spring Security dependency needed because of security extension below. -->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core</artifactId>
            <scope>compile</scope>
        </dependency>

        <!-- Spring Security for SAML authentication. -->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-saml2-service-provider</artifactId>
            <scope>compile</scope>
        </dependency>

        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>

        <!-- Spring Security Dialect with Thymeleaf -->
        <dependency>
            <groupId>org.thymeleaf.extras</groupId>
            <artifactId>thymeleaf-extras-springsecurity6</artifactId>
        </dependency>

        <!-- Lombok for automatic method generation -->
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <version>${lombok.version}</version>
        </dependency>

        <!-- Flyway for database version management -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-flyway</artifactId>
        </dependency>
        <dependency>
            <groupId>org.flywaydb</groupId>
            <artifactId>flyway-mysql</artifactId>
        </dependency>

        <!-- webjars for UI JavaScript dependencies -->
        <dependency>
            <groupId>org.webjars</groupId>
            <artifactId>webjars-locator-lite</artifactId>
            <version>${webjars.locator.version}</version>
        </dependency>
        <dependency>
            <groupId>org.webjars</groupId>
            <artifactId>bootstrap</artifactId>
            <version>${webjars.bootstrap.version}</version>
        </dependency>
        <dependency>
            <groupId>org.webjars</groupId>
            <artifactId>jquery</artifactId>
            <version>${webjars.jquery.version}</version>
        </dependency>
        <dependency>
            <groupId>org.webjars</groupId>
            <artifactId>font-awesome</artifactId>
            <version>${webjars.fontawesome.version}</version>
        </dependency>
        <dependency>
            <groupId>org.webjars.npm</groupId>
            <artifactId>chart.js</artifactId>
            <version>${webjars.chartjs.version}</version>
        </dependency>
        <dependency>
            <groupId>org.webjars.npm</groupId>
            <artifactId>chartjs-plugin-zoom</artifactId>
            <version>${webjars.chartjs-plugin-zoom.version}</version>
        </dependency>
        <dependency>
            <groupId>org.webjars.npm</groupId>
            <artifactId>nouislider</artifactId>
            <version>${webjars.nouislider.version}</version>
        </dependency>
        <dependency>
            <groupId>org.webjars.npm</groupId>
            <artifactId>simplemde</artifactId>
            <version>${webjars.simplemde.version}</version>
        </dependency>
        <dependency>
            <groupId>org.webjars.npm</groupId>
            <artifactId>tom-select</artifactId>
            <version>${webjars.tom-select.version}</version>
        </dependency>

        <!-- Jackson for parsing JSON to DTOs -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
        </dependency>
        <!-- For parsing DateTime properties -->
        <dependency>
            <groupId>com.fasterxml.jackson.datatype</groupId>
            <artifactId>jackson-datatype-jsr310</artifactId>
        </dependency>

        <!-- Used in SAML2Configuration -->
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcpkix-jdk18on</artifactId>
            <version>${bouncycastle.version}</version>
        </dependency>

        <!-- Needed for Spring with SAML2 -->
        <dependency>
            <groupId>commons-codec</groupId>
            <artifactId>commons-codec</artifactId>
            <version>${codec.version}</version>
        </dependency>

        <!-- MariaDB connector -->
        <dependency>
            <groupId>org.mariadb.jdbc</groupId>
            <artifactId>mariadb-java-client</artifactId>
            <version>3.5.10</version>
        </dependency>

        <!-- Annotations for entities -->
        <dependency>
            <groupId>jakarta.validation</groupId>
            <artifactId>jakarta.validation-api</artifactId>
            <version>${jakarta.validation.version}</version>
        </dependency>


        <!-- JSON -->
        <dependency>
            <groupId>org.json</groupId>
            <artifactId>json</artifactId>
            <version>${json.version}</version>
        </dependency>

        <!-- Markdown -->
        <dependency>
            <groupId>org.commonmark</groupId>
            <artifactId>commonmark</artifactId>
            <version>${commonmark.version}</version>
        </dependency>


        <!-- CSV Files -->
        <dependency>
            <groupId>com.opencsv</groupId>
            <artifactId>opencsv</artifactId>
            <version>${opencsv.version}</version>
        </dependency>

        <!-- Generate passwords complying with rules -->
        <dependency>
            <groupId>org.passay</groupId>
            <artifactId>passay</artifactId>
            <version>${passay.version}</version>
        </dependency>

        <!-- API, java.xml.bind module no longer contained in JDK since Java 11 -->
        <dependency>
            <groupId>jakarta.xml.bind</groupId>
            <artifactId>jakarta.xml.bind-api</artifactId>
            <version>${jaxb.version}</version>
        </dependency>

        <!-- Runtime, com.sun.xml.bind module no longer contained in JDK since Java 11 -->
        <dependency>
            <groupId>org.glassfish.jaxb</groupId>
            <artifactId>jaxb-runtime</artifactId>
            <version>${glassfish-jaxb.version}</version>
        </dependency>

        <!-- LitterBox for analyzing Scratch projects -->
        <dependency>
            <groupId>de.uni_passau.fim.se2</groupId>
            <artifactId>Litterbox</artifactId>
            <version>${litterbox.version}</version>
        </dependency>

        <!-- JUnit 5 -->
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>com.squareup.okhttp3</groupId>
            <artifactId>mockwebserver3</artifactId>
            <version>5.5.0</version>
            <scope>test</scope>
        </dependency>

        <!-- Mockito 3 -->
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-inline</artifactId>
            <version>${mockito-inline.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-junit-jupiter</artifactId>
            <version>${mockito.version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>1.21.4</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>mariadb</artifactId>
            <version>1.21.4</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.6.3</version>
                <executions>
                    <execution>
                        <id>enforce-maven</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requireMavenVersion>
                                    <version>3.6.3</version>
                                </requireMavenVersion>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <mainClass>de.uni_passau.fim.se2.scratchlog.ScratchLogApplication</mainClass>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>repackage</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>com.mycila</groupId>
                <artifactId>license-maven-plugin</artifactId>
                <version>5.1.2</version>
                <configuration>
                    <properties>
                        <year>2021-2026</year>
                    </properties>
                    <headerDefinitions>${project.basedir}/scripts/header-defs.xml</headerDefinitions>
                    <licenseSets>
                        <licenseSet>
                            <header>src/etc/header.txt</header>
                            <basedir>src/</basedir>
                            <excludes>
                                <exclude>main/resources/**</exclude>
                                <exclude>test/resources/**</exclude>
                            </excludes>
                        </licenseSet>
                    </licenseSets>
                    <mapping>
                        <java>SLASHSTAR_STYLE</java>
                    </mapping>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- Checkstyle -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>${maven.checkstyle.version}</version>
                <dependencies>
                    <dependency>
                        <groupId>com.puppycrawl.tools</groupId>
                        <artifactId>checkstyle</artifactId>
                        <version>${checkstyle.version}</version>
                    </dependency>
                </dependencies>
                <configuration>
                    <configLocation>checkstyle.xml</configLocation>
                    <excludes>de.uni_passau.fim.se2.scratchlog.ScratchLogApplication</excludes>
                </configuration>
            </plugin>

            <!-- SpotBugs (with FindSecBugs); the check runs as part of "mvn verify" -->
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>${spotbugs.maven.version}</version>
                <dependencies>
                    <dependency>
                        <groupId>com.github.spotbugs</groupId>
                        <artifactId>spotbugs</artifactId>
                        <version>${spotbugs.version}</version>
                    </dependency>
                </dependencies>
                <configuration>
                    <effort>Max</effort>
                    <threshold>Medium</threshold>
                    <xmlOutput>true</xmlOutput>
                    <excludeFilterFile>spotbugs-exclude.xml</excludeFilterFile>
                    <plugins>
                        <plugin>
                            <groupId>com.h3xstream.findsecbugs</groupId>
                            <artifactId>findsecbugs-plugin</artifactId>
                            <version>${findsecbugs.version}</version>
                        </plugin>
                    </plugins>
                </configuration>
                <executions>
                    <execution>
                        <id>spotbugs-check</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- PMD; the check runs as part of "mvn verify" -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <version>${maven.pmd.version}</version>
                <dependencies>
                    <dependency>
                        <groupId>net.sourceforge.pmd</groupId>
                        <artifactId>pmd-java</artifactId>
                        <version>${pmd.version}</version>
                    </dependency>
                    <dependency>
                        <groupId>net.sourceforge.pmd</groupId>
                        <artifactId>pmd-core</artifactId>
                        <version>${pmd.version}</version>
                    </dependency>
                </dependencies>
                <configuration>
                    <rulesets>
                        <ruleset>pmd-ruleset.xml</ruleset>
                    </rulesets>
                    <targetJdk>${java.version}</targetJdk>
                    <printFailingErrors>true</printFailingErrors>
                    <linkXRef>false</linkXRef>
                </configuration>
                <executions>
                    <execution>
                        <id>pmd-check</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- JUnit 5 Tests -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>${maven.surefire.version}</version>
                <configuration>
                    <includes>**/*.java</includes>
                </configuration>
            </plugin>

            <!-- JaCoCo Test report -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>${jacoco.version}</version>
                <executions>
                    <execution>
                        <id>pre-unit-test</id>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>post-unit-test</id>
                        <phase>test</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>coverage-check</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <rule>
                                    <element>BUNDLE</element>
                                    <limits>
                                        <limit>
                                            <counter>LINE</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>${jacoco.minimum.line.coverage}</minimum>
                                        </limit>
                                        <limit>
                                            <counter>BRANCH</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>${jacoco.minimum.branch.coverage}</minimum>
                                        </limit>
                                    </limits>
                                </rule>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <repositories>
        <repository>
            <id>central</id>
            <url>https://repo1.maven.org/maven2</url>
        </repository>
        <!-- Repository for downloading opensaml-saml-api, a dependency of spring security saml2 service provider -->
        <repository>
            <id>shibboleth_repository</id>
            <name>Shibboleth Maven Repository</name>
            <url>https://build.shibboleth.net/nexus/content/repositories/releases/</url>
        </repository>

        <!-- Repository for downloading LitterBox -->
        <repository>
            <id>gitlab-se2</id>
            <url>https://gitlab.infosun.fim.uni-passau.de/api/v4/groups/275/-/packages/maven</url>
        </repository>
    </repositories>
</project>