pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
The MIT License

Copyright (c) 2019, CloudBees, Inc.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <parent>
    <groupId>org.jenkins-ci.main</groupId>
    <artifactId>jenkins-parent</artifactId>
    <version>${revision}${changelist}</version>
  </parent>

  <artifactId>jenkins-bom</artifactId>
  <packaging>pom</packaging>

  <name>Jenkins BOM</name>
  <description>The module contains dependencies that are used by a specific Jenkins version</description>

  <properties>
    <asm.version>9.3</asm.version>
    <slf4jVersion>1.7.36</slf4jVersion>
    <stapler.version>1711.1713.vc400cfb_5597a_</stapler.version>
    <groovy.version>2.4.21</groovy.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>com.google.inject</groupId>
        <artifactId>guice-bom</artifactId>
        <version>5.0.1</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-framework-bom</artifactId>
        <version>5.3.22</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <!-- https://docs.spring.io/spring-security/site/docs/5.5.4/reference/html5/#getting-maven-no-boot -->
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-bom</artifactId>
        <version>5.7.2</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>antlr</groupId>
        <artifactId>antlr</artifactId>
        <version>2.7.7</version>
      </dependency>
      <dependency>
        <!-- JENKINS-21160: Remoting also depends on args4j; please update accordingly -->
        <groupId>args4j</groupId>
        <artifactId>args4j</artifactId>
        <version>2.33</version>
      </dependency>
      <dependency>
        <groupId>com.github.spotbugs</groupId>
        <artifactId>spotbugs-annotations</artifactId>
        <version>${spotbugs-annotations.version}</version>
      </dependency>
      <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>31.1-jre</version>
      </dependency>
      <dependency>
        <!-- Overriding Stapler’s 1.1.3 version to diagnose JENKINS-20618: -->
        <groupId>com.jcraft</groupId>
        <artifactId>jzlib</artifactId>
        <version>1.1.3-kohsuke-1</version>
      </dependency>
      <dependency>
        <groupId>com.sun.solaris</groupId>
        <artifactId>embedded_su4j</artifactId>
        <version>1.1</version>
      </dependency>
      <dependency>
        <groupId>com.sun.xml.txw2</groupId>
        <artifactId>txw2</artifactId>
        <version>20110809</version>
      </dependency>
      <dependency>
        <groupId>com.thoughtworks.xstream</groupId>
        <artifactId>xstream</artifactId>
        <version>1.4.19</version>
      </dependency>
      <dependency>
        <groupId>commons-beanutils</groupId>
        <artifactId>commons-beanutils</artifactId>
        <version>1.9.4</version>
      </dependency>
      <dependency>
        <groupId>commons-codec</groupId>
        <artifactId>commons-codec</artifactId>
        <version>1.15</version>
      </dependency>
      <dependency>
        <groupId>commons-collections</groupId>
        <artifactId>commons-collections</artifactId>
        <version>3.2.2</version>
      </dependency>
      <dependency>
        <groupId>commons-fileupload</groupId>
        <artifactId>commons-fileupload</artifactId>
        <version>1.4</version>
      </dependency>
      <dependency>
        <groupId>commons-httpclient</groupId>
        <artifactId>commons-httpclient</artifactId>
        <version>3.1-jenkins-3</version>
      </dependency>
      <dependency>
        <groupId>commons-io</groupId>
        <artifactId>commons-io</artifactId>
        <version>2.11.0</version>
      </dependency>
      <dependency>
        <groupId>commons-jelly</groupId>
        <artifactId>commons-jelly-tags-fmt</artifactId>
        <version>1.0</version>
      </dependency>
      <dependency>
        <groupId>commons-jelly</groupId>
        <artifactId>commons-jelly-tags-xml</artifactId>
        <version>1.1</version>
      </dependency>
      <dependency>
        <groupId>commons-lang</groupId>
        <artifactId>commons-lang</artifactId>
        <version>2.6</version>
      </dependency>
      <dependency>
        <groupId>io.jenkins.stapler</groupId>
        <artifactId>jenkins-stapler-support</artifactId>
        <version>1.1</version>
      </dependency>
      <dependency>
        <groupId>jakarta.servlet.jsp.jstl</groupId>
        <artifactId>jakarta.servlet.jsp.jstl-api</artifactId>
        <version>1.2.7</version>
      </dependency>
      <dependency>
        <groupId>jaxen</groupId>
        <artifactId>jaxen</artifactId>
        <version>1.2.0</version>
      </dependency>
      <dependency>
        <groupId>net.java.dev.jna</groupId>
        <artifactId>jna</artifactId>
        <version>5.12.1</version>
      </dependency>
      <dependency>
        <groupId>net.java.sezpoz</groupId>
        <artifactId>sezpoz</artifactId>
        <version>1.13</version>
      </dependency>
      <dependency>
        <groupId>net.jcip</groupId>
        <artifactId>jcip-annotations</artifactId>
        <version>1.0</version>
      </dependency>
      <dependency>
        <groupId>net.sf.kxml</groupId>
        <artifactId>kxml2</artifactId>
        <version>2.3.0</version>
      </dependency>
      <dependency>
        <groupId>org.apache.ant</groupId>
        <artifactId>ant</artifactId>
        <version>1.10.12</version>
      </dependency>
      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-compress</artifactId>
        <version>1.21</version>
      </dependency>
      <dependency>
        <groupId>org.codehaus.groovy</groupId>
        <artifactId>groovy-all</artifactId>
        <version>${groovy.version}</version>
      </dependency>
      <dependency>
        <groupId>org.connectbot.jbcrypt</groupId>
        <artifactId>jbcrypt</artifactId>
        <version>1.0.0</version>
      </dependency>
      <dependency>
        <!-- Groovy shell uses this, but it doesn't declare the dependency -->
        <groupId>org.fusesource.jansi</groupId>
        <artifactId>jansi</artifactId>
        <version>1.11</version>
      </dependency>
      <dependency>
        <groupId>org.jenkins-ci</groupId>
        <artifactId>annotation-indexer</artifactId>
        <version>1.16</version>
      </dependency>
      <dependency>
        <groupId>org.jenkins-ci</groupId>
        <artifactId>commons-jexl</artifactId>
        <version>1.1-jenkins-20111212</version>
      </dependency>
      <dependency>
        <groupId>org.jenkins-ci</groupId>
        <artifactId>crypto-util</artifactId>
        <version>1.7</version>
      </dependency>
      <dependency>
        <groupId>org.jenkins-ci</groupId>
        <artifactId>memory-monitor</artifactId>
        <version>1.11</version>
      </dependency>
      <dependency>
        <groupId>org.jenkins-ci</groupId>
        <artifactId>symbol-annotation</artifactId>
        <version>1.23</version>
      </dependency>
      <dependency>
        <groupId>org.jenkins-ci</groupId>
        <artifactId>task-reactor</artifactId>
        <version>1.7</version>
      </dependency>
      <dependency>
        <groupId>org.jenkins-ci</groupId>
        <artifactId>version-number</artifactId>
        <version>1.10</version>
      </dependency>
      <dependency>
        <groupId>org.jenkins-ci.main</groupId>
        <artifactId>remoting</artifactId>
        <version>${remoting.version}</version>
      </dependency>
      <dependency>
        <groupId>org.jfree</groupId>
        <artifactId>jfreechart</artifactId>
        <version>1.0.19</version>
      </dependency>
      <dependency>
        <groupId>org.jvnet.hudson</groupId>
        <artifactId>commons-jelly-tags-define</artifactId>
        <version>1.0.1-hudson-20071021</version>
      </dependency>
      <dependency>
        <groupId>org.jvnet.localizer</groupId>
        <artifactId>localizer</artifactId>
        <version>1.31</version>
      </dependency>
      <dependency>
        <groupId>org.jvnet.robust-http-client</groupId>
        <artifactId>robust-http-client</artifactId>
        <version>1.2</version>
      </dependency>
      <dependency>
        <groupId>org.jvnet.winp</groupId>
        <artifactId>winp</artifactId>
        <version>1.28</version>
      </dependency>
      <dependency>
        <groupId>org.kohsuke</groupId>
        <artifactId>access-modifier-annotation</artifactId>
        <version>${access-modifier.version}</version>
      </dependency>
      <dependency>
        <groupId>org.kohsuke</groupId>
        <artifactId>windows-package-checker</artifactId>
        <version>1.2</version>
      </dependency>
      <dependency>
        <groupId>org.kohsuke.jinterop</groupId>
        <artifactId>j-interop</artifactId>
        <version>2.0.8-kohsuke-1</version>
      </dependency>
      <dependency>
        <groupId>org.kohsuke.metainf-services</groupId>
        <artifactId>metainf-services</artifactId>
        <version>1.9</version>
      </dependency>
      <dependency>
        <groupId>org.kohsuke.stapler</groupId>
        <artifactId>json-lib</artifactId>
        <version>2.4-jenkins-3</version>
      </dependency>
      <dependency>
        <groupId>org.kohsuke.stapler</groupId>
        <artifactId>stapler</artifactId>
        <version>${stapler.version}</version>
      </dependency>
      <dependency>
        <groupId>org.kohsuke.stapler</groupId>
        <artifactId>stapler-adjunct-codemirror</artifactId>
        <version>1.3</version>
      </dependency>
      <dependency>
        <groupId>org.kohsuke.stapler</groupId>
        <artifactId>stapler-adjunct-timeline</artifactId>
        <version>1.5</version>
      </dependency>
      <dependency>
        <groupId>org.kohsuke.stapler</groupId>
        <artifactId>stapler-groovy</artifactId>
        <version>${stapler.version}</version>
      </dependency>
      <dependency>
        <groupId>org.ow2.asm</groupId>
        <artifactId>asm</artifactId>
        <version>${asm.version}</version>
      </dependency>
      <dependency>
        <groupId>org.ow2.asm</groupId>
        <artifactId>asm-analysis</artifactId>
        <version>${asm.version}</version>
      </dependency>
      <dependency>
        <groupId>org.ow2.asm</groupId>
        <artifactId>asm-commons</artifactId>
        <version>${asm.version}</version>
      </dependency>
      <dependency>
        <groupId>org.ow2.asm</groupId>
        <artifactId>asm-tree</artifactId>
        <version>${asm.version}</version>
      </dependency>
      <dependency>
        <groupId>org.ow2.asm</groupId>
        <artifactId>asm-util</artifactId>
        <version>${asm.version}</version>
      </dependency>
      <dependency>
        <groupId>org.samba.jcifs</groupId>
        <artifactId>jcifs</artifactId>
        <version>1.3.18-kohsuke-1</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>jcl-over-slf4j</artifactId>
        <version>${slf4jVersion}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>log4j-over-slf4j</artifactId>
        <version>${slf4jVersion}</version>
      </dependency>
      <dependency>
        <!-- SLF4J used in maven-plugin and possibly others -->
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-api</artifactId>
        <version>${slf4jVersion}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-jdk14</artifactId>
        <version>${slf4jVersion}</version>
      </dependency>
      <dependency>
        <!-- provided by jcl-over-slf4j -->
        <groupId>commons-logging</groupId>
        <artifactId>commons-logging</artifactId>
        <version>1.2</version>
        <scope>provided</scope>
      </dependency>
      <dependency>
        <!--  make sure these old servlet versions are never used by us or by any plugins which end up depending on this version -->
        <!--  plugin-pom tries to fudge servlet support to be compatible with cores < 2.0 and JTH which needs 3.x for jetty, and ends up causing issues with some IDEs -->
        <groupId>javax.servlet</groupId>
        <!-- the old artifactID for the servlet API -->
        <artifactId>servlet-api</artifactId>
        <version>[0]</version>
        <!--
              "[0]" is a range that must be exactly 0
              this is different to "0" which is hint to use version 0.
              therefore unless anyone else uses ranges (they should not) this version will always win
              We have deployed a version 0 to jenkins repo which has an empty jar
              This prevents conflicts between the old Servlet API and the new Servlet API as the groupIDs have changed
              see https://github.com/jenkinsci/jenkins/pull/3033/files#r141325857 for a fuller description
        -->
        <scope>provided</scope>
        <optional>true</optional>
      </dependency>
      <dependency>
        <!-- provided by log4j-over-slf4j -->
        <groupId>log4j</groupId>
        <artifactId>log4j</artifactId>
        <version>1.2.17</version>
        <scope>provided</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <build>
    <plugins>
      <!-- override the default to keep the dependencyManagement intact -->
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>flatten-maven-plugin</artifactId>
        <configuration>
          <updatePomFile>true</updatePomFile>
          <outputDirectory>${project.build.directory}</outputDirectory>
          <flattenedPomFilename>${project.artifactId}-${project.version}.pom</flattenedPomFilename>
        </configuration>
        <executions>
          <execution>
            <id>flatten</id>
            <goals>
              <goal>flatten</goal>
            </goals>
            <phase>process-resources</phase>
            <configuration>
              <flattenMode>bom</flattenMode>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

</project>