pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
 ~  Copyright 2021 Collate
 ~  Licensed under the Apache License, Version 2.0 (the "License");
 ~  you may not use this file except in compliance with the License.
 ~  You may obtain a copy of the License at
 ~  http://www.apache.org/licenses/LICENSE-2.0
 ~  Unless required by applicable law or agreed to in writing, software
 ~  distributed under the License is distributed on an "AS IS" BASIS,
 ~  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 ~  See the License for the specific language governing permissions and
 ~  limitations under the License.
 -->

<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>org.open-metadata</groupId>
  <artifactId>platform</artifactId>
  <name>OpenMetadata-Platform</name>
  <description> is an all-in-one platform for data discovery, data lineage, data quality, observability, governance,
    and team collaboration. It is one of the fastest growing open-source projects with a vibrant community and
    adoption by a diverse set of companies in a variety of industry verticals. Powered by a centralized metadata store
    based on Open Metadata Standards/APIs, supporting connectors to a wide range of data services,
    OpenMetadata enables end-to-end metadata management, giving you the freedom to unlock the value of your data assets.
  </description>
  <version>2.0.0-SNAPSHOT</version>
  <url>https://github.com/open-metadata/OpenMetadata</url>
  <modules>
    <module>openmetadata-spec</module>
    <module>openmetadata-sdk</module>
    <module>common</module>
    <module>docker/rdf-store</module>
    <module>openmetadata-shaded-deps</module>
    <module>openmetadata-service</module>
    <module>openmetadata-k8s-operator</module>
    <module>openmetadata-integration-tests</module>
    <module>openmetadata-mcp</module>
    <module>openmetadata-ui-core-components</module>
    <module>openmetadata-ui</module>
    <module>openmetadata-dist</module>
    <module>openmetadata-clients</module>
  </modules>
  <packaging>pom</packaging>

  <licenses>
    <license>
      <name>The Apache License, Version 2.0</name>
      <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
    </license>
  </licenses>

  <scm>
    <connection>scm:git:git@github.com:Open-Metadata/OpenMetadata</connection>
    <developerConnection>scm:git:git@github.com:Open-Metadata/OpenMetadata</developerConnection>
    <url>scm:git:git@github.com:Open-Metadata/OpenMetadata</url>
  </scm>

  <developers>
    <developer>
      <name>OpenMetadata</name>
      <email>openmetadata@getcollate.io</email>
      <organization>Get Collate</organization>
      <organizationUrl>https://getcollate.io/</organizationUrl>
    </developer>
  </developers>

  <!-- distributionManagement section removed - not needed with central-publishing-maven-plugin -->

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <mockito.version>5.14.2</mockito.version>
    <!-- Upgrading slf4j causes dropwizard issues -->
    <slf4j.version>2.0.4</slf4j.version>
    <!-- 2.18.11 clears CVE-2026-89425 and CVE-2026-91777 (patch over 2.18.10). -->
    <jackson.version>2.18.11</jackson.version>
    <!-- Single source for the AWS SDK v2 BOM version, consumed by the root BOM
         import below and by openmetadata-service's BOM import. -->
    <awssdk.version>2.41.30</awssdk.version>
    <dropwizard.version>5.0.0</dropwizard.version>
    <dropwizard-jdbi3.version>5.0.0</dropwizard-jdbi3.version>
    <diffMatch.version>1.0</diffMatch.version>
    <jersey-bom.version>3.1.11</jersey-bom.version>
    <javax.ws.rs-api.version>2.1.1</javax.ws.rs-api.version>
    <!-- update from here -->
    <jakarta.servlet-api.version>6.0.0</jakarta.servlet-api.version>
    <maven-dependency-plugin.version>3.6.0</maven-dependency-plugin.version>
    <maven-jar-plugin.version>3.3.0</maven-jar-plugin.version>
    <maven-surefire.version>3.1.2</maven-surefire.version>
    <maven-javadoc-plugin.version>3.6.0</maven-javadoc-plugin.version>
    <maven-source-plugin.version>3.3.1</maven-source-plugin.version>
    <jakarta.version>3.0.2</jakarta.version>
    <jaxb.version>3.0.2</jaxb.version>
    <wiremock-standalone.version>2.15.0</wiremock-standalone.version>
    <jacoco-plugin.version>0.8.10</jacoco-plugin.version>
    <!-- Upgrading to jdbi version causes test failures-->
    <jdbi3.version>3.37.1</jdbi3.version>
    <commons-cli.version>1.9.0</commons-cli.version>
    <commons-io.version>2.17.0</commons-io.version>
    <redshift-jdbc.version>2.2.2</redshift-jdbc.version>
    <gson.version>2.13.1</gson.version>
    <mysql.connector.version>9.3.0</mysql.connector.version>
    <postgres.connector.version>42.7.12</postgres.connector.version>
    <jsonschema2pojo.version>1.3.1</jsonschema2pojo.version>
    <lombok.version>1.18.36</lombok.version>
    <tomcat-jdbc.version>11.0.11</tomcat-jdbc.version>
    <hikaricp.version>7.0.2</hikaricp.version>
    <!-- CVE-2026-15687: Directory Traversal in copyDirectoryFromPod, vulnerable [,25.0.1).
         Lives at the root because two modules consume it — openmetadata-service and
         openmetadata-integration-tests. Keep it here so a bump cannot miss one of them. -->
    <kubernetes-client.version>25.0.1</kubernetes-client.version>
    <elasticsearch.version>7.17.25</elasticsearch.version>
    <opensearch.version>2.6.0</opensearch.version>
    <httpasyncclient.version>4.1.5</httpasyncclient.version>
    <openapiswagger.version>2.2.25</openapiswagger.version>
    <httpclient.version>4.5.14</httpclient.version>
    <spring.version>7.0.9</spring.version>
    <log4j.version>2.25.5</log4j.version>
    <org.junit.jupiter.version>5.11.4</org.junit.jupiter.version>
    <org.junit.platform.version>1.11.4</org.junit.platform.version>
    <dropwizard-health.version>5.0.0</dropwizard-health.version>
    <handlebars.version>4.5.2</handlebars.version>
    <fernet.version>1.5.0</fernet.version>
    <antlr.version>4.13.2</antlr.version>
    <!-- Apache Jena RDF client libraries. Pinned project-wide so
         openmetadata-service and openmetadata-integration-tests stay on the
         same classpath; the previous split (4.10.0 vs 5.0.0) forced
         JenaFusekiStorage to abstract over API differences between Jena 4 and
         Jena 5 with a CompletableFuture wrapper around every RDFConnection
         call. Jena 6 requires Java 21 — already our project minimum, so no
         JDK bump needed.

         6.2.0 fixes CVE-2026-61372 (SPARQL Update LOAD accepted URLs pointing
         at local resources, so an update could read data off the machine
         running the engine; 6.2.0 restricts them to http/ftp). There is no
         5.x line with the fix — 5.6.0 is the last 5.x release — so the only
         way off the CVE is the major bump. Do not go back below 6.2.0.

         The client can run against a 5.6 or 6.2 Fuseki interchangeably: the
         SPARQL/GSP protocols and the RDF Thrift wire format are identical
         across the two, so client and server upgrade independently. That
         decoupling is what lets the server-side Fuseki bump roll out on its
         own schedule; it is not a reason to leave a server on 5.6, which is
         still exposed to the CVE above. -->
    <jena.version>6.2.0</jena.version>

    <sonar.projectKey>open-metadata_OpenMetadata</sonar.projectKey>
    <sonar.moduleKey>${project.artifactId}</sonar.moduleKey>
    <sonar.organization>open-metadata</sonar.organization>
    <sonar.host.url>https://sonarcloud.io</sonar.host.url>
    <sonar.working.directory>target/sonar</sonar.working.directory>
    <maven.sonar-plugin.version>3.10.0.2594</maven.sonar-plugin.version>
    <sonar.language>java</sonar.language>
    <sonar.skip>false</sonar.skip>
    <sonar.dynamicAnalysis>reuseReports</sonar.dynamicAnalysis>
    <testng.version>7.6.1</testng.version>
    <dropwizard-micrometer.version>3.0.0</dropwizard-micrometer.version>
    <micrometer.version>1.16.7</micrometer.version>
    <json-schema-validator.version>2.0.1</json-schema-validator.version>
    <java-jwt.version>4.4.0</java-jwt.version>
    <jwks-rsa.version>0.22.1</jwks-rsa.version>
    <jjwt.version>0.9.1</jjwt.version>
    <rerunner-jupiter.version>2.1.6</rerunner-jupiter.version>
    <!-- CVE-2026-84939: relative path traversal via ClassTemplateLoader / WebappTemplateLoader
         during localized template lookup, fixed in 2.3.35. -->
    <freemarker.version>2.3.35</freemarker.version>
    <passay.version>1.6.6</passay.version>
    <bcrypt.version>0.10.2</bcrypt.version>
    <simplejavamail.version>8.12.6</simplejavamail.version>
    <dropwizardkafka.version>1.8.0</dropwizardkafka.version>
    <maven-release-plugin.version>3.0.1</maven-release-plugin.version>
    <unboundsdk.version>6.0.11</unboundsdk.version>
    <dropwizard-web.version>3.0.1</dropwizard-web.version>
    <snakeyaml.version>2.3</snakeyaml.version>
    <woodstox.version>5.4.0</woodstox.version>
    <slack.version>1.29.2</slack.version>
    <spotless.version>2.41.1</spotless.version>
    <picocli.version>4.7.6</picocli.version>
    <logback-core.version>1.5.36</logback-core.version>
    <logback-classic.version>1.5.36</logback-classic.version>
    <jsonpath.version>2.9.0</jsonpath.version>
    <everit.version>1.14.4</everit.version>
    <json-patch.version>1.13</json-patch.version>
    <!-- 12.1.12 clears CVE-2026-19203 (jetty-http) and CVE-2026-19204 (jetty-websocket-core-common). -->
    <jetty.version>12.1.12</jetty.version>
    <jakarta-el.version>5.0.0-M1</jakarta-el.version>
    <mcp-sdk.version>1.1.1</mcp-sdk.version>
    <lettuce.version>6.7.1.RELEASE</lettuce.version>
    <flyway.version>9.22.3</flyway.version>
    <angus-mail.version>2.0.4</angus-mail.version>
    <commonmark.version>0.26.0</commonmark.version>
    <flexmark.version>0.64.8</flexmark.version>
    <owasp-html-sanitizer.version>20260101.1</owasp-html-sanitizer.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.junit</groupId>
        <artifactId>junit-bom</artifactId>
        <version>${org.junit.jupiter.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <!-- Pin every org.eclipse.jetty:* to one patched line. Declaring individual artifacts
           with ${jetty.version} only covers the ones named explicitly; the rest arrive
           transitively from dropwizard-core and stay unmanaged on its older line (e.g.
           jetty-security, CVE-2026-10050 digest authentication bypass). Imported before
           anything that pulls dropwizard so the patched line wins. -->
      <dependency>
        <groupId>org.eclipse.jetty</groupId>
        <artifactId>jetty-bom</artifactId>
        <version>${jetty.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>org.eclipse.jetty.ee10</groupId>
        <artifactId>jetty-ee10-bom</artifactId>
        <version>${jetty.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <!-- Security: Force newer versions to fix vulnerabilities -->
      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-lang3</artifactId>
        <version>3.18.0</version>
      </dependency>
      <dependency>
        <groupId>com.squareup.okhttp3</groupId>
        <artifactId>okhttp</artifactId>
        <version>4.12.0</version>
      </dependency>
      <!-- Held alongside okhttp above. client-java 25.x declares logging-interceptor 5.1.0,
           which drags in okhttp-jvm 5.1.0 — okhttp 5 moved the okhttp3.* classes into that
           artifact, so it would sit on the classpath duplicating the pinned okhttp 4.12.0 jar
           (split package, resolved by classpath order). client-java 25.0.1 references the exact
           same 118 okhttp/okio members as 24.0.0, so 4.12.0 satisfies it. Drop this pin only as
           part of a real okhttp 5 migration. -->
      <dependency>
        <groupId>com.squareup.okhttp3</groupId>
        <artifactId>logging-interceptor</artifactId>
        <version>5.5.0</version>
      </dependency>
      <!-- CVE-2026-47857: reactor-core < 3.8.7 (reached transitively via reactor-netty and the
           azure/spring stacks). Pin the whole Reactor 2026.0 train together: reactor-core 3.8.7
           and reactor-netty 1.3.7 are the aligned release, so mixing lines is avoided. -->
      <dependency>
        <groupId>io.projectreactor</groupId>
        <artifactId>reactor-core</artifactId>
        <version>3.8.7</version>
      </dependency>
      <!-- CVE-2026-47874: reactor-netty-http < 1.3.7. The fix ships only on the 1.3.x line (1.2.18
           is the last 1.2.x GA, no backport), and reactor-netty 1.3.x requires Netty 4.2.x — see
           the netty-bom pin below, raised to 4.2.x in lockstep so 1.3.x's Netty 4.2 APIs resolve.
           Pin -core alongside -http so a path that reaches -core directly cannot drag the 1.2 line
           back in. This mirrors ai-platform's ADR-0018, which moves the same three together. -->
      <dependency>
        <groupId>io.projectreactor.netty</groupId>
        <artifactId>reactor-netty-core</artifactId>
        <version>1.3.7</version>
      </dependency>
      <dependency>
        <groupId>io.projectreactor.netty</groupId>
        <artifactId>reactor-netty-http</artifactId>
        <version>1.3.7</version>
      </dependency>
      <!-- CVE-2026-45292: opentelemetry-api 1.37.0 (transitive of
           co.elastic.clients:elasticsearch-java, shaded into elasticsearch-deps)
           is vulnerable; import the BOM to pin -api and -context to the fix. -->
      <dependency>
        <groupId>io.opentelemetry</groupId>
        <artifactId>opentelemetry-bom</artifactId>
        <version>1.62.0</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>org.eclipse.angus</groupId>
        <artifactId>angus-mail</artifactId>
        <version>${angus-mail.version}</version>
      </dependency>
      <!-- CVE-2026-43869 + CVE-2026-45112 (unbounded read) + CVE-2026-48586 (zlib data
           amplification): pin to 0.24.0, the first release carrying all three fixes. No Jena
           release ships a fixed libthrift yet (6.1.0 still pulls 0.22.0), so this pin cannot be
           retired by upgrading Jena. Excluding libthrift breaks RDF tests — Jena's ModelFactory
           statically references TException. -->
      <dependency>
        <groupId>org.apache.thrift</groupId>
        <artifactId>libthrift</artifactId>
        <version>0.24.0</version>
      </dependency>
      <dependency>
        <groupId>org.antlr</groupId>
        <artifactId>antlr4-runtime</artifactId>
        <version>${antlr.version}</version>
      </dependency>
      <dependency>
        <groupId>org.glassfish.jersey</groupId>
        <artifactId>jersey-bom</artifactId>
        <version>${jersey-bom.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>com.macasaet.fernet</groupId>
        <artifactId>fernet-java8</artifactId>
        <version>${fernet.version}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-annotations</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-core</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.module</groupId>
        <artifactId>jackson-module-blackbird</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>io.dropwizard</groupId>
        <artifactId>dropwizard-core</artifactId>
        <version>${dropwizard.version}</version>
        <exclusions>
          <exclusion>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-core</artifactId>
          </exclusion>
          <exclusion>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>log4j-over-slf4j</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>jetty-server</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <!-- https://mvnrepository.com/artifact/io.modelcontextprotocol.sdk/mcp-bom -->
      <dependency>
        <groupId>io.modelcontextprotocol.sdk</groupId>
        <artifactId>mcp-bom</artifactId>
        <version>${mcp-sdk.version}</version>
        <type>pom</type>
      </dependency>
      <dependency>
        <groupId>io.modelcontextprotocol.sdk</groupId>
        <artifactId>mcp-core</artifactId>
        <version>${mcp-sdk.version}</version>
      </dependency>
      <dependency>
        <groupId>io.modelcontextprotocol.sdk</groupId>
        <artifactId>mcp-json-jackson2</artifactId>
        <version>${mcp-sdk.version}</version>
      </dependency>
      <dependency>
        <groupId>org.eclipse.jetty</groupId>
        <artifactId>jetty-server</artifactId>
        <version>${jetty.version}</version>
      </dependency>
      <!-- Jetty EE10 dependencies for Dropwizard 5.0 / Jakarta EE 10 -->
      <dependency>
        <groupId>org.eclipse.jetty.ee10</groupId>
        <artifactId>jetty-ee10-servlet</artifactId>
        <version>${jetty.version}</version>
      </dependency>
      <dependency>
        <groupId>org.eclipse.jetty.ee10.websocket</groupId>
        <artifactId>jetty-ee10-websocket-jetty-server</artifactId>
        <version>${jetty.version}</version>
      </dependency>
      <dependency>
        <groupId>org.eclipse.jetty.ee10.websocket</groupId>
        <artifactId>jetty-ee10-websocket-jakarta-server</artifactId>
        <version>${jetty.version}</version>
      </dependency>
      <dependency>
        <groupId>io.dropwizard</groupId>
        <artifactId>dropwizard-assets</artifactId>
        <version>${dropwizard.version}</version>
        <exclusions>
          <exclusion>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-core</artifactId>
          </exclusion>
          <exclusion>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>jetty-server</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>io.dropwizard</groupId>
        <artifactId>dropwizard-http2</artifactId>
        <version>${dropwizard.version}</version>
      </dependency>
      <dependency>
        <groupId>io.dropwizard</groupId>
        <artifactId>dropwizard-client</artifactId>
        <version>${dropwizard.version}</version>
      </dependency>
      <dependency>
        <groupId>io.dropwizard</groupId>
        <artifactId>dropwizard-testing</artifactId>
        <version>${dropwizard.version}</version>
        <exclusions>
          <exclusion>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
          </exclusion>
            <exclusion>
              <groupId>ch.qos.logback</groupId>
              <artifactId>logback-core</artifactId>
            </exclusion>
            <exclusion>
              <groupId>ch.qos.logback</groupId>
              <artifactId>logback-classic</artifactId>
            </exclusion>
        </exclusions>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-core</artifactId>
        <version>${logback-core.version}</version>
      </dependency>
      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-classic</artifactId>
        <version>${logback-classic.version}</version>
      </dependency>
      <!-- logback-access-jetty12 for Jetty 12 compatibility -->
      <dependency>
        <groupId>ch.qos.logback.access</groupId>
        <artifactId>logback-access-jetty12</artifactId>
        <version>2.0.7</version>
      </dependency>
      <dependency>
        <groupId>ch.qos.logback.access</groupId>
        <artifactId>logback-access-common</artifactId>
        <version>2.0.7</version>
      </dependency>
      <dependency>
        <groupId>io.dropwizard</groupId>
        <artifactId>dropwizard-json-logging</artifactId>
        <version>${dropwizard.version}</version>
      </dependency>
      <dependency>
        <groupId>org.awaitility</groupId>
        <artifactId>awaitility</artifactId>
        <version>4.2.2</version>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>io.dropwizard</groupId>
        <artifactId>dropwizard-jdbi3</artifactId>
        <version>${dropwizard-jdbi3.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.jdbi</groupId>
            <artifactId>jdbi3-sqlobject</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.apache.tomcat</groupId>
            <artifactId>tomcat-jdbc</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.jdbi</groupId>
        <artifactId>jdbi3-core</artifactId>
        <version>${jdbi3.version}</version>
      </dependency>
      <dependency>
        <groupId>org.jdbi</groupId>
        <artifactId>jdbi3-sqlobject</artifactId>
        <version>${jdbi3.version}</version>
      </dependency>
      <!-- Removed dropwizard-web dependency - not compatible with Dropwizard 5.0 -->
      <!-- Using local web configuration classes in org.openmetadata.service.config.web -->
      <dependency>
        <groupId>org.eclipse.jetty.ee10</groupId>
        <artifactId>jetty-ee10-servlets</artifactId>
        <version>${jetty.version}</version>
      </dependency>
      <dependency>
        <groupId>commons-cli</groupId>
        <artifactId>commons-cli</artifactId>
        <version>${commons-cli.version}</version>
      </dependency>
      <dependency>
        <groupId>commons-io</groupId>
        <artifactId>commons-io</artifactId>
        <version>${commons-io.version}</version>
      </dependency>
      <dependency>
        <groupId>com.mysql</groupId>
        <artifactId>mysql-connector-j</artifactId>
        <version>${mysql.connector.version}</version>
        <exclusions>
          <exclusion>
            <groupId>com.google.protobuf</groupId>
            <artifactId>protobuf-java</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.postgresql</groupId>
        <artifactId>postgresql</artifactId>
        <version>${postgres.connector.version}</version>
      </dependency>
      <dependency>
        <groupId>com.google.code.gson</groupId>
        <artifactId>gson</artifactId>
        <version>${gson.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.httpcomponents</groupId>
        <artifactId>httpasyncclient</artifactId>
        <version>${httpasyncclient.version}</version>
      </dependency>
      <dependency>
        <groupId>io.swagger.core.v3</groupId>
        <artifactId>swagger-core</artifactId>
        <version>${openapiswagger.version}</version>
      </dependency>
      <dependency>
        <groupId>io.swagger.core.v3</groupId>
        <artifactId>swagger-jaxrs2</artifactId>
        <version>${openapiswagger.version}</version>
      </dependency>
      <dependency>
        <groupId>io.swagger.core.v3</groupId>
        <artifactId>swagger-integration</artifactId>
        <version>${openapiswagger.version}</version>
      </dependency>
      <dependency>
        <groupId>io.swagger.core.v3</groupId>
        <artifactId>swagger-annotations</artifactId>
        <version>${openapiswagger.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.httpcomponents</groupId>
        <artifactId>httpclient</artifactId>
        <version>${httpclient.version}</version>
      </dependency>
      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>${spring.version}</version>
      </dependency>
      <!-- API, java.xml.bind module -->
      <dependency>
        <groupId>jakarta.xml.bind</groupId>
        <artifactId>jakarta.xml.bind-api</artifactId>
        <version>4.0.2</version>
      </dependency>

      <dependency>
        <groupId>io.dropwizard</groupId>
        <artifactId>dropwizard-metrics</artifactId>
        <version>${dropwizard.version}</version>
      </dependency>

      <!-- For Prometheus support. Pinned to match micrometer-registry-prometheus 1.16.x
           (pulls client_java 1.4.3); a mismatched version splits the prometheus-metrics
           family so one layer calls config APIs absent in the other
           (NoSuchMethodError at runtime). Drives -core/-config across all modules. -->
      <dependency>
        <groupId>io.prometheus</groupId>
        <artifactId>prometheus-metrics-instrumentation-dropwizard</artifactId>
        <version>1.4.3</version>
      </dependency>


      <!-- Runtime, com.sun.xml.bind module -->
      <dependency>
        <groupId>org.glassfish.jaxb</groupId>
        <artifactId>jaxb-runtime</artifactId>
        <version>${jaxb.version}</version>
      </dependency>

      <!--Test dependencies-->
      <dependency>
        <groupId>org.mockito</groupId>
        <artifactId>mockito-core</artifactId>
        <version>${mockito.version}</version>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>org.mockito</groupId>
        <artifactId>mockito-all</artifactId>
        <version>2.0.2-beta</version>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>org.mockito</groupId>
        <artifactId>mockito-inline</artifactId>
        <version>5.2.0</version>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>org.mockito</groupId>
        <artifactId>mockito-junit-jupiter</artifactId>
        <version>${mockito.version}</version>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>com.amazon.redshift</groupId>
        <artifactId>redshift-jdbc42</artifactId>
        <version>${redshift-jdbc.version}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-api</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-simple</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <version>${lombok.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.tomcat</groupId>
        <artifactId>tomcat-jdbc</artifactId>
        <version>${tomcat-jdbc.version}</version>
      </dependency>
      <dependency>
        <groupId>com.zaxxer</groupId>
        <artifactId>HikariCP</artifactId>
        <version>${hikaricp.version}</version>
      </dependency>
      <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter-engine</artifactId>
        <version>${org.junit.jupiter.version}</version>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>io.github.classgraph</groupId>
        <artifactId>classgraph</artifactId>
        <version>4.8.177</version>
      </dependency>
      <dependency>
        <groupId>org.reflections</groupId>
        <artifactId>reflections</artifactId>
        <!-- Can't be upgraded to the latest -->
        <version>0.9.11</version>
      </dependency>
      <dependency>
          <groupId>org.apache.logging.log4j</groupId>
          <artifactId>log4j-core</artifactId>
          <version>${log4j.version}</version>
      </dependency>
      <dependency>
          <groupId>org.apache.logging.log4j</groupId>
          <artifactId>log4j-api</artifactId>
          <version>${log4j.version}</version>
      </dependency>
      <!-- JSON-P: Java API for JSON Processing (JSR 374) -->
      <dependency>
        <groupId>javax.json</groupId>
        <artifactId>javax.json-api</artifactId>
        <version>1.1.4</version>
      </dependency>

      <!-- Apache Johnzon: Implementation of the Java API for JSON Processing (JSR 374) -->
      <dependency>
        <groupId>org.apache.johnzon</groupId>
        <artifactId>johnzon-core</artifactId>
        <version>1.2.21</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.datatype</groupId>
        <artifactId>jackson-datatype-jsr353</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.datatype</groupId>
        <artifactId>jackson-datatype-jakarta-jsonp</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>io.github.resilience4j</groupId>
        <artifactId>resilience4j-retry</artifactId>
        <version>2.3.0</version>
      </dependency>
      <dependency>
        <groupId>info.picocli</groupId>
        <artifactId>picocli</artifactId>
        <version>${picocli.version}</version>
      </dependency>
      <dependency>
        <groupId>com.github.erosb</groupId>
        <artifactId>everit-json-schema</artifactId>
        <version>${everit.version}</version>
      </dependency>
      <dependency>
        <groupId>org.eclipse.jetty</groupId>
        <artifactId>jetty-io</artifactId>
        <version>${jetty.version}</version>
      </dependency>
      <dependency>
        <groupId>org.glassfish</groupId>
        <artifactId>jakarta.el</artifactId>
        <version>${jakarta-el.version}</version>
      </dependency>

      <!-- avoid security issue https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329 -->
      <dependency>
        <groupId>com.fasterxml.jackson.dataformat</groupId>
        <artifactId>jackson-dataformat-cbor</artifactId>
        <version>${jackson.version}</version>
      </dependency>

      <dependency>
        <groupId>com.jayway.jsonpath</groupId>
        <artifactId>json-path</artifactId>
        <version>${jsonpath.version}</version>
        <exclusions>
          <exclusion>
            <groupId>net.minidev</groupId>
            <artifactId>json-smart</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
    <dependency>
      <groupId>com.github.java-json-tools</groupId>
      <artifactId>json-patch</artifactId>
      <version>${json-patch.version}</version>
    </dependency>
    <dependency>
      <groupId>com.github.jknack</groupId>
      <artifactId>handlebars</artifactId>
      <version>${handlebars.version}</version>
    </dependency>
      <dependency>
        <groupId>com.microsoft.azure</groupId>
        <artifactId>msal4j</artifactId>
        <version>1.22.0</version>
        <exclusions>
          <exclusion>
            <groupId>net.minidev</groupId>
            <artifactId>json-smart</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>com.azure</groupId>
        <artifactId>azure-identity</artifactId>
        <version>1.15.2</version>
      </dependency>
      <!-- Pin all transitive io.netty:* to one patched line via the BOM (netty-codec-http et al.
           arrive transitively through reactor-netty-http and others). Held on the 4.2.x line
           because reactor-netty 1.3.x (pinned above) is built against Netty 4.2; 4.2.18.Final
           clears the netty-codec-http Transfer-Encoding request-smuggling issue CVE-2026-89044
           and still covers the CorsHandler Vary-header cache-poisoning / info-disclosure issue
           CVE-2026-59903. -->
      <dependency>
        <groupId>io.netty</groupId>
        <artifactId>netty-bom</artifactId>
        <version>4.2.18.Final</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <!-- avoid security issue https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360 -->
      <!-- Enforce consistent snakeyaml version -->
      <dependency>
        <groupId>org.yaml</groupId>
        <artifactId>snakeyaml</artifactId>
        <version>${snakeyaml.version}</version>
      </dependency>
      <!-- Enforce consistent jackson-dataformat-yaml version -->
      <dependency>
        <groupId>com.fasterxml.jackson.dataformat</groupId>
        <artifactId>jackson-dataformat-yaml</artifactId>
        <version>${jackson.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.yaml</groupId>
            <artifactId>snakeyaml</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <!-- Redis/Cache dependencies -->
      <dependency>
        <groupId>io.lettuce</groupId>
        <artifactId>lettuce-core</artifactId>
        <version>${lettuce.version}</version>
      </dependency>

      <!-- Flyway dependencies - only for SQL parsing, not migration management -->
      <dependency>
        <groupId>org.flywaydb</groupId>
        <artifactId>flyway-core</artifactId>
        <version>${flyway.version}</version>
      </dependency>
      <dependency>
        <groupId>org.flywaydb</groupId>
        <artifactId>flyway-maven-plugin</artifactId>
        <version>${flyway.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.codehaus.plexus</groupId>
            <artifactId>plexus-utils</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.flywaydb</groupId>
        <artifactId>flyway-mysql</artifactId>
        <version>${flyway.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.httpcomponents.core5</groupId>
        <artifactId>httpcore5</artifactId>
        <version>5.4.3</version>
      </dependency>
      <dependency>
        <groupId>org.apache.httpcomponents.core5</groupId>
        <artifactId>httpcore5-h2</artifactId>
        <version>5.4.3</version>
      </dependency>
      <!--
        Keep this in step with the httpcore5 pin above - Apache releases the two together
        and mixing lines breaks search. httpclient5 5.5/5.5.2 are built against httpcore5
        5.3.x; on 5.4.x their I/O reactor dispatchers die silently, leaking connection-pool
        leases until every request fails with DeadlineTimeoutException. 5.6.4 declares
        httpcore5 5.4.3 (identical to 5.6.3), so client and core match.

        5.6.3 was the first release outside the CVE-2026-64607 range (affects
        5.0-alpha1 through 5.6.2: the classic i/o client leaks a connection when a response
        carries an invalid Content-Encoding). 5.6.4 additionally closes CVE-2026-71290
        (improper certificate validation: HostnameVerificationPolicy#BUILTIN had no effect on
        the async TLS upgrade path, so SSL parameters were not applied).

        The 5.6 line enables automatic content decompression in the async client, which the
        search transports also do - see disableContentCompression() in OpenSearchClient and
        ElasticSearchClient. Do not drop those when touching this pin.
      -->
      <dependency>
        <groupId>org.apache.httpcomponents.client5</groupId>
        <artifactId>httpclient5</artifactId>
        <version>5.6.4</version>
      </dependency>
      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-compress</artifactId>
        <version>1.26.0</version>
      </dependency>
      <!-- CVE-2026-75140: quadratic memory in XmlTreeBuilder namespace-map copying lets a
           deeply nested, uniquely-namespaced XML document exhaust the heap. Vulnerable through
           1.23.1; the fix (jsoup PR #2556) ships in 1.23.2. jsoup is not declared by any module -
           it arrives only as a transitive of flexmark-html2md-converter, which declares 1.15.4.
           That is a soft requirement, so managing it here overrides it. Remove this pin only if
           flexmark ever ships a release declaring 1.23.2 or newer itself (0.64.8 is its latest). -->
      <dependency>
        <groupId>org.jsoup</groupId>
        <artifactId>jsoup</artifactId>
        <version>1.23.2</version>
      </dependency>
      <dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcpkix-jdk18on</artifactId>
        <version>1.85</version>
      </dependency>
      <dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcprov-jdk18on</artifactId>
        <version>1.85</version>
      </dependency>
      <dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcutil-jdk18on</artifactId>
        <version>1.85</version>
      </dependency>
      <!-- Force patched tools.jackson 3.x (jsonschema2pojo-core pulls 3.0.2 transitively).
           3.1.7 clears CVE-2026-89425 and CVE-2026-91777.
           jsonschema2pojo-core is scope=provided so none of this reaches the runtime
           classpath, but Snyk's Maven scanner walks the provided tree. -->
      <dependency>
        <groupId>tools.jackson</groupId>
        <artifactId>jackson-bom</artifactId>
        <version>3.1.7</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
<!-- AWS SDK v2 BOM at root so every module resolves the patched line.
           openmetadata-dist / -mcp / -k8s-operator are siblings that depend on
           -service (not children of it), so -service's BOM alone does not reach
           them. Clears cloudfront (SNYK-JAVA-SOFTWAREAMAZONAWSSDK-15810116). -->
      <dependency>
        <groupId>software.amazon.awssdk</groupId>
        <artifactId>bom</artifactId>
        <version>${awssdk.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <repositories>
    <repository>
      <releases>
        <enabled>true</enabled>
      </releases>
      <snapshots>
        <enabled>false</enabled>
      </snapshots>
      <id>central</id>
      <url>https://repo.maven.apache.org/maven2/</url>
    </repository>
    <repository>
      <releases>
        <enabled>true</enabled>
      </releases>
      <snapshots>
        <enabled>true</enabled>
      </snapshots>
      <id>clojars</id>
      <url>https://repository.apache.org/content/repositories/snapshots/</url>
    </repository>
    <repository>
      <releases>
        <enabled>true</enabled>
      </releases>
      <snapshots>
        <enabled>true</enabled>
      </snapshots>
      <id>aws-redshift</id>
      <url>https://s3.amazonaws.com/redshift-maven-repository/release</url>
    </repository>
  </repositories>

  <profiles>

    <profile>	<!-- run SCA -->
      <id>static-code-analysis</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.jacoco</groupId>
            <artifactId>jacoco-maven-plugin</artifactId>
            <version>${jacoco-plugin.version}</version>
            <executions>
              <execution>
                <id>prepare-agent</id>
                <goals>
                  <goal>prepare-agent</goal>
                </goals>
              </execution>
              <execution>
                <id>report</id>
                <phase>verify</phase>
                <goals>
                  <goal>report</goal>
                </goals>
              </execution>
            </executions>
          </plugin>

          <plugin>
            <groupId>org.sonarsource.scanner.maven</groupId>
            <artifactId>sonar-maven-plugin</artifactId>
            <version>${maven.sonar-plugin.version}</version>
            <executions>
              <execution>
                <id>sonar-verify-execution</id>
                <phase>verify</phase>
                <goals>
                  <goal>sonar</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>

    <profile>
      <id>release</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-source-plugin</artifactId>
            <version>${maven-source-plugin.version}</version>
            <executions>
              <execution>
                <id>attach-sources</id>
                <goals>
                  <goal>jar-no-fork</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-javadoc-plugin</artifactId>
            <version>${maven-javadoc-plugin.version}</version>
            <configuration>
              <doclint>none</doclint>
            </configuration>
            <executions>
              <execution>
                <id>attach-javadocs</id>
                <goals>
                  <goal>jar</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <version>3.0.1</version>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
                <configuration>
                  <gpgArguments>
                    <arg>--pinentry-mode</arg>
                    <arg>loopback</arg>
                  </gpgArguments>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>

  </profiles>
  <reporting>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jxr-plugin</artifactId>
        <version>3.3.0</version>
      </plugin>
    </plugins>
  </reporting>
  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-enforcer-plugin</artifactId>
          <version>3.1.0</version>
          <executions>
            <execution>
              <id>enforce-maven</id>
              <goals>
                <goal>enforce</goal>
              </goals>
              <configuration>
                <rules>
                  <requireMavenVersion>
                    <version>3.8</version>
                  </requireMavenVersion>
                </rules>
              </configuration>
            </execution>
          </executions>
        </plugin>
        <plugin>
          <groupId>com.theoryinpractise</groupId>
          <artifactId>googleformatter-maven-plugin</artifactId>
          <version>1.7.5</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-clean-plugin</artifactId>
          <version>3.2.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-deploy-plugin</artifactId>
          <version>3.0.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-install-plugin</artifactId>
          <version>3.0.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-resources-plugin</artifactId>
          <version>3.3.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-assembly-plugin</artifactId>
          <version>3.4.2</version>
        </plugin>
        <plugin>
          <groupId>io.openapitools.swagger</groupId>
          <artifactId>swagger-maven-plugin</artifactId>
          <version>2.1.6</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-site-plugin</artifactId>
          <version>3.12.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-dependency-plugin</artifactId>
          <version>${maven-dependency-plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>com.diffplug.spotless</groupId>
          <artifactId>spotless-maven-plugin</artifactId>
          <version>${spotless.version}</version>
          <configuration>
            <java>
              <includes>
                <include>src/main/java/**/*.java</include>
                <include>src/test/java/**/*.java</include>
              </includes>
              <googleJavaFormat>
                <style>GOOGLE</style>
                <reflowLongStrings>false</reflowLongStrings>
                <formatJavadoc>false</formatJavadoc>
                <groupArtifact>com.google.googlejavaformat:google-java-format</groupArtifact>
              </googleJavaFormat>
              <removeUnusedImports/>
            </java>
          </configuration>
          <executions>
            <execution>
              <goals>
                <goal>check</goal>
              </goals>
            </execution>
          </executions>
        </plugin>
        <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-checkstyle-plugin</artifactId>
           <version>3.2.0</version>
           <configuration>
             <configLocation>./checkstyle/checkstyle.xml</configLocation>
               <includeTestSourceDirectory>true</includeTestSourceDirectory>
           </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-release-plugin</artifactId>
          <version>${maven-release-plugin.version}</version>
          <configuration>
            <!--suppress UnresolvedMavenProperty -->
            <arguments>-Dgpg.passphrase=${gpg.passphrase}</arguments>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>3.13.0</version>
          <configuration>
            <source>21</source>
            <target>21</target>
            <annotationProcessorPaths>
              <path>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <version>${lombok.version}</version>
              </path>
            </annotationProcessorPaths>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jar-plugin</artifactId>
          <version>${maven-jar-plugin.version}</version>
        </plugin>

        <!-- Test plugins -->
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-surefire-plugin</artifactId>
          <version>${maven-surefire.version}</version>
          <configuration>
            <includes>
              <include>org.openmetadata.service.apps.*.java</include>
              <include>org.openmetadata.service.cache.*.java</include>
              <include>org.openmetadata.service.events.*.java</include>
              <include>org.openmetadata.service.formatter.**.*.java</include>
              <include>org.openmetadata.service.governance.*.java</include>
              <include>org.openmetadata.service.jdbi3.*.java</include>
              <include>org.openmetadata.service.monitoring.*.java</include>
              <include>org.openmetadata.service.notifications.**.*.java</include>
              <include>org.openmetadata.service.pipelineService.*.java</include>
              <include>org.openmetadata.service.resources.**.*.java</include>
              <include>org.openmetadata.service.rules.*.java</include>
              <include>org.openmetadata.service.search.*.java</include>
              <include>org.openmetadata.service.secrets.*.java</include>
              <include>org.openmetadata.service.security.*.java</include>
              <include>org.openmetadata.service.util.*.java</include>
              <include>org.openmetadata.service.EnumBackwardCompatibilityTest</include>
            </includes>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-surefire-report-plugin</artifactId>
          <version>${maven-surefire.version}</version>
        </plugin>
        <plugin>
          <groupId>org.jacoco</groupId>
          <artifactId>jacoco-maven-plugin</artifactId>
          <version>${jacoco-plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.sonarsource.scanner.maven</groupId>
          <artifactId>sonar-maven-plugin</artifactId>
          <version>${maven.sonar-plugin.version}</version>
        </plugin>
      </plugins>
    </pluginManagement>

    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <executions>
          <execution>
            <id>enforce-maven</id>
            <goals>
              <goal>enforce</goal>
            </goals>
            <configuration>
              <rules>
                <requireMavenVersion>
                  <version>3.6.0</version>
                </requireMavenVersion>
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-clean-plugin</artifactId>
        <version>3.2.0</version>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-deploy-plugin</artifactId>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-install-plugin</artifactId>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-release-plugin</artifactId>
        <version>${maven-release-plugin.version}</version>
        <configuration>
          <autoVersionSubmodules>true</autoVersionSubmodules>
          <tagNameFormat>v@{project.version}</tagNameFormat>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>versions-maven-plugin</artifactId>
        <version>2.13.0</version>
        <configuration>
          <generateBackupPoms>false</generateBackupPoms>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.sonatype.central</groupId>
        <artifactId>central-publishing-maven-plugin</artifactId>
        <version>0.9.0</version>
        <extensions>true</extensions>
        <configuration>
          <publishingServerId>central</publishingServerId>
          <autoPublish>true</autoPublish>
          <!-- Return once Sonatype has validated the bundle; autoPublish still
               publishes it afterwards. Waiting for the terminal 'published' state
               polls Central's async publish queue, which is slow on busy days and
               times out (~30m) as a false BUILD FAILURE even though the upload and
               validation succeeded (e.g. the 1.13.6 release). -->
          <waitUntil>validated</waitUntil>
        </configuration>
      </plugin>
    </plugins>
  </build>
</project>