sonarqube/pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.sonarsource.parent</groupId>
    <artifactId>parent</artifactId>
    <version>40</version>
  </parent>
  <groupId>org.sonarsource.sonarqube</groupId>
  <artifactId>sonarqube</artifactId>
  <packaging>pom</packaging>
  <version>6.6-SNAPSHOT</version>
  <name>SonarQube</name>
  <url>http://www.sonarqube.org/</url>
  <description>Open source platform for continuous inspection of code quality</description>

  <modules>
    <module>sonar-plugin-api-deps</module>
    <module>sonar-application</module>
    <module>sonar-scanner-engine</module>
    <module>sonar-scanner-protocol</module>
    <module>sonar-scanner-engine-shaded</module>
    <module>sonar-check-api</module>
    <module>sonar-core</module>
    <module>sonar-duplications</module>
    <module>sonar-home</module>
    <module>sonar-markdown</module>
    <module>sonar-plugin-api</module>
    <module>server</module>
    <module>sonar-ws</module>
    <module>sonar-testing-harness</module>
    <module>plugins/sonar-xoo-plugin</module>
  </modules>

  <organization>
    <name>SonarSource</name>
    <url>http://www.sonarsource.com</url>
  </organization>
  <inceptionYear>2009</inceptionYear>

  <issueManagement>
    <system>jira</system>
    <url>http://jira.sonarsource.com/browse/SONAR</url>
  </issueManagement>

  <properties>
    <!-- see http://repo1.maven.org/maven2/org/sonarsource/dotnet/sonar-csharp-plugin/ -->
    <!-- Do not forget to exclude any new transitive dependencies -->
    <sonarCSharp.version>5.10.1.1411</sonarCSharp.version>
    <!-- see http://repo1.maven.org/maven2/org/sonarsource/java/sonar-java-plugin/ -->
    <!-- Do not forget to exclude any new transitive dependencies -->
    <sonarJava.version>4.12.0.11033</sonarJava.version>
    <!-- see http://repo1.maven.org/maven2/org/sonarsource/javascript/sonar-javascript-plugin/ -->
    <!-- Do not forget to exclude any new transitive dependencies -->
    <sonarJavaScript.version>3.1.1.5128</sonarJavaScript.version>
    <!-- see http://repo1.maven.org/maven2/org/sonarsource/php/sonar-php-plugin/ -->
    <!-- Do not forget to exclude any new transitive dependencies -->
    <sonarPhp.version>2.10.0.2087</sonarPhp.version>
    <!-- see http://repo1.maven.org/maven2/org/sonarsource/python/sonar-python-plugin/ -->
    <!-- Do not forget to exclude any new transitive dependencies -->
    <sonarPython.version>1.8.0.1496</sonarPython.version>
    <!-- see http://repo1.maven.org/maven2/org/sonarsource/flex/sonar-flex-plugin/ -->
    <!-- Do not forget to exclude any new transitive dependencies -->
    <sonarFlex.version>2.3</sonarFlex.version>
    <!-- see http://repo1.maven.org/maven2/org/sonarsource/xml/sonar-xml-plugin/ -->
    <!-- Do not forget to exclude any new transitive dependencies -->
    <sonarXml.version>1.4.3.1027</sonarXml.version>
    <sonarGit.version>1.2</sonarGit.version>
    <sonarSvn.version>1.5.0.715</sonarSvn.version>
    <sonarUpdateCenter.version>1.18.0.487</sonarUpdateCenter.version>
    <h2.version>1.3.176</h2.version>
    <jetty.version>8.1.12.v20130726</jetty.version>
    <logback.version>1.1.7</logback.version>
    <slf4j.version>1.7.24</slf4j.version>

    <!-- Be aware that Log4j is used by Elasticsearch client -->
    <log4j.version>2.8.2</log4j.version>
    <tomcat.version>8.5.16</tomcat.version>
    <elasticsearch.version>5.6.2</elasticsearch.version>
    <orchestrator.version>3.15.0.1256</orchestrator.version>
    <okhttp.version>3.7.0</okhttp.version>
    <jackson.version>2.6.6</jackson.version>

    <protobuf.version>3.0.0-beta-2</protobuf.version>

    <hazelcast.version>3.8.4</hazelcast.version>

    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <maven.min.version>3.2</maven.min.version>
    <timestamp>${maven.build.timestamp}</timestamp>
    <maven.build.timestamp.format>yyyy-MM-dd'T'HH:mm:ssZ</maven.build.timestamp.format>
    <license.title>SonarQube</license.title>

    <skipSanityChecks>false</skipSanityChecks>

    <argLine>-Xmx512m -Djava.awt.headless=true</argLine>
    <maven.test.redirectTestOutputToFile>true</maven.test.redirectTestOutputToFile>

    <!-- used for deployment to SonarSource Artifactory -->
    <gitRepositoryName>sonarqube</gitRepositoryName>
    <!-- Release: enable publication to Bintray -->
    <artifactsToPublish>${project.groupId}:sonar-application:zip</artifactsToPublish>
  </properties>

  <prerequisites>
    <maven>3.2</maven>
  </prerequisites>

  <build>
    <extensions>
      <extension>
        <groupId>kr.motd.maven</groupId>
        <artifactId>os-maven-plugin</artifactId>
        <version>1.4.1.Final</version>
      </extension>
    </extensions>

    <pluginManagement>
      <!-- Plugins ordered by shortname (assembly, antrun ...) -->
      <plugins>
        <plugin>
          <groupId>com.github.eirslett</groupId>
          <artifactId>frontend-maven-plugin</artifactId>
          <version>1.6</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-assembly-plugin</artifactId>
          <version>2.4</version>
          <configuration>
            <archiverConfig>
              <!-- Workaround for http://jira.codehaus.org/browse/MASSEMBLY-422 -->
              <!-- 420(dec) = 644(oct) -->
              <fileMode>420</fileMode>
              <!-- 493(dec) = 755(oct) -->
              <directoryMode>493</directoryMode>
              <defaultDirectoryMode>493</defaultDirectoryMode>
            </archiverConfig>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.codehaus.mojo</groupId>
          <artifactId>build-helper-maven-plugin</artifactId>
          <version>1.12</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-clean-plugin</artifactId>
          <version>3.0.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-dependency-plugin</artifactId>
          <version>2.10</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-enforcer-plugin</artifactId>
          <version>1.4.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-gpg-plugin</artifactId>
          <version>1.6</version>
        </plugin>
        <plugin>
          <groupId>org.jacoco</groupId>
          <artifactId>jacoco-maven-plugin</artifactId>
          <version>0.7.9</version>
          <configuration>
            <excludes>
              <exclude>*_javassist_*</exclude>
            </excludes>
            <includes>
              <include>org.sonar.*</include>
              <include>org.sonarqube.*</include>
            </includes>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-javadoc-plugin</artifactId>
          <version>2.10.4</version>
          <configuration>
            <author>false</author>
            <linksource>true</linksource>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jar-plugin</artifactId>
          <version>3.0.2</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jxr-plugin</artifactId>
          <version>2.5</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-resources-plugin</artifactId>
          <version>3.0.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-shade-plugin</artifactId>
          <version>3.0.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-source-plugin</artifactId>
          <version>3.0.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-surefire-plugin</artifactId>
          <version>2.20</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-war-plugin</artifactId>
          <version>2.6</version>
        </plugin>
        <plugin>
          <!-- not thread safe -->
          <groupId>org.codehaus.sonar</groupId>
          <artifactId>sonar-dev-maven-plugin</artifactId>
          <version>1.8</version>
        </plugin>
        <plugin>
          <groupId>org.sonarsource.sonar-packaging-maven-plugin</groupId>
          <artifactId>sonar-packaging-maven-plugin</artifactId>
          <version>1.18.0.372</version>
        </plugin>
        <plugin>
          <groupId>org.owasp</groupId>
          <artifactId>dependency-check-maven</artifactId>
          <version>1.2.11</version>
          <configuration>
            <failBuildOnCVSS>8</failBuildOnCVSS>
            <suppressionFile>cve-false-positives.xml</suppressionFile>
          </configuration>
        </plugin>
        <plugin>
          <!--
          Detection of conflicts in classpath.
          Command line is: mvn org.basepom.maven:duplicate-finder-maven-plugin:check
          See https://github.com/basepom/duplicate-finder-maven-plugin
          -->
          <groupId>org.basepom.maven</groupId>
          <artifactId>duplicate-finder-maven-plugin</artifactId>
          <version>1.1.1</version>
          <configuration>
            <printEqualFiles>true</printEqualFiles>
            <!--
            <failBuildInCaseOfDifferentContentConflict>true</failBuildInCaseOfDifferentContentConflict>
            <failBuildInCaseOfEqualContentConflict>true</failBuildInCaseOfEqualContentConflict>
            <failBuildInCaseOfConflict>true</failBuildInCaseOfConflict>
            -->
            <checkCompileClasspath>true</checkCompileClasspath>
            <checkRuntimeClasspath>true</checkRuntimeClasspath>
            <checkTestClasspath>false</checkTestClasspath>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.xolstice.maven.plugins</groupId>
          <artifactId>protobuf-maven-plugin</artifactId>
          <version>0.5.0</version>
        </plugin>
        <plugin>
          <groupId>com.github.genthaler</groupId>
          <artifactId>beanshell-maven-plugin</artifactId>
          <version>1.2</version>
        </plugin>
      </plugins>
    </pluginManagement>

    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <executions>
          <execution>
            <id>enforce-rules</id>
            <goals>
              <goal>enforce</goal>
            </goals>
            <configuration>
              <rules>
                <requirePluginVersions>
                  <message>Build reproducibility : always define plugin versions</message>
                  <banLatest>true</banLatest>
                  <banRelease>true</banRelease>
                  <phases>clean,deploy</phases>
                </requirePluginVersions>
                <requireReleaseDeps>
                  <message>No SNAPSHOT versions allowed for dependencies</message>
                  <onlyWhenRelease>true</onlyWhenRelease>
                </requireReleaseDeps>
                <requireJavaVersion>
                  <message>To build this project JDK ${jdk.min.version} (or upper) is required. Please install it.
                  </message>
                  <version>${jdk.min.version}</version>
                </requireJavaVersion>
                <requireMavenVersion>
                  <version>[${maven.min.version},)</version>
                </requireMavenVersion>
                <bannedDependencies>
                  <!-- See SONAR-2512 -->
                  <message>commons-beanutils:commons-beanutils should be used instead</message>
                  <excludes>
                    <exclude>commons-beanutils:commons-beanutils-core</exclude>
                  </excludes>
                  <searchTransitive>true</searchTransitive>
                </bannedDependencies>
                <requireNoRepositories>
                  <message>Definition of new repositories is not allowed in order to deploy to central repository.
                  </message>
                </requireNoRepositories>
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <!--
      Choosing a random timezone when executing tests allows to detect
      early the tests that are coupled with local environment.
      -->
      <plugin>
        <groupId>com.github.genthaler</groupId>
        <artifactId>beanshell-maven-plugin</artifactId>
        <executions>
          <execution>
            <id>randomize-environment</id>
            <phase>validate</phase>
            <goals>
              <goal>run</goal>
            </goals>
            <configuration>
              <script>
                <![CDATA[
                String[] timezones = new String[] {"GMT-9", "UTC", "GMT+9"};
                String testTimezone = timezones[new java.util.Random().nextInt(timezones.length)];
                project.getProperties().setProperty("testTimezone", testTimezone);
                logger.info("Timezone used for tests: " + testTimezone);
                ]]>
              </script>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jxr-plugin</artifactId>
        <configuration>
          <aggregate>true</aggregate>
          <linkJavadoc>true</linkJavadoc>
          <javadocDir>${project.reporting.outputDirectory}/${project.version}/apidocs</javadocDir>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <configuration>
          <runOrder>random</runOrder>
          <systemPropertyVariables>
            <!-- keep system temp directory clean -->
            <java.io.tmpdir>${project.build.directory}</java.io.tmpdir>
            <!--
            See profile 'randomize-environment'
            -->
            <user.timezone>${testTimezone}</user.timezone>
          </systemPropertyVariables>
          <threadCount>1</threadCount>
        </configuration>
      </plugin>
    </plugins>
  </build>

  <dependencyManagement>
    <dependencies>
      <!-- SonarQube modules -->
      <dependency>
        <groupId>org.codehaus.sonar</groupId>
        <artifactId>sonar-channel</artifactId>
        <version>4.1</version>
        <exclusions>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.codehaus.sonar</groupId>
        <artifactId>sonar-classloader</artifactId>
        <version>1.0</version>
      </dependency>
      <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>sonar-markdown</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>sonar-core</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>sonar-db-dao</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>sonar-db-migration</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>sonar-db-testing</artifactId>
        <version>${project.version}</version>
        <type>pom</type>
      </dependency>
      <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>sonar-scanner-protocol</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>sonar-ws</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>sonar-home</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>sonar-plugin-api</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>sonar-process</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>sonar-server</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.update-center</groupId>
        <artifactId>sonar-update-center-common</artifactId>
        <version>${sonarUpdateCenter.version}</version>
      </dependency>
      <dependency>
        <groupId>org.codehaus.sonar</groupId>
        <artifactId>sonar-squid</artifactId>
        <version>4.1</version>
        <exclusions>
          <exclusion>
            <!--
            Provided at runtime by sonar-plugin-api.
            Do not use transitive version 4.1 but the current version.
             -->
            <groupId>org.codehaus.sonar</groupId>
            <artifactId>sonar-check-api</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.sonarqube</groupId>
        <artifactId>sonar-xoo-plugin</artifactId>
        <version>${project.version}</version>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.scm.git</groupId>
        <artifactId>sonar-scm-git-plugin</artifactId>
        <version>${sonarGit.version}</version>
        <type>sonar-plugin</type>
        <exclusions>
          <!--
          no need for transitive dependencies as only the JAR file
          is needed for the zip bundle
          -->
          <exclusion>
            <groupId>org.eclipse.jgit</groupId>
            <artifactId>org.eclipse.jgit</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.scm.svn</groupId>
        <artifactId>sonar-scm-svn-plugin</artifactId>
        <version>${sonarSvn.version}</version>
        <type>sonar-plugin</type>
        <exclusions>
          <!--
          no need for transitive dependencies as only the JAR file
          is needed for the zip bundle
          -->
          <exclusion>
            <groupId>org.tmatesoft.svnkit</groupId>
            <artifactId>svnkit</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.sonarqube</groupId>
        <artifactId>sonar-db-core</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.sonarqube</groupId>
        <artifactId>sonar-db-testing</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.sonarqube</groupId>
        <artifactId>sonar-testing-harness</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.sonarqube</groupId>
        <artifactId>sonar-plugin-bridge</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.java</groupId>
        <artifactId>sonar-java-plugin</artifactId>
        <version>${sonarJava.version}</version>
        <type>sonar-plugin</type>
        <exclusions>
          <!--
          no need for transitive dependencies as only the JAR file
          is needed for the zip bundle
          -->
          <exclusion>
            <groupId>classworlds</groupId>
            <artifactId>classworlds</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-all</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.sonarsource.java</groupId>
            <artifactId>java-surefire</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.sonarsource.java</groupId>
            <artifactId>java-jacoco</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.sonarsource.java</groupId>
            <artifactId>java-frontend</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.sonarsource.java</groupId>
            <artifactId>java-checks</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.javascript</groupId>
        <artifactId>sonar-javascript-plugin</artifactId>
        <version>${sonarJavaScript.version}</version>
        <type>sonar-plugin</type>
        <exclusions>
          <!--
          no need for transitive dependencies as only the JAR file
          is needed for the zip bundle
          -->
          <exclusion>
            <groupId>org.sonarsource.javascript</groupId>
            <artifactId>javascript-frontend</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.sonarsource.javascript</groupId>
            <artifactId>javascript-checks</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.dotnet</groupId>
        <artifactId>sonar-csharp-plugin</artifactId>
        <version>${sonarCSharp.version}</version>
        <type>sonar-plugin</type>
        <exclusions>
          <exclusion>
            <groupId>org.sonarsource.dotnet</groupId>
            <artifactId>sonar-dotnet-tests-library</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.sonarsource.dotnet</groupId>
            <artifactId>sonar-dotnet-shared-library</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.sonarsource.sslr-squid-bridge</groupId>
            <artifactId>sslr-squid-bridge</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.php</groupId>
        <artifactId>sonar-php-plugin</artifactId>
        <version>${sonarPhp.version}</version>
        <type>sonar-plugin</type>
        <exclusions>
          <!--
          no need for transitive dependencies as only the JAR file
          is needed for the zip bundle
          -->
          <exclusion>
            <groupId>org.sonarsource.php</groupId>
            <artifactId>php-frontend</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.sonarsource.php</groupId>
            <artifactId>php-checks</artifactId>
          </exclusion>
          <exclusion>
            <groupId>com.thoughtworks.xstream</groupId>
            <artifactId>xstream</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.python</groupId>
        <artifactId>sonar-python-plugin</artifactId>
        <version>${sonarPython.version}</version>
        <type>sonar-plugin</type>
        <exclusions>
          <!--
          no need for transitive dependencies as only the JAR file
          is needed for the zip bundle
          -->
          <exclusion>
            <groupId>org.sonarsource.python</groupId>
            <artifactId>python-squid</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.sonarsource.python</groupId>
            <artifactId>python-checks</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.codehaus.woodstox</groupId>
            <artifactId>woodstox-core-lgpl</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.codehaus.staxmate</groupId>
            <artifactId>staxmate</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.flex</groupId>
        <artifactId>sonar-flex-plugin</artifactId>
        <version>${sonarFlex.version}</version>
        <type>sonar-plugin</type>
        <exclusions>
          <!--
          no need for transitive dependencies as only the JAR file
          is needed for the zip bundle
          -->
          <exclusion>
            <groupId>org.sonarsource.flex</groupId>
            <artifactId>flex-squid</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.sonarsource.flex</groupId>
            <artifactId>flex-checks</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.sonarsource.xml</groupId>
        <artifactId>sonar-xml-plugin</artifactId>
        <version>${sonarXml.version}</version>
        <type>sonar-plugin</type>
        <exclusions>
          <!--
          no need for transitive dependencies as only the JAR file
          is needed for the zip bundle
          -->
          <exclusion>
            <groupId>org.sonarsource.xml</groupId>
            <artifactId>xml-squid</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>com.hazelcast</groupId>
        <artifactId>hazelcast</artifactId>
        <version>${hazelcast.version}</version>
      </dependency>
      <dependency>
        <groupId>com.hazelcast</groupId>
        <artifactId>hazelcast-client</artifactId>
        <version>${hazelcast.version}</version>
      </dependency>
      <dependency>
        <groupId>org.elasticsearch.client</groupId>
        <artifactId>transport</artifactId>
        <version>${elasticsearch.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.elasticsearch.plugin</groupId>
            <artifactId>lang-mustache-client</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.elasticsearch.plugin</groupId>
            <artifactId>transport-netty3-client</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>com.github.tlrx</groupId>
        <artifactId>elasticsearch-test</artifactId>
        <version>1.2.1</version>
      </dependency>
      <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>18.0</version>
      </dependency>
      <dependency>
        <groupId>com.google.code.findbugs</groupId>
        <artifactId>jsr305</artifactId>
        <version>3.0.2</version>
      </dependency>
      <dependency>
        <groupId>commons-dbutils</groupId>
        <artifactId>commons-dbutils</artifactId>
        <version>1.5</version>
      </dependency>
      <dependency>
        <groupId>commons-io</groupId>
        <artifactId>commons-io</artifactId>
        <version>2.4</version>
      </dependency>
      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-csv</artifactId>
        <version>1.4</version>
      </dependency>
      <dependency>
        <groupId>commons-codec</groupId>
        <artifactId>commons-codec</artifactId>
        <version>1.8</version>
      </dependency>
      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-email</artifactId>
        <version>1.5</version>
      </dependency>
      <dependency>
        <groupId>commons-lang</groupId>
        <artifactId>commons-lang</artifactId>
        <version>2.6</version>
      </dependency>
      <dependency>
        <groupId>commons-dbcp</groupId>
        <artifactId>commons-dbcp</artifactId>
        <version>1.4</version>
      </dependency>
      <dependency>
        <!-- See SONAR-2512 -->
        <groupId>commons-beanutils</groupId>
        <artifactId>commons-beanutils</artifactId>
        <version>1.8.3</version>
        <exclusions>
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>com.ibm.icu</groupId>
        <artifactId>icu4j</artifactId>
        <!-- animal-sniffer doesn't work with 2.6.1 -->
        <version>3.4.4</version>
      </dependency>
      <dependency>
        <groupId>com.googlecode.json-simple</groupId>
        <artifactId>json-simple</artifactId>
        <version>1.1.1</version>
        <exclusions>
          <exclusion>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt</artifactId>
        <version>0.6.0</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-core</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-annotations</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>org.yaml</groupId>
        <artifactId>snakeyaml</artifactId>
        <version>1.15</version>
      </dependency>
      <dependency>
        <groupId>org.mybatis</groupId>
        <artifactId>mybatis</artifactId>
        <version>3.4.4</version>
      </dependency>
      <dependency>
        <groupId>org.nanohttpd</groupId>
        <artifactId>nanohttpd</artifactId>
        <version>2.3.0</version>
      </dependency>
      <dependency>
        <groupId>org.picocontainer</groupId>
        <artifactId>picocontainer</artifactId>
        <version>2.15</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-api</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>jul-to-slf4j</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>jcl-over-slf4j</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>log4j-over-slf4j</artifactId>
        <version>${slf4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-to-slf4j</artifactId>
        <version>${log4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-api</artifactId>
        <version>${log4j.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core</artifactId>
        <version>${log4j.version}</version>
      </dependency>
      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-access</artifactId>
        <version>${logback.version}</version>
      </dependency>
      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-classic</artifactId>
        <version>${logback.version}</version>
      </dependency>
      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-core</artifactId>
        <version>${logback.version}</version>
      </dependency>
      <dependency>
        <groupId>com.h2database</groupId>
        <artifactId>h2</artifactId>
        <version>${h2.version}</version>
      </dependency>
      <dependency>
        <groupId>com.microsoft.sqlserver</groupId>
        <artifactId>mssql-jdbc</artifactId>
        <version>6.1.0.jre8</version>
      </dependency>
      <dependency>
        <groupId>mysql</groupId>
        <artifactId>mysql-connector-java</artifactId>
        <version>5.1.42</version>
      </dependency>
      <dependency>
        <groupId>com.oracle.jdbc</groupId>
        <artifactId>ojdbc8</artifactId>
        <!--
             This version is compatible with Oracle 11g and 12c :
             http://www.oracle.com/technetwork/database/enterprise-edition/jdbc-faq-090281.html#01_02
        -->
        <version>12.2.0.1.0</version>
     </dependency>
      <dependency>
        <groupId>org.postgresql</groupId>
        <artifactId>postgresql</artifactId>
        <version>42.1.1</version>
      </dependency>
      <dependency>
        <groupId>org.codehaus.woodstox</groupId>
        <artifactId>woodstox-core-lgpl</artifactId>
        <version>4.4.0</version>
        <exclusions>
          <exclusion>
            <!-- provided by Java 1.7 -->
            <groupId>javax.xml.stream</groupId>
            <artifactId>stax-api</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.codehaus.staxmate</groupId>
        <artifactId>staxmate</artifactId>
        <version>2.0.1</version>
        <exclusions>
          <!-- see SONAR-879 -->
          <exclusion>
            <groupId>org.codehaus.woodstox</groupId>
            <artifactId>stax2-api</artifactId>
          </exclusion>
          <exclusion>
            <groupId>stax</groupId>
            <artifactId>stax-api</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.codehaus.woodstox</groupId>
            <artifactId>woodstox-core-asl</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.mockito</groupId>
        <artifactId>mockito-core</artifactId>
        <version>1.10.19</version>
        <exclusions>
          <exclusion>
            <groupId>org.hamcrest</groupId>
            <artifactId>hamcrest-core</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.assertj</groupId>
        <artifactId>assertj-core</artifactId>
        <version>3.4.1</version>
      </dependency>
      <dependency>
        <groupId>org.assertj</groupId>
        <artifactId>assertj-guava</artifactId>
        <version>3.0.0</version>
      </dependency>
      <dependency>
        <groupId>org.codehaus.woodstox</groupId>
        <artifactId>stax2-api</artifactId>
        <version>3.1.4</version>
        <exclusions>
          <exclusion>
            <groupId>stax</groupId>
            <artifactId>stax-api</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>javax.servlet-api</artifactId>
        <version>3.0.1</version>
      </dependency>
      <dependency>
        <groupId>org.eclipse.jetty</groupId>
        <artifactId>jetty-server</artifactId>
        <version>${jetty.version}</version>
      </dependency>
      <dependency>
        <groupId>org.hamcrest</groupId>
        <artifactId>hamcrest-all</artifactId>
        <version>1.3</version>
      </dependency>
      <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
        <version>4.12</version>
      </dependency>
      <dependency>
        <groupId>com.tngtech.java</groupId>
        <artifactId>junit-dataprovider</artifactId>
        <version>1.9.2</version>
      </dependency>
      <dependency>
        <groupId>org.dbunit</groupId>
        <artifactId>dbunit</artifactId>
        <version>2.4.5</version>
        <exclusions>
          <!--  removing commons lang 2.1 and xerces-->
          <exclusion>
            <groupId>commons-lang</groupId>
            <artifactId>commons-lang</artifactId>
          </exclusion>
          <exclusion>
            <groupId>xerces</groupId>
            <artifactId>xmlParserAPIs</artifactId>
          </exclusion>
          <exclusion>
            <groupId>xerces</groupId>
            <artifactId>xercesImpl</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.eclipse.jetty</groupId>
        <artifactId>test-jetty-servlet</artifactId>
        <version>${jetty.version}</version>
      </dependency>
      <dependency>
        <groupId>org.reflections</groupId>
        <artifactId>reflections</artifactId>
        <version>0.9.9</version>
      </dependency>
      <dependency>
        <groupId>com.google.code.gson</groupId>
        <artifactId>gson</artifactId>
        <version>2.3.1</version>
      </dependency>
      <dependency>
        <groupId>org.sonarsource</groupId>
        <artifactId>sonar-persistit</artifactId>
        <version>3.3.2</version>
        <exclusions>
          <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>com.github.kevinsawicki</groupId>
        <artifactId>http-request</artifactId>
        <version>5.4.1</version>
      </dependency>
      <dependency>
        <groupId>org.codehaus.sonar.runner</groupId>
        <artifactId>sonar-runner-api</artifactId>
        <version>2.4</version>
      </dependency>
      <dependency>
        <groupId>org.freemarker</groupId>
        <artifactId>freemarker</artifactId>
        <version>2.3.20</version>
      </dependency>
      <dependency>
        <groupId>com.google.protobuf</groupId>
        <artifactId>protobuf-java</artifactId>
        <version>${protobuf.version}</version>
      </dependency>
      <dependency>
        <groupId>net.jpountz.lz4</groupId>
        <artifactId>lz4</artifactId>
        <version>1.3.0</version>
      </dependency>
      <dependency>
        <groupId>org.subethamail</groupId>
        <artifactId>subethasmtp</artifactId>
        <version>3.1.7</version>
        <scope>test</scope>
      </dependency>

      <!-- tomcat -->
      <dependency>
        <groupId>org.apache.tomcat.embed</groupId>
        <artifactId>tomcat-embed-core</artifactId>
        <version>${tomcat.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.apache.tomcat.embed</groupId>
            <artifactId>tomcat-embed-jasper</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.eclipse.jdt</groupId>
            <artifactId>ecj</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>com.squareup.okhttp3</groupId>
        <artifactId>okhttp</artifactId>
        <version>${okhttp.version}</version>
      </dependency>
      <dependency>
        <groupId>com.squareup.okhttp3</groupId>
        <artifactId>mockwebserver</artifactId>
        <version>${okhttp.version}</version>
      </dependency>

      <!-- Using scope=provided to exclude from all transitive dependencies -->
      <dependency>
        <groupId>xml-apis</groupId>
        <artifactId>xml-apis</artifactId>
        <version>1.4.01</version>
        <scope>provided</scope>
      </dependency>

    </dependencies>
  </dependencyManagement>

  <mailingLists>
    <mailingList>
      <name>SonarQube users mailing list</name>
      <subscribe>http://xircles.codehaus.org/projects/sonar/lists</subscribe>
      <unsubscribe>http://xircles.codehaus.org/projects/sonar/lists</unsubscribe>
      <post>user@sonar.codehaus.org</post>
      <archive>http://www.nabble.com/Sonar-f30151.html</archive>
    </mailingList>
  </mailingLists>

  <scm>
    <connection>scm:git:git@github.com:SonarSource/sonarqube.git</connection>
    <developerConnection>scm:git:git@github.com:SonarSource/sonarqube.git</developerConnection>
    <url>https://github.com/SonarSource/sonarqube</url>
    <tag>HEAD</tag>
  </scm>

  <ciManagement>
    <system>travis-ci</system>
    <url>https://travis-ci.org/SonarSource/sonarqube</url>
  </ciManagement>

  <licenses>
    <license>
      <name>GNU LGPL 3</name>
      <url>http://www.gnu.org/licenses/lgpl.txt</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <!-- Developers information should not be removed as it's
  required for deployment -->

  <developers>
    <developer>
      <id>bellingard</id>
      <name>Fabrice Bellingard</name>
      <email>fabrice.bellingard@sonarsource.com</email>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>dbolkensteyn</id>
      <name>Dinesh Bolkensteyn</name>
      <email>dinesh.bolkensteyn@sonarsource.com</email>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>dgageot</id>
      <name>David Gageot</name>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>ehartmann</id>
      <name>Eric Hartmann</name>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>fmallet</id>
      <name>Freddy Mallet</name>
      <email>freddy.mallet@sonarsource.com</email>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>Godin</id>
      <name>Evgeny Mandrikov</name>
      <email>evgeny.mandrikov@sonarsource.com</email>
      <organization>SonarSource</organization>
      <timezone>+3</timezone>
    </developer>
    <developer>
      <id>henryju</id>
      <name>Julien Henry</name>
      <email>julien.henry@sonarsource.com</email>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>jblievremont</id>
      <name>Jean-Baptiste Lievremont</name>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>julienlancelot</id>
      <name>Julien Lancelot</name>
      <email>julien.lancelot@sonarsource.com</email>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>olivier.gaudin</id>
      <name>Olivier Gaudin</name>
      <email>olivier.gaudin@sonarsource.com</email>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>simonbrandhof</id>
      <name>Simon Brandhof</name>
      <email>simon.brandhof@sonarsource.com</email>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>sns-seb</id>
      <name>Sebastien Lesaint</name>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>stas-vilchik</id>
      <name>Stas Vilchik</name>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
    <developer>
      <id>teryk</id>
      <name>Teryk Bellahsene</name>
      <organization>SonarSource</organization>
      <timezone>+1</timezone>
    </developer>
  </developers>

  <profiles>
    <profile>
      <id>dev</id>
      <properties>
        <skipSanityChecks>true</skipSanityChecks>
        <enforcer.skip>true</enforcer.skip>
      </properties>
    </profile>
    <profile>
      <id>release</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-javadoc-plugin</artifactId>
            <executions>
              <execution>
                <id>attach-javadocs</id>
                <goals>
                  <goal>jar</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>

    <profile>
      <id>protobuf-compile</id>
      <activation>
        <file>
          <exists>src/main/protobuf</exists>
        </file>
      </activation>
      <build>
        <plugins>
          <plugin>
            <groupId>org.xolstice.maven.plugins</groupId>
            <artifactId>protobuf-maven-plugin</artifactId>
            <executions>
              <execution>
                <id>generate-protobuf-java-sources</id>
                <goals>
                  <goal>compile</goal>
                </goals>
                <configuration>
                  <protocArtifact>com.google.protobuf:protoc:${protobuf.version}:exe:${os.detected.classifier}
                  </protocArtifact>
                  <protoSourceRoot>${project.basedir}/src/main/protobuf</protoSourceRoot>
                  <outputDirectory>${project.build.directory}/generated-sources/protobuf</outputDirectory>
                </configuration>
              </execution>
            </executions>
            <dependencies>
              <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protoc</artifactId>
                <version>${protobuf.version}</version>
                <type>exe</type>
                <classifier>${os.detected.classifier}</classifier>
              </dependency>
            </dependencies>
          </plugin>
          <plugin>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>build-helper-maven-plugin</artifactId>
            <executions>
              <execution>
                <id>add-protobuf-generated-sources</id>
                <phase>generate-sources</phase>
                <goals>
                  <goal>add-source</goal>
                </goals>
                <configuration>
                  <sources>
                    <source>${project.build.directory}/generated-sources/protobuf</source>
                  </sources>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>protobuf-test-compile</id>
      <activation>
        <file>
          <exists>src/test/protobuf</exists>
        </file>
      </activation>
      <build>
        <plugins>
          <plugin>
            <groupId>org.xolstice.maven.plugins</groupId>
            <artifactId>protobuf-maven-plugin</artifactId>
            <executions>
              <execution>
                <id>generate-protobuf-java-tests</id>
                <goals>
                  <goal>test-compile</goal>
                </goals>
                <configuration>
                  <protocArtifact>com.google.protobuf:protoc:${protobuf.version}:exe:${os.detected.classifier}
                  </protocArtifact>
                  <protoTestSourceRoot>${project.basedir}/src/test/protobuf</protoTestSourceRoot>
                  <outputDirectory>${project.build.directory}/generated-test-sources/protobuf</outputDirectory>
                </configuration>
              </execution>
            </executions>
            <dependencies>
              <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protoc</artifactId>
                <version>${protobuf.version}</version>
                <classifier>${os.detected.classifier}</classifier>
                <type>exe</type>
              </dependency>
            </dependencies>
          </plugin>
          <plugin>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>build-helper-maven-plugin</artifactId>
            <executions>
              <execution>
                <id>add-protobuf-generated-tests</id>
                <phase>generate-test-sources</phase>
                <goals>
                  <goal>add-test-source</goal>
                </goals>
                <configuration>
                  <sources>
                    <source>${project.build.directory}/generated-test-sources/protobuf</source>
                  </sources>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>

    <profile>
      <!--
      check if maven dependencies have vulnerabilities listed in CVE
      Standalone command: mvn org.owasp:dependency-check-maven:check
      See http://jeremylong.github.io/DependencyCheck
      -->
      <id>securityCheck</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.owasp</groupId>
            <artifactId>dependency-check-maven</artifactId>
            <executions>
              <execution>
                <goals>
                  <goal>check</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>

    <profile>
      <!-- integration tests -->
      <id>tests</id>
      <modules>
        <module>tests</module>
        <module>tests/plugins</module>
      </modules>
    </profile>
  </profiles>

</project>