sonarqube/sonar-plugin-api-deps/pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <parent>
    <groupId>org.sonarsource.sonarqube</groupId>
    <artifactId>sonarqube</artifactId>
    <version>7.1-SNAPSHOT</version>
  </parent>

  <artifactId>sonar-plugin-api-deps</artifactId>

  <name>SonarQube :: Plugin API Dependencies</name>
  <description>Deprecated transitive dependencies of sonar-plugin-api</description>

  <properties>
    <maven.deploy.skip>true</maven.deploy.skip>
  </properties>
  
  <dependencies>

    <!--
    Versions must not be changed and overridden from parent pom. These are
    the versions defined in SQ 5.1
    -->

    <dependency>
      <groupId>com.google.code.gson</groupId>
      <artifactId>gson</artifactId>
      <version>2.3.1</version>
    </dependency>
    <dependency>
      <groupId>com.google.guava</groupId>
      <artifactId>guava</artifactId>
      <version>10.0.1</version>
    </dependency>
    <dependency>
      <groupId>commons-beanutils</groupId>
      <artifactId>commons-beanutils</artifactId>
      <version>1.9.3</version>
    </dependency>
    <dependency>
      <groupId>commons-codec</groupId>
      <artifactId>commons-codec</artifactId>
      <version>1.8</version>
    </dependency>
    <dependency>
      <groupId>commons-collections</groupId>
      <artifactId>commons-collections</artifactId>
      <version>3.2.2</version>
    </dependency>
    <dependency>
      <groupId>org.apache.commons</groupId>
      <artifactId>commons-email</artifactId>
      <version>1.3.2</version>
    </dependency>
    <dependency>
      <groupId>commons-io</groupId>
      <artifactId>commons-io</artifactId>
      <version>2.4</version>
    </dependency>
    <dependency>
      <groupId>commons-lang</groupId>
      <artifactId>commons-lang</artifactId>
      <version>2.6</version>
    </dependency>
    <dependency>
      <groupId>dom4j</groupId>
      <artifactId>dom4j</artifactId>
      <version>1.6.1</version>
    </dependency>
    <dependency>
      <groupId>xml-apis</groupId>
      <artifactId>xml-apis</artifactId>
      <version>1.4.01</version>
    </dependency>
    <dependency>
      <groupId>org.picocontainer</groupId>
      <artifactId>picocontainer</artifactId>
      <version>2.14.3</version>
    </dependency>
    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>slf4j-api</artifactId>
      <version>1.7.10</version>
    </dependency>
    <dependency>
      <groupId>ch.qos.logback</groupId>
      <artifactId>logback-classic</artifactId>
      <version>1.1.2</version>
    </dependency>
    <dependency>
      <groupId>ch.qos.logback</groupId>
      <artifactId>logback-core</artifactId>
      <version>1.1.2</version>
    </dependency>
    <!-- Needed by old versions of Java plugin (JavaClasspath) -->
    <dependency>
      <groupId>org.apache.maven</groupId>
      <artifactId>maven-core</artifactId>
      <version>3.0.5</version>
      <exclusions>
        <exclusion>
          <!-- See SONAR-2455 -->
          <groupId>classworlds</groupId>
          <artifactId>classworlds</artifactId>
        </exclusion>
        <exclusion>
          <!-- this fork conflicts with google's guava -->
          <groupId>org.sonatype.sisu</groupId>
          <artifactId>sisu-guava</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.apache.maven</groupId>
      <artifactId>maven-artifact</artifactId>
      <version>3.0.5</version>
    </dependency>
    <dependency>
      <groupId>org.codehaus.sonar</groupId>
      <artifactId>sonar-squid</artifactId>
      <version>4.1</version>
      <exclusions>
        <exclusion>
          <!--
          Provided at runtime by sonar-plugin-api.
          Do not use transitive version 4.1 but the current version.
           -->
          <groupId>org.codehaus.sonar</groupId>
          <artifactId>sonar-check-api</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.codehaus.sonar</groupId>
      <artifactId>sonar-java-api</artifactId>
      <version>5.1</version>
      <exclusions>
        <exclusion>
          <groupId>org.codehaus.sonar</groupId>
          <artifactId>sonar-deprecated</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.codehaus.sonar</groupId>
          <artifactId>sonar-plugin-api</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
  </dependencies>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-shade-plugin</artifactId>
        <executions>
          <execution>
            <phase>package</phase>
            <goals>
              <goal>shade</goal>
            </goals>
            <configuration>
              <minimizeJar>false</minimizeJar>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jar-plugin</artifactId>
        <executions>
          <execution>
            <id>empty-javadoc-jar</id>
            <phase>package</phase>
            <goals>
              <goal>jar</goal>
            </goals>
            <configuration>
              <classifier>javadoc</classifier>
            </configuration>
          </execution>
          <execution>
            <id>empty-sources-jar</id>
            <phase>package</phase>
            <goals>
              <goal>jar</goal>
            </goals>
            <configuration>
              <classifier>sources</classifier>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

  <profiles>
    <!--
    This module contains deprecated dependencies (containing vulnerability issues) for plugins built for SonarQube < 5.2
    It will be removed for 7.0
    -->
    <profile>
      <!--
      check if maven dependencies have vulnerabilities listed in CVE
      Standalone command: mvn org.owasp:dependency-check-maven:check
      See http://jeremylong.github.io/DependencyCheck
      -->
      <id>securityCheck</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.owasp</groupId>
            <artifactId>dependency-check-maven</artifactId>
            <executions>
              <execution>
                <goals>
                  <goal>check</goal>
                </goals>
                <configuration>
                  <skip>true</skip>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>

</project>