<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <artifactId>aws-serverless-java-container-core</artifactId>
    <name>AWS Serverless Java container support - Core</name>
    <description>Allows Java applications written for a servlet container to run in AWS Lambda</description>
    <url>https://aws.amazon.com/lambda</url>
    <version>1.1.2</version>

    <parent>
        <groupId>com.amazonaws.serverless</groupId>
        <artifactId>aws-serverless-java-container</artifactId>
        <version>1.1.2</version>
    </parent>

    <properties>
        <jackson.version>2.9.5</jackson.version>
        <jaxrs.version>2.1</jaxrs.version>
        <servlet.version>3.1.0</servlet.version>
    </properties>

    <dependencies>
        <!-- https://mvnrepository.com/artifact/com.amazonaws/aws-lambda-java-core -->
        <dependency>
            <groupId>com.amazonaws</groupId>
            <artifactId>aws-lambda-java-core</artifactId>
            <version>1.2.0</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/javax.servlet/javax.servlet-api -->
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>javax.servlet-api</artifactId>
            <version>${servlet.version}</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/javax.ws.rs/javax.ws.rs-api -->
        <dependency>
            <groupId>javax.ws.rs</groupId>
            <artifactId>javax.ws.rs-api</artifactId>
            <version>${jaxrs.version}</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>${jackson.version}</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/commons-fileupload/commons-fileupload -->
        <dependency>
            <groupId>commons-fileupload</groupId>
            <artifactId>commons-fileupload</artifactId>
            <version>1.3.3</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/org.apache.httpcomponents/httpmime -->
        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
            <artifactId>httpmime</artifactId>
            <version>4.5.3</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>3.1.1</version>
                <configuration>
                    <!--
                        Enables analysis which takes more memory but finds more bugs.
                        If you run out of memory, changes the value of the effort element
                        to 'Low'.
                    -->
                    <effort>Max</effort>
                    <!-- Reports all bugs (other values are medium and max) -->
                    <threshold>Low</threshold>
                    <!-- Produces XML report -->
                    <xmlOutput>true</xmlOutput>
                    <!-- Configures the directory in which the XML report is created -->
                    <spotbugsXmlOutputDirectory>${project.build.directory}/spotbugs</spotbugsXmlOutputDirectory>

                    <plugins>
                        <plugin>
                            <groupId>com.h3xstream.findsecbugs</groupId>
                            <artifactId>findsecbugs-plugin</artifactId>
                            <version>1.7.1</version>
                        </plugin>
                    </plugins>
                </configuration>
                <executions>
                    <!--
                        Ensures that SpotBug inspects source code when project is compiled.
                    -->
                    <execution>
                        <id>analyze-compile</id>
                        <phase>compile</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <version>3.1.1</version>
                <configuration>
                    <skipProvidedScope>true</skipProvidedScope>
                    <suppressionFiles>
                        <suppressionFile>${project.basedir}/../owasp-suppression.xml</suppressionFile>
                    </suppressionFiles>
                    <failBuildOnCVSS>7</failBuildOnCVSS>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

</project>
