<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>xyz.tcheeric</groupId>
    <artifactId>cashu-wallet</artifactId>
    <version>0.8.2</version>
    <packaging>pom</packaging>

    <name>cashu-wallet</name>
    <url>http://maven.apache.org</url>
    <modules>
        <module>cashu-wallet-protocol</module>
        <module>cashu-wallet-client</module>
    </modules>

    <distributionManagement>
        <repository>
            <id>reposilite-releases</id>
            <url>https://maven.398ja.xyz/releases</url>
        </repository>
        <snapshotRepository>
            <id>reposilite-snapshots</id>
            <url>https://maven.398ja.xyz/snapshots</url>
        </snapshotRepository>
    </distributionManagement>

    <repositories>
        <repository>
            <id>reposilite-snapshots</id>
            <url>https://maven.398ja.xyz/snapshots</url>
            <snapshots>
                <checksumPolicy>fail</checksumPolicy>
            </snapshots>
            <releases>
                <checksumPolicy>fail</checksumPolicy>
            </releases>
        </repository>
        <repository>
            <id>reposilite-releases</id>
            <url>https://maven.398ja.xyz/releases</url>
            <releases>
                <checksumPolicy>fail</checksumPolicy>
            </releases>
            <snapshots>
                <checksumPolicy>fail</checksumPolicy>
            </snapshots>
        </repository>
    </repositories>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.source>21</maven.compiler.source>
        <maven.compiler.target>21</maven.compiler.target>

        <!-- Dependency Versions -->
        <cashu-lib.version>0.30.5</cashu-lib.version>
        <cashu-voucher.version>0.14.4</cashu-voucher.version>
        <bip-utils.version>2.0.0</bip-utils.version>
        <spring-boot.version>3.5.16</spring-boot.version>

        <!-- Tomcat, overriding what Spring Boot pins. Boot 3.5.16 ships
             10.1.55, which OSV still reports as carrying three CRITICALs
             including CVE-2026-43512 and CVE-2026-65905, both authentication
             bypasses. The advisories name 10.1.58 as the fix, but that version
             was never published to Maven Central (the index skips .57 to .59),
             so the real floor is 10.1.59.
             Remove this override once a Boot release ships >= 10.1.59. -->
        <tomcat.version>10.1.59</tomcat.version>
        <junit-jupiter.version>5.12.2</junit-jupiter.version>
        <junit-platform.version>1.13.4</junit-platform.version>
        <mockito.version>5.19.0</mockito.version>
        <assertj.version>3.27.4</assertj.version>
        <lombok.version>1.18.40</lombok.version>
    </properties>

    <dependencyManagement>
        <dependencies>
            <!-- Tomcat and BouncyCastle, pinned AHEAD of the Spring Boot
                 import below. Order is load-bearing: the imported
                 spring-boot-dependencies resolves ${tomcat.version} against its
                 OWN properties, not ours, so setting the property alone looks
                 right and does nothing. Only an explicit entry declared BEFORE
                 the import wins, because Maven takes the first declaration.
                 BouncyCastle: CVE-2025-14813 is fixed in 1.80.2, 1.81.1 and
                 1.84 only. NOT 1.83, which OSV reports as carrying more
                 vulnerabilities than the 1.81 it would replace. -->
            <dependency>
                <groupId>org.apache.tomcat.embed</groupId>
                <artifactId>tomcat-embed-core</artifactId>
                <version>${tomcat.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.tomcat.embed</groupId>
                <artifactId>tomcat-embed-el</artifactId>
                <version>${tomcat.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.tomcat.embed</groupId>
                <artifactId>tomcat-embed-websocket</artifactId>
                <version>${tomcat.version}</version>
            </dependency>
            <dependency>
                <groupId>org.bouncycastle</groupId>
                <artifactId>bcprov-jdk18on</artifactId>
                <version>1.85</version>
            </dependency>
            <dependency>
                <groupId>org.bouncycastle</groupId>
                <artifactId>bcprov-jdk15to18</artifactId>
                <version>1.85</version>
            </dependency>

            <!-- Import Spring Boot BOM -->
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>${spring-boot.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- JUnit BOM - imported AFTER Spring Boot to override mismatched versions -->
            <dependency>
                <groupId>org.junit</groupId>
                <artifactId>junit-bom</artifactId>
                <version>${junit-jupiter.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- Explicit JUnit Platform overrides -->
            <dependency>
                <groupId>org.junit.platform</groupId>
                <artifactId>junit-platform-commons</artifactId>
                <version>${junit-platform.version}</version>
            </dependency>
            <dependency>
                <groupId>org.junit.platform</groupId>
                <artifactId>junit-platform-engine</artifactId>
                <version>${junit-platform.version}</version>
            </dependency>
            <dependency>
                <groupId>org.junit.platform</groupId>
                <artifactId>junit-platform-launcher</artifactId>
                <version>${junit-platform.version}</version>
            </dependency>

            <!-- Cashu Library Modules -->
            <dependency>
                <groupId>xyz.tcheeric</groupId>
                <artifactId>cashu-lib-entities</artifactId>
                <version>${cashu-lib.version}</version>
            </dependency>
            <dependency>
                <groupId>xyz.tcheeric</groupId>
                <artifactId>cashu-lib-crypto</artifactId>
                <version>${cashu-lib.version}</version>
            </dependency>
            <dependency>
                <groupId>xyz.tcheeric</groupId>
                <artifactId>cashu-lib-common</artifactId>
                <version>${cashu-lib.version}</version>
            </dependency>

            <!-- Cashu Voucher Modules -->
            <dependency>
                <groupId>xyz.tcheeric</groupId>
                <artifactId>cashu-voucher-domain</artifactId>
                <version>${cashu-voucher.version}</version>
            </dependency>
            <dependency>
                <groupId>xyz.tcheeric</groupId>
                <artifactId>cashu-voucher-app</artifactId>
                <version>${cashu-voucher.version}</version>
            </dependency>
            <dependency>
                <groupId>xyz.tcheeric</groupId>
                <artifactId>cashu-voucher-nostr</artifactId>
                <version>${cashu-voucher.version}</version>
            </dependency>

            <!-- BIP Utils -->
            <dependency>
                <groupId>xyz.tcheeric</groupId>
                <artifactId>bip-utils</artifactId>
                <version>${bip-utils.version}</version>
            </dependency>

            <!-- Test Dependencies -->
            <dependency>
                <groupId>org.mockito</groupId>
                <artifactId>mockito-core</artifactId>
                <version>${mockito.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.mockito</groupId>
                <artifactId>mockito-junit-jupiter</artifactId>
                <version>${mockito.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.assertj</groupId>
                <artifactId>assertj-core</artifactId>
                <version>${assertj.version}</version>
                <scope>test</scope>
            </dependency>

            <!-- Annotation Processors -->
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <version>${lombok.version}</version>
                <scope>provided</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <pluginManagement>
            <plugins>
                <!-- Import plugin management from cashu-platform-bom -->
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.14.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>3.5.4</version>
                    <configuration>
                        <!-- Enable Virtual Thread pinning detection during tests -->
                        <argLine>-Djdk.tracePinnedThreads=short</argLine>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.jacoco</groupId>
                    <artifactId>jacoco-maven-plugin</artifactId>
                    <version>0.8.13</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-failsafe-plugin</artifactId>
                    <version>3.5.4</version>
                </plugin>
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>flatten-maven-plugin</artifactId>
                    <version>1.7.2</version>
                </plugin>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                    <version>3.5.5</version>
                </plugin>
                <plugin>
                    <groupId>org.owasp</groupId>
                    <artifactId>dependency-check-maven</artifactId>
                    <version>12.1.1</version>
                    <configuration>
                        <failBuildOnCVSS>7</failBuildOnCVSS>
                    </configuration>
                </plugin>
            </plugins>
        </pluginManagement>
        <plugins>
<!--
            <plugin>
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <executions>
                    <execution>
                        <goals>
                            <goal>check</goal>
                        </goals>
                        <phase>verify</phase>
                    </execution>
                </executions>
            </plugin>
-->
        </plugins>
    </build>

</project>
