pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.github.onsdigital</groupId>
    <artifactId>babbage</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>Babbage</name>
    <description>Backend of the ONS website</description>
    <url>https://www.ons.gov.uk/</url>

    <properties>
        <java.version>1.8</java.version>
        <!-- If moving beyond version 4.2.1 there is a dependency on handlebars-humanize that 
         must be resolved -->
        <handlebars-java-version>4.2.1</handlebars-java-version>
        <handlebars-markdown-java-version>4.2.0</handlebars-markdown-java-version>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <dp-logging.version>v2.0.0-beta.18</dp-logging.version>
        <fasterxml.jackson.version>2.21.4</fasterxml.jackson.version>
        <flying-saucer.version>9.4.1</flying-saucer.version>
        <mockito.version>3.12.4</mockito.version>
        <restolino.version>v0.8.3</restolino.version>
        <httpcomponents.version>5.6.2</httpcomponents.version>
    </properties>

    <dependencyManagement>
        <dependencies>
            <!-- Import the Jackson BOM to manage versions of Jackson dependencies as they move
              at different rates - e.g. jackson-annotations does not have a 2.21.4 -->
            <dependency>
                <groupId>com.fasterxml.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${fasterxml.jackson.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <dependency>
            <groupId>org.antlr</groupId>
            <artifactId>antlr4</artifactId>
            <version>4.13.1</version>
        </dependency>
        <!-- Prometheus client libraries -->
        <!-- Exposition HTTPServer-->
        <dependency>
            <groupId>io.prometheus</groupId>
            <artifactId>simpleclient_httpserver</artifactId>
            <version>0.16.0</version>
        </dependency>

         <!-- Logging -->
        <dependency>
            <groupId>com.github.onsdigital</groupId>
            <artifactId>dp-logging</artifactId>
            <version>${dp-logging.version}</version>
        </dependency>

        <!-- Prototyping framework -->
        <dependency>
            <groupId>com.github.onsdigital</groupId>
            <artifactId>restolino</artifactId>
            <version>${restolino.version}</version>
        </dependency>


        <dependency>
            <groupId>com.github.davidcarboni</groupId>
            <artifactId>resource-utils</artifactId>
            <version>1.2.2</version>
        </dependency>

        <!-- PDF Generation -->
        <dependency>
            <groupId>org.dom4j</groupId>
            <artifactId>dom4j</artifactId>
            <version>2.1.4</version>
        </dependency>

        <!-- Handlebars Java-->
        <dependency>
            <groupId>com.github.jknack</groupId>
            <artifactId>handlebars</artifactId>
            <version>${handlebars-java-version}</version>
        </dependency>
        <dependency>
            <groupId>com.github.jknack</groupId>
            <artifactId>handlebars-markdown</artifactId>
            <version>${handlebars-markdown-java-version}</version>
        </dependency>
        <dependency>
            <groupId>com.github.jknack</groupId>
            <artifactId>handlebars-humanize</artifactId>
            <version>${handlebars-java-version}</version>
        </dependency>
        <dependency>
            <groupId>com.github.jknack</groupId>
            <artifactId>handlebars-helpers</artifactId>
            <version>${handlebars-java-version}</version>
        </dependency>
        <dependency>
            <groupId>com.github.jknack</groupId>
            <artifactId>handlebars-jackson2</artifactId>
            <version>${handlebars-java-version}</version>
        </dependency>

        <!--Handlebars Java markdown uses a newer version of pegdown with a peculiar bug, overwriting dependency explicitly-->
        <!-- Warning - we overwrite the rendering for MailLinkNodes to stop obfuscation and so upgrading this dependency should bear this in mind -->
        <dependency>
            <groupId>org.pegdown</groupId>
            <artifactId>pegdown</artifactId>
            <version>1.4.2</version>
        </dependency>

        <!-- Cryptography -->
        <dependency>
            <groupId>com.github.onsdigital</groupId>
            <artifactId>dp-cryptolite-java</artifactId>
            <version>1.9.0</version>
        </dependency>

        <!-- Commons -->
        <dependency>
            <groupId>commons-lang</groupId>
            <artifactId>commons-lang</artifactId>
            <version>2.6</version>
        </dependency>

        <!-- Ical4j-->
        <dependency>
            <groupId>org.mnode.ical4j</groupId>
            <artifactId>ical4j</artifactId>
            <version>2.2.7</version>
        </dependency>

        <dependency>
            <groupId>org.xhtmlrenderer</groupId>
            <artifactId>flying-saucer-core</artifactId>
            <version>${flying-saucer.version}</version>
        </dependency>

        <dependency>
            <groupId>org.xhtmlrenderer</groupId>
            <artifactId>flying-saucer-pdf</artifactId>
            <version>${flying-saucer.version}</version>
        </dependency>

        <dependency>
            <groupId>org.jsoup</groupId>
            <artifactId>jsoup</artifactId>
            <version>1.17.2</version>
        </dependency>

        <!-- Test -->
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.13.2</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>${mockito.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-inline</artifactId>
            <version>${mockito.version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.apache.httpcomponents.core5</groupId>
            <artifactId>httpcore5</artifactId>
            <version>5.4.3</version>
        </dependency>

        <dependency>
            <groupId>org.apache.httpcomponents.client5</groupId>
            <artifactId>httpclient5</artifactId>
            <version>${httpcomponents.version}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.httpcomponents.client5</groupId>
            <artifactId>httpclient5-cache</artifactId>
            <version>${httpcomponents.version}</version>
        </dependency>

        <dependency>
            <groupId>org.reflections</groupId>
            <artifactId>reflections</artifactId>
            <version>0.10.2</version>
        </dependency>


        <!-- JWTs for signed URLs -->
        <dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>3.19.4</version>
        </dependency>

        <!-- Fasterxml Jackson dependencies - overrides vulnerable transitive dependencies
        and declared explicitly to resolve conflicts in handlebars -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-core</artifactId>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-annotations</artifactId>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.dataformat</groupId>
            <artifactId>jackson-dataformat-smile</artifactId>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.dataformat</groupId>
            <artifactId>jackson-dataformat-yaml</artifactId>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.dataformat</groupId>
            <artifactId>jackson-dataformat-cbor</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.pdfbox</groupId>
            <artifactId>pdfbox</artifactId>
            <version>2.0.30</version>
        </dependency>

        <!-- OpenTelemetry-->
        <dependency>
            <groupId>software.amazon.opentelemetry</groupId>
            <artifactId>aws-opentelemetry-agent</artifactId>
            <version>1.32.0</version>
        </dependency>
    </dependencies>

    <build>
        <resources>
            <!-- Standard resources -->
            <resource>
                <directory>${basedir}/src/main/resources</directory>
            </resource>
            <!-- Generated contents-->
            <resource>
                <directory>${basedir}/src/main/content</directory>
                <targetPath>${project.build.directory}/content</targetPath>
            </resource>
            <!-- Copy Sixteens to both source (for development) and target (for deployment) -->
            <resource>
                <directory>${basedir}/src/main/web/node_modules/sixteens/dist</directory>
                <targetPath>${basedir}/src/main/web/assets</targetPath>
            </resource>
            <resource>
                <directory>${basedir}/src/main/web/node_modules/sixteens/dist</directory>
                <targetPath>${project.build.directory}/web/assets</targetPath>
            </resource>
            <!-- Filter out node_modules for deployment -->
            <resource>
                <directory>src/main/web</directory>
                <targetPath>${project.build.directory}/web</targetPath>
                <excludes>
                    <exclude>node_modules/**</exclude>
                </excludes>
            </resource>
        </resources>
        <plugins>
            <!-- Needs Java 1.8 -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.12.1</version>
                <configuration>
                    <source>${java.version}</source>
                    <target>${java.version}</target>
                    <encoding>UTF-8</encoding>
                </configuration>
            </plugin>

            <!-- A folder of dependencies is used in development when reloading classes: -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-dependency-plugin</artifactId>
                <version>3.6.1</version>
                <executions>
                    <execution>
                        <id>copy-dependencies</id>
                        <phase>package</phase>
                        <goals>
                            <goal>copy-dependencies</goal>
                        </goals>
                        <!-- Default output folder is ${project.build.api}/dependency -->
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.sonatype.ossindex.maven</groupId>
                <artifactId>ossindex-maven-plugin</artifactId>
                <version>3.2.0</version>
                <!-- configuration for mvn ossindex:audit -->
                <configuration>
                    <authId>ossindex</authId>
                    <!-- if CVSS >= 7.0 (critical) then ERROR else WARN -->
                    <fail>true</fail>
                    <cvssScoreThreshold>7.0</cvssScoreThreshold>
                    <excludeCoordinates>
                        <!--
                            Jira Ticket to resolve: DIS-3662
                            This is to exclude vulnerability CVE-2023-2976
                        -->
                        <exclude>
                            <groupId>com.google.guava</groupId>
                            <artifactId>guava</artifactId>
                            <version>23.0</version>
                        </exclude>
                        <!-- End exclusion for DIS-3662 -->
                    </excludeCoordinates>
                    <excludeVulnerabilityIds>
                        <!-- Note - OSS Index suppressions are global, not per dependency -->
                        <!--
                            Jira epic to remove the following exclusion: DIS-4777
                         -->
                        <exclude>CVE-2026-2332</exclude>
                        <!-- End DIS-4777 -->
                        <!-- DIS-5047 -->
                        <exclude>CVE-2026-55760</exclude>
                        <!-- End DIS-5047 -->

                        <!-- 
                            CVE covers logback-classic v1.3.16
                            Epic to remove this exclusion: DIS-5085
                        -->
                        <exclude>CVE-2026-13006</exclude>
                    </excludeVulnerabilityIds>
                </configuration>
                <executions>
                    <execution>
                        <id>audit-dependencies-critical</id>
                        <phase>validate</phase>
                        <goals>
                            <goal>audit</goal>
                        </goals>
                    </execution>
                </executions>

            </plugin>
        </plugins>
    </build>

    <repositories>
        <!-- Adding maven central repo explicitly to prevent jitpack.io resolving artifacts that are already on Github. Otherwise handlebars-java fails -->
        <repository>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
            <id>central</id>
            <name>Central Repository</name>
            <url>https://repo.maven.apache.org/maven2</url>
        </repository>
        <!--Jitpack io allows us include projects and libraries available on github but not built and published to maven central-->
        <!-- It is used for including internal project modules. See more on https://jitpack.io/-->
        <repository>
            <id>jitpack.io</id>
            <url>https://jitpack.io</url>
        </repository>
    </repositories>

</project>