<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Licensed to the Apache Software Foundation (ASF) under one or more
  ~ contributor license agreements.  See the NOTICE file distributed with
  ~ this work for additional information regarding copyright ownership.
  ~ The ASF licenses this file to you under the Apache License, Version 2.0
  ~ (the "License"); you may not use this file except in compliance with
  ~ the License.  You may obtain a copy of the License at
  ~
  ~      http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-bom</artifactId>
    <version>${revision}</version>
  </parent>

  <!-- Using `log4j` instead of `log4j-parent` for backward compatibility: -->
  <artifactId>log4j</artifactId>
  <packaging>pom</packaging>

  <name>Apache Log4j Parent</name>
  <description>Apache Log4j Parent</description>

  <properties>
    <!-- ██     ██  █████  ██████  ███    ██ ██ ███    ██  ██████  ██
         ██     ██ ██   ██ ██   ██ ████   ██ ██ ████   ██ ██       ██
         ██  █  ██ ███████ ██████  ██ ██  ██ ██ ██ ██  ██ ██   ███ ██
         ██ ███ ██ ██   ██ ██   ██ ██  ██ ██ ██ ██  ██ ██ ██    ██
          ███ ███  ██   ██ ██   ██ ██   ████ ██ ██   ████  ██████  ██

         Dependency and plugin version properties might have many implications beyond their simple appearance!
         Walk through the following checklist before making a change in these properties!

         1. Follow the `<artifactId>.version` naming convention
         2. Make sure properties are sorted in alphabetical order
         3. Check parent POMs for any associations.
            For instance, Maven Surefire Plugin version property is such an exception.
            It is named as `surefire.version` rather than `maven-surefire-plugin.version`, since `surefire.version` is already employed by `apache.org:apache` parent POM.
         4. Think of consequences when users _import_ this POM along with, e.g., `spring-boot-dependencies` BOM -->

    <!-- =================================================
         Plugin version properties (in alphabetical order)
         ================================================= -->
    <asciidoctor-maven-plugin.version>2.2.4</asciidoctor-maven-plugin.version>
    <docker-maven-plugin.version>0.48.1</docker-maven-plugin.version>
    <exam-maven-plugin.version>4.14.0</exam-maven-plugin.version>
    <maven-taglib-plugin.version>2.4</maven-taglib-plugin.version>
    <!-- `surefire.version` property used in `apache.org:apache`: -->
    <surefire.version>3.5.2</surefire.version>

    <!-- =====================================================
         Direct dependency version properties (in alphabetical order)
         ===================================================== -->
    <activemq.version>6.2.7</activemq.version>
    <angus-activation.version>2.0.3</angus-activation.version>
    <angus-mail.version>2.0.5</angus-mail.version>
    <assertj.version>3.27.7</assertj.version>
    <awaitility.version>4.3.0</awaitility.version>
    <bsh.version>2.0b6</bsh.version>
    <bnd.annotation.version>7.3.0</bnd.annotation.version>
    <cassandra.version>3.11.19</cassandra.version>
    <cassandra-driver.version>3.11.5</cassandra-driver.version>
    <commons-codec.version>1.22.0</commons-codec.version>
    <commons-compress.version>1.28.0</commons-compress.version>
    <commons-csv.version>1.14.1</commons-csv.version>
    <commons-dbcp2.version>2.14.0</commons-dbcp2.version>
    <commons-io.version>2.22.0</commons-io.version>
    <commons-lang3.version>3.20.0</commons-lang3.version>
    <commons-logging.version>1.4.0</commons-logging.version>
    <!-- `com.conversantmedia:disruptor` version 1.2.16 requires Java 9: -->
    <conversant.disruptor.version>1.2.15</conversant.disruptor.version>
    <disruptor.version>3.4.4</disruptor.version>
    <embedded-ldap.version>0.9.0</embedded-ldap.version>
    <error-prone-annotations.version>2.50.0</error-prone-annotations.version>
    <felix.version>7.0.5</felix.version>
    <groovy.version>4.0.27</groovy.version>
    <guava.version>33.6.0-jre</guava.version>
    <h2.version>2.2.224</h2.version>
    <hamcrest.version>3.0</hamcrest.version>
    <HdrHistogram.version>2.2.2</HdrHistogram.version>
    <hsqldb.version>2.7.4</hsqldb.version>
    <jackson-bom.version>2.22.1</jackson-bom.version>
    <!-- Override the version in Jakarta EE 9 BOM: -->
    <jakarta-activation.version>2.1.4</jakarta-activation.version>
    <jakarta-mail.version>2.1.5</jakarta-mail.version>
    <!-- BOM with Jakarta EE 9 APIs: -->
    <jakartaee-bom.version>9.1.0</jakartaee-bom.version>
    <!-- No BOM for Java EE 8 APIs, so we list them separately: -->
    <javax-activation.version>1.2.0</javax-activation.version>
    <javax-inject.version>1</javax-inject.version>
    <javax-jms.version>2.0.1</javax-jms.version>
    <javax-mail.version>1.6.2</javax-mail.version>
    <javax-persistence.version>2.2</javax-persistence.version>
    <javax-servlet.version>4.0.1</javax-servlet.version>
    <javax-servlet-jsp.version>2.3.3</javax-servlet-jsp.version>
    <java-allocation-instrumenter.version>3.3.5</java-allocation-instrumenter.version>
    <jazzer.version>0.30.0</jazzer.version>
    <jconsole.version>1.7.0</jconsole.version>
    <jctools.version>4.0.6</jctools.version>
    <jeromq.version>0.6.0</jeromq.version>
    <jmdns.version>3.6.3</jmdns.version>
    <jmh.version>1.37</jmh.version>
    <jspecify.version>1.0.0</jspecify.version>
    <junit.version>4.13.2</junit.version>
    <junit-jupiter.version>5.14.4</junit-jupiter.version>
    <junit-pioneer.version>1.9.1</junit-pioneer.version>
    <kafka.version>3.9.2</kafka.version>
    <lightcouch.version>0.2.0</lightcouch.version>
    <log4j.version>1.2.17</log4j.version>
    <log4j-transform.version>0.2.0</log4j-transform.version>
    <log4j2-cachefile-transformer.version>2.15.0</log4j2-cachefile-transformer.version>
    <log4j2-ecs-layout.version>1.8.0</log4j2-ecs-layout.version>
    <logback.version>1.3.15</logback.version>
    <maven.version>3.9.16</maven.version>
    <mockito.version>4.11.0</mockito.version>
    <nashorn.version>15.7</nashorn.version>
    <org.eclipse.osgi.version>3.24.200</org.eclipse.osgi.version>
    <org.eclipse.persistence.version>2.7.16</org.eclipse.persistence.version>
    <oro.version>2.0.8</oro.version>
    <!-- The OSGi API version MUST always be the MINIMUM version Log4j supports: -->
    <osgi.api.version>6.0.0</osgi.api.version>
    <osgi.annotation.bundle.version>2.0.0</osgi.annotation.bundle.version>
    <osgi.annotation.versioning.version>1.1.2</osgi.annotation.versioning.version>
    <pax-exam.version>4.14.0</pax-exam.version>
    <plexus-utils.version>3.6.1</plexus-utils.version>
    <spring-boot.version>2.7.18</spring-boot.version>
    <spring-framework.version>5.3.39</spring-framework.version>
    <stax2-api.version>4.3.0</stax2-api.version>
    <system-stubs.version>2.0.3</system-stubs.version>
    <velocity.version>1.7</velocity.version>
    <wiremock.version>2.35.2</wiremock.version>
    <xmlunit.version>2.12.0</xmlunit.version>
    <xz.version>1.12</xz.version>
    <zstd.version>1.5.7-4</zstd.version>

    <!-- =====================================================
         Pinned transitive dependency version properties (in alphabetical order)

         These are not directly used in the code, but ensure
         the independence of transitive dependencies from the order
         of dependencies (requireUpperBoundDeps rule).
         ===================================================== -->
    <asm.version>9.6</asm.version>
    <byte-buddy.version>1.14.9</byte-buddy.version>
    <commons-pool2.version>2.13.1</commons-pool2.version>
    <httpclient.version>4.5.14</httpclient.version>
    <httpcore.version>4.4.16</httpcore.version>
    <jna.version>5.19.1</jna.version>

    <!-- Add 'requires static' for annotation library dependencies (defined as <scope>provided</scope> in this file)
         to allow them to be visible at compile time to make the '-Xlint:classfile' check of javac pass.
         Overrides parent's 'bnd-jpms-module-info' and hence re-defines '$[bnd-module-name];access=0' -->
    <bnd-jpms-module-info>$[bnd-module-name];access=0;modules="
      biz.aQute.bnd.annotation,
      com.google.errorprone.annotations,
      org.osgi.annotation.bundle,
      org.osgi.annotation.versioning
      "</bnd-jpms-module-info>
  </properties>

  <dependencyManagement>
    <dependencies>

      <!-- BEGIN: Modules that are consumed only internally -->

      <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-fuzz-test</artifactId>
        <version>${project.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-layout-template-json-test</artifactId>
        <version>${project.version}</version>
      </dependency>

      <!-- END: Modules that are consumed only internally -->

      <dependency>
        <groupId>org.apache.groovy</groupId>
        <artifactId>groovy-bom</artifactId>
        <version>${groovy.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <dependency>
        <groupId>com.fasterxml.jackson</groupId>
        <artifactId>jackson-bom</artifactId>
        <version>${jackson-bom.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <dependency>
        <groupId>jakarta.platform</groupId>
        <artifactId>jakarta.jakartaee-bom</artifactId>
        <version>${jakartaee-bom.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <dependency>
        <groupId>org.junit</groupId>
        <artifactId>junit-bom</artifactId>
        <version>${junit-jupiter.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <dependency>
        <groupId>org.mockito</groupId>
        <artifactId>mockito-bom</artifactId>
        <version>${mockito.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-framework-bom</artifactId>
        <version>${spring-framework.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-api-java9</artifactId>
        <version>${project.version}</version>
        <type>zip</type>
      </dependency>

      <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core-java9</artifactId>
        <version>${project.version}</version>
        <type>zip</type>
      </dependency>

      <!-- Dummy dependency to trick `dependabot` into updating the `log4j-transform.version` property: -->
      <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-transform-maven-shade-plugin-extensions</artifactId>
        <version>${log4j-transform.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.activemq</groupId>
        <artifactId>activemq-broker</artifactId>
        <version>${activemq.version}</version>
      </dependency>

      <dependency>
        <groupId>org.eclipse.angus</groupId>
        <artifactId>angus-activation</artifactId>
        <version>${angus-activation.version}</version>
      </dependency>

      <dependency>
        <groupId>org.assertj</groupId>
        <artifactId>assertj-core</artifactId>
        <version>${assertj.version}</version>
      </dependency>

      <dependency>
        <groupId>org.awaitility</groupId>
        <artifactId>awaitility</artifactId>
        <version>${awaitility.version}</version>
      </dependency>

      <dependency>
        <groupId>com.code-intelligence</groupId>
        <artifactId>jazzer</artifactId>
        <version>${jazzer.version}</version>
      </dependency>

      <dependency>
        <groupId>com.code-intelligence</groupId>
        <artifactId>jazzer-api</artifactId>
        <version>${jazzer.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache-extras.beanshell</groupId>
        <artifactId>bsh</artifactId>
        <version>${bsh.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.cassandra</groupId>
        <artifactId>cassandra-all</artifactId>
        <version>${cassandra.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>jcl-over-slf4j</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>log4j-over-slf4j</artifactId>
          </exclusion>
          <exclusion>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
          </exclusion>
          <exclusion>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-core</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>com.datastax.cassandra</groupId>
        <artifactId>cassandra-driver-core</artifactId>
        <version>${cassandra-driver.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.cassandra</groupId>
        <artifactId>cassandra-thrift</artifactId>
        <version>${cassandra.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>jcl-over-slf4j</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>log4j-over-slf4j</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>commons-codec</groupId>
        <artifactId>commons-codec</artifactId>
        <version>${commons-codec.version}</version>
      </dependency>

      <!-- Used for compressing to formats other than `zip` and `gz`: -->
      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-compress</artifactId>
        <version>${commons-compress.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-csv</artifactId>
        <version>${commons-csv.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-dbcp2</artifactId>
        <version>${commons-dbcp2.version}</version>
      </dependency>

      <dependency>
        <groupId>commons-io</groupId>
        <artifactId>commons-io</artifactId>
        <version>${commons-io.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-lang3</artifactId>
        <version>${commons-lang3.version}</version>
      </dependency>

      <dependency>
        <groupId>commons-logging</groupId>
        <artifactId>commons-logging</artifactId>
        <version>${commons-logging.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-pool2</artifactId>
        <version>${commons-pool2.version}</version>
      </dependency>

      <dependency>
        <groupId>com.conversantmedia</groupId>
        <artifactId>disruptor</artifactId>
        <version>${conversant.disruptor.version}</version>
      </dependency>

      <dependency>
        <groupId>com.lmax</groupId>
        <artifactId>disruptor</artifactId>
        <version>${disruptor.version}</version>
      </dependency>

      <dependency>
        <groupId>org.zapodot</groupId>
        <artifactId>embedded-ldap-junit</artifactId>
        <version>${embedded-ldap.version}</version>
      </dependency>

      <!-- Transitive dependency: setting upper bound of declared versions -->
      <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>${guava.version}</version>
      </dependency>

      <dependency>
        <groupId>com.google.guava</groupId>
        <!-- https://javadoc.io/doc/com.google.guava/guava-testlib/latest/com/google/common/testing/TestLogHandler.html used in log4j-to-jul tests -->
        <artifactId>guava-testlib</artifactId>
        <version>${guava.version}</version>
      </dependency>

      <dependency>
        <groupId>com.h2database</groupId>
        <artifactId>h2</artifactId>
        <version>${h2.version}</version>
      </dependency>

      <dependency>
        <groupId>org.hamcrest</groupId>
        <artifactId>hamcrest</artifactId>
        <version>${hamcrest.version}</version>
      </dependency>

      <dependency>
        <groupId>org.hamcrest</groupId>
        <artifactId>hamcrest-core</artifactId>
        <version>${hamcrest.version}</version>
      </dependency>

      <dependency>
        <groupId>org.hamcrest</groupId>
        <artifactId>hamcrest-library</artifactId>
        <version>${hamcrest.version}</version>
      </dependency>

      <dependency>
        <groupId>org.hdrhistogram</groupId>
        <artifactId>HdrHistogram</artifactId>
        <version>${HdrHistogram.version}</version>
      </dependency>

      <dependency>
        <groupId>org.hsqldb</groupId>
        <artifactId>hsqldb</artifactId>
        <version>${hsqldb.version}</version>
        <classifier>jdk8</classifier>
      </dependency>

      <dependency>
        <groupId>org.apache.httpcomponents</groupId>
        <artifactId>httpclient</artifactId>
        <version>${httpclient.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.httpcomponents</groupId>
        <artifactId>httpcore</artifactId>
        <version>${httpcore.version}</version>
      </dependency>

      <dependency>
        <groupId>jakarta.activation</groupId>
        <artifactId>jakarta.activation-api</artifactId>
        <version>${jakarta-activation.version}</version>
      </dependency>

      <dependency>
        <groupId>org.eclipse.angus</groupId>
        <artifactId>jakarta.mail</artifactId>
        <version>${angus-mail.version}</version>
      </dependency>

      <dependency>
        <groupId>jakarta.mail</groupId>
        <artifactId>jakarta.mail-api</artifactId>
        <version>${jakarta-mail.version}</version>
      </dependency>

      <!-- Used for garbage-free tests: -->
      <dependency>
        <groupId>com.google.code.java-allocation-instrumenter</groupId>
        <artifactId>java-allocation-instrumenter</artifactId>
        <version>${java-allocation-instrumenter.version}</version>
      </dependency>

      <dependency>
        <groupId>javax.activation</groupId>
        <artifactId>javax.activation-api</artifactId>
        <version>${javax-activation.version}</version>
      </dependency>

      <dependency>
        <groupId>javax.inject</groupId>
        <artifactId>javax.inject</artifactId>
        <version>${javax-inject.version}</version>
      </dependency>

      <dependency>
        <groupId>javax.jms</groupId>
        <artifactId>javax.jms-api</artifactId>
        <version>${javax-jms.version}</version>
      </dependency>

      <dependency>
        <groupId>com.sun.mail</groupId>
        <artifactId>javax.mail</artifactId>
        <version>${javax-mail.version}</version>
      </dependency>

      <dependency>
        <groupId>javax.mail</groupId>
        <artifactId>javax.mail-api</artifactId>
        <version>${javax-mail.version}</version>
      </dependency>

      <dependency>
        <groupId>javax.persistence</groupId>
        <artifactId>javax.persistence-api</artifactId>
        <version>${javax-persistence.version}</version>
      </dependency>

      <dependency>
        <groupId>javax.servlet.jsp</groupId>
        <artifactId>javax.servlet.jsp-api</artifactId>
        <version>${javax-servlet-jsp.version}</version>
      </dependency>

      <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>javax.servlet-api</artifactId>
        <version>${javax-servlet.version}</version>
      </dependency>

      <dependency>
        <groupId>com.sun</groupId>
        <artifactId>jconsole</artifactId>
        <version>${jconsole.version}</version>
      </dependency>

      <dependency>
        <groupId>org.jctools</groupId>
        <artifactId>jctools-core</artifactId>
        <version>${jctools.version}</version>
      </dependency>

      <dependency>
        <groupId>org.zeromq</groupId>
        <artifactId>jeromq</artifactId>
        <version>${jeromq.version}</version>
      </dependency>

      <!-- Zeroconf advertiser tests: -->
      <dependency>
        <groupId>org.jmdns</groupId>
        <artifactId>jmdns</artifactId>
        <version>${jmdns.version}</version>
      </dependency>

      <dependency>
        <groupId>org.openjdk.jmh</groupId>
        <artifactId>jmh-core</artifactId>
        <version>${jmh.version}</version>
      </dependency>

      <dependency>
        <groupId>org.openjdk.jmh</groupId>
        <artifactId>jmh-generator-annprocess</artifactId>
        <version>${jmh.version}</version>
      </dependency>

      <dependency>
        <groupId>net.java.dev.jna</groupId>
        <artifactId>jna</artifactId>
        <version>${jna.version}</version>
      </dependency>

      <dependency>
        <groupId>org.jspecify</groupId>
        <artifactId>jspecify</artifactId>
        <version>${jspecify.version}</version>
      </dependency>

      <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
        <version>${junit.version}</version>
      </dependency>

      <dependency>
        <groupId>org.junit-pioneer</groupId>
        <artifactId>junit-pioneer</artifactId>
        <version>${junit-pioneer.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.kafka</groupId>
        <artifactId>kafka-clients</artifactId>
        <version>${kafka.version}</version>
      </dependency>

      <dependency>
        <groupId>org.lightcouch</groupId>
        <artifactId>lightcouch</artifactId>
        <version>${lightcouch.version}</version>
      </dependency>

      <dependency>
        <groupId>log4j</groupId>
        <artifactId>log4j</artifactId>
        <version>${log4j.version}</version>
      </dependency>

      <!-- Used for testing `JsonTemplateLayout`: -->
      <dependency>
        <groupId>co.elastic.logging</groupId>
        <artifactId>log4j2-ecs-layout</artifactId>
        <version>${log4j2-ecs-layout.version}</version>
      </dependency>

      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-classic</artifactId>
        <version>${logback.version}</version>
      </dependency>

      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-classic</artifactId>
        <version>${logback.version}</version>
        <type>test-jar</type>
      </dependency>

      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-core</artifactId>
        <version>${logback.version}</version>
      </dependency>

      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-core</artifactId>
        <version>${logback.version}</version>
        <type>test-jar</type>
      </dependency>

      <dependency>
        <groupId>org.apache.maven</groupId>
        <artifactId>maven-core</artifactId>
        <version>${maven.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.maven</groupId>
        <artifactId>maven-model</artifactId>
        <version>${maven.version}</version>
      </dependency>

      <dependency>
        <groupId>org.openjdk.nashorn</groupId>
        <artifactId>nashorn-core</artifactId>
        <version>${nashorn.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.felix</groupId>
        <artifactId>org.apache.felix.framework</artifactId>
        <version>${felix.version}</version>
      </dependency>

      <dependency>
        <groupId>org.eclipse.platform</groupId>
        <artifactId>org.eclipse.osgi</artifactId>
        <version>${org.eclipse.osgi.version}</version>
      </dependency>

      <dependency>
        <groupId>org.eclipse.persistence</groupId>
        <artifactId>org.eclipse.persistence.jpa</artifactId>
        <version>${org.eclipse.persistence.version}</version>
        <exclusions>
          <!-- A copy of `javax.persistence:javax.persistence-api`: -->
          <exclusion>
            <groupId>org.eclipse.persistence</groupId>
            <artifactId>jakarta.persistence</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>org.osgi</groupId>
        <artifactId>org.osgi.core</artifactId>
        <version>${osgi.api.version}</version>
      </dependency>

      <dependency>
        <groupId>oro</groupId>
        <artifactId>oro</artifactId>
        <version>${oro.version}</version>
      </dependency>

      <dependency>
        <groupId>org.ops4j.pax.exam</groupId>
        <artifactId>pax-exam</artifactId>
        <version>${pax-exam.version}</version>
      </dependency>

      <dependency>
        <groupId>org.ops4j.pax.exam</groupId>
        <artifactId>pax-exam-container-native</artifactId>
        <version>${pax-exam.version}</version>
      </dependency>

      <dependency>
        <groupId>org.ops4j.pax.exam</groupId>
        <artifactId>pax-exam-junit4</artifactId>
        <version>${pax-exam.version}</version>
      </dependency>

      <dependency>
        <groupId>org.ops4j.pax.exam</groupId>
        <artifactId>pax-exam-link-assembly</artifactId>
        <version>${pax-exam.version}</version>
      </dependency>

      <dependency>
        <groupId>org.ops4j.pax.exam</groupId>
        <artifactId>pax-exam-spi</artifactId>
        <version>${pax-exam.version}</version>
      </dependency>

      <dependency>
        <groupId>org.codehaus.plexus</groupId>
        <artifactId>plexus-utils</artifactId>
        <version>${plexus-utils.version}</version>
      </dependency>

      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot</artifactId>
        <version>${spring-boot.version}</version>
      </dependency>

      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-autoconfigure</artifactId>
        <version>${spring-boot.version}</version>
      </dependency>

      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-log4j2</artifactId>
        <version>${spring-boot.version}</version>
      </dependency>

      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <version>${spring-boot.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-logging</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>${spring-framework.version}</version>
        <exclusions>
          <exclusion>
            <groupId>org.springframework</groupId>
            <artifactId>spring-jcl</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>org.codehaus.woodstox</groupId>
        <artifactId>stax2-api</artifactId>
        <version>${stax2-api.version}</version>
      </dependency>

      <dependency>
        <groupId>uk.org.webcompere</groupId>
        <artifactId>system-stubs-core</artifactId>
        <version>${system-stubs.version}</version>
      </dependency>

      <!-- Environment and system properties support for JUnit Jupiter: -->
      <dependency>
        <groupId>uk.org.webcompere</groupId>
        <artifactId>system-stubs-jupiter</artifactId>
        <version>${system-stubs.version}</version>
      </dependency>

      <dependency>
        <groupId>org.apache.velocity</groupId>
        <artifactId>velocity</artifactId>
        <version>${velocity.version}</version>
      </dependency>

      <!-- Used for testing `HttpAppender`: -->
      <dependency>
        <groupId>com.github.tomakehurst</groupId>
        <artifactId>wiremock-jre8</artifactId>
        <version>${wiremock.version}</version>
      </dependency>

      <dependency>
        <groupId>org.xmlunit</groupId>
        <artifactId>xmlunit-core</artifactId>
        <version>${xmlunit.version}</version>
      </dependency>

      <dependency>
        <groupId>org.xmlunit</groupId>
        <artifactId>xmlunit-matchers</artifactId>
        <version>${xmlunit.version}</version>
      </dependency>

      <dependency>
        <groupId>org.tukaani</groupId>
        <artifactId>xz</artifactId>
        <version>${xz.version}</version>
      </dependency>

      <dependency>
        <groupId>com.github.luben</groupId>
        <artifactId>zstd-jni</artifactId>
        <version>${zstd.version}</version>
      </dependency>

    </dependencies>
  </dependencyManagement>

  <!-- Common annotations used in all the modules -->
  <dependencies>

    <dependency>
      <groupId>biz.aQute.bnd</groupId>
      <artifactId>biz.aQute.bnd.annotation</artifactId>
      <version>${bnd.annotation.version}</version>
      <scope>provided</scope>
    </dependency>

    <dependency>
      <groupId>com.google.errorprone</groupId>
      <artifactId>error_prone_annotations</artifactId>
      <version>${error-prone-annotations.version}</version>
      <scope>provided</scope>
    </dependency>

    <dependency>
      <groupId>org.osgi</groupId>
      <artifactId>org.osgi.annotation.bundle</artifactId>
      <version>${osgi.annotation.bundle.version}</version>
      <scope>provided</scope>
    </dependency>

    <dependency>
      <groupId>org.osgi</groupId>
      <artifactId>org.osgi.annotation.versioning</artifactId>
      <version>${osgi.annotation.versioning.version}</version>
      <scope>provided</scope>
    </dependency>

  </dependencies>

  <build>
    <pluginManagement>
      <plugins>

        <!-- used by `docker` profile -->
        <plugin>
          <groupId>io.fabric8</groupId>
          <artifactId>docker-maven-plugin</artifactId>
          <version>${docker-maven-plugin.version}</version>
        </plugin>

        <!-- used by OSGi tests -->
        <plugin>
          <groupId>org.ops4j.pax.exam</groupId>
          <artifactId>exam-maven-plugin</artifactId>
          <version>${exam-maven-plugin.version}</version>
        </plugin>

        <!-- used to generate taglib documentation -->
        <plugin>
          <groupId>net.sourceforge.maven-taglib</groupId>
          <artifactId>maven-taglib-plugin</artifactId>
          <version>${maven-taglib-plugin.version}</version>
        </plugin>

        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-shade-plugin</artifactId>
          <dependencies>
            <dependency>
              <groupId>org.apache.logging.log4j</groupId>
              <artifactId>log4j-transform-maven-shade-plugin-extensions</artifactId>
              <version>${log4j-transform.version}</version>
            </dependency>
          </dependencies>
          <executions>
            <execution>
              <id>generate-uber-jar</id>
              <goals>
                <goal>shade</goal>
              </goals>
              <phase>package</phase>
              <configuration>
                <createDependencyReducedPom>false</createDependencyReducedPom>
                <!-- Minimization causes `@Plugin`-annotated classes to be omitted, hence disabling it: -->
                <minimizeJar>false</minimizeJar>
                <finalName>${project.artifactId}-${project.version}-uber</finalName>
                <transformers>
                  <transformer implementation="org.apache.maven.plugins.shade.resource.ApacheLicenseResourceTransformer" />
                  <transformer implementation="org.apache.maven.plugins.shade.resource.ApacheNoticeResourceTransformer" />
                  <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                    <manifestEntries>
                      <Multi-Release>true</Multi-Release>
                    </manifestEntries>
                  </transformer>
                  <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer" />
                  <transformer implementation="org.apache.logging.log4j.maven.plugins.shade.transformer.Log4j2PluginCacheFileTransformer" />
                </transformers>
                <filters>
                  <filter>
                    <!--
                      Shading signed JARs will fail without this.
                      http://stackoverflow.com/questions/999489/invalid-signature-file-when-attempting-to-run-a-jar
                    -->
                    <artifact>*:*</artifact>
                    <excludes>
                      <exclude>META-INF/*.SF</exclude>
                      <exclude>META-INF/*.DSA</exclude>
                      <exclude>META-INF/*.RSA</exclude>
                      <exclude>META-INF/MANIFEST.MF</exclude>
                      <exclude>module-info.class</exclude>
                      <exclude>META-INF/versions/9/module-info.class</exclude>
                    </excludes>
                  </filter>
                </filters>
              </configuration>
            </execution>
          </executions>
        </plugin>

      </plugins>
    </pluginManagement>

    <plugins>

      <!--
        ~ A previous `generate-module-descriptors` execution leaves:
        ~  * `target/classes/module-info.class` files, which interferes with `maven-compiler-plugin`,
        ~  * `target/classes/META-INF/versions` folder, which switch `bnd-maven-plugin` into MRJ mode.
        ~
        ~ TODO: test BND multi-release mode in 2.23.0.
        -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-clean-plugin</artifactId>
        <executions>
          <execution>
            <id>delete-module-descriptors</id>
            <goals>
              <goal>clean</goal>
            </goals>
            <phase>process-sources</phase>
            <configuration>
              <excludeDefaultDirectories>true</excludeDefaultDirectories>
              <filesets>
                <fileset>
                  <directory>${project.build.outputDirectory}</directory>
                  <includes>
                    <include>module-info.class</include>
                    <include>META-INF/versions/**</include>
                  </includes>
                </fileset>
              </filesets>
            </configuration>
          </execution>
        </executions>
      </plugin>

      <!--
        ~ Some external logging bridges can interfere with our tests, giving false negatives.
        -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <executions>
          <execution>
            <id>ban-logging-dependencies</id>
            <goals>
              <goal>enforce</goal>
            </goals>
            <configuration>
              <rules>
                <bannedDependencies>
                  <excludes>
                    <!-- JCL replacements -->
                    <exclude>org.slf4j:jcl-over-slf4j</exclude>
                    <exclude>org.springframework:spring-jcl</exclude>
                    <!-- Log4j 1.x replacements -->
                    <exclude>org.slf4j:log4j-over-slf4j</exclude>
                    <exclude>ch.qos.reload4j:reload4j</exclude>
                    <!-- Bridges to Log4j 1.x -->
                    <exclude>org.slf4j:slf4j-log4j12</exclude>
                    <exclude>org.slf4j:slf4j-reload4j</exclude>
                    <!-- PAX Logging just to be safe -->
                    <exclude>org.ops4j.pax.logging:*</exclude>
                    <!-- Logback -->
                    <exclude>ch.qos.logback:*</exclude>
                  </excludes>
                </bannedDependencies>
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>

      <plugin>
        <groupId>org.codehaus.gmavenplus</groupId>
        <artifactId>gmavenplus-plugin</artifactId>
        <executions>
          <execution>
            <id>ban-static-transitive</id>
            <goals>
              <goal>execute</goal>
            </goals>
            <phase>verify</phase>
            <configuration>
              <continueExecuting>false</continueExecuting>
              <scripts>
                <script><![CDATA[
                  import java.io.StringWriter
                  import java.util.spi.ToolProvider

                  if ("jar" != project.packaging) {
                      log.info("Skipping module descriptor check, since the project type is not `jar`.")
                      return
                  }
                  String jarFile = project.build.directory + "/" + project.build.finalName + ".jar";
                  if (!new File(jarFile).exists()) {
                      log.info("Skipping module descriptor check, since `" + jarFile + "` is missing.")
                      return
                  }
                  StringWriter out = new StringWriter()
                  StringWriter err = new StringWriter()
                  ToolProvider jar = ToolProvider.findFirst("jar").orElseThrow()
                  int result = jar.run(new PrintWriter(out), new PrintWriter(err), "-d", "-f", jarFile)
                  if (result != 0) {
                      throw new RuntimeException("Failed to decompile the module descriptor in `" + jarFile + "`:\n" + err)
                  }
                  log.debug("Module descriptor: " + out)
                  for (String line : out.toString().split("\r?\n", -1)) {
                      if (line.contains("static") && line.contains("transitive")) {
                          throw new RuntimeException("The `static` and `transitive` modifiers should not be use together: " + line)
                      }
                  }
                  log.info("Successfully verified module descriptor in `" + jarFile + "`.")
              ]]></script>
              </scripts>
            </configuration>
          </execution>
        </executions>
      </plugin>

      <!-- Add annotation library dependencies (defined as <scope>provided</scope> in this file) as compileOnlyApi
           dependencies for Gradle consumers. This makes the Jars automatically available at compile time to make
           the '-Xlint:classfile' check of javac pass.-->
      <plugin>
        <groupId>org.gradlex</groupId>
        <artifactId>gradle-module-metadata-maven-plugin</artifactId>
        <version>1.2</version>
        <configuration>
          <compileOnlyApiDependencies>
            <dependency>
              <groupId>org.jspecify</groupId>
              <artifactId>jspecify</artifactId>
              <version>${jspecify.version}</version>
            </dependency>
            <dependency>
              <groupId>biz.aQute.bnd</groupId>
              <artifactId>biz.aQute.bnd.annotation</artifactId>
              <version>${bnd.annotation.version}</version>
            </dependency>
            <dependency>
              <groupId>com.google.errorprone</groupId>
              <artifactId>error_prone_annotations</artifactId>
              <version>${error-prone-annotations.version}</version>
            </dependency>
            <dependency>
              <groupId>org.osgi</groupId>
              <!-- Note: 'org.osgi.annotation.bundle' and 'osgi.annotation' overlap. We do not want to add
                   both. As 'org.osgi.annotation.bundle' has an Automatic-Module-Name, it is preferred. -->
              <artifactId>org.osgi.annotation.bundle</artifactId>
              <version>${osgi.annotation.bundle.version}</version>
            </dependency>
            <dependency>
              <groupId>org.osgi</groupId>
              <artifactId>org.osgi.annotation.versioning</artifactId>
              <version>${osgi.annotation.versioning.version}</version>
            </dependency>
          </compileOnlyApiDependencies>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>gmm</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

    </plugins>
  </build>

  <profiles>

    <!-- `java8-tests` profile to force using Java 8 while running tests -->
    <profile>

      <id>java8-tests</id>

      <activation>
        <property>
          <name>env.CI</name>
          <value>true</value>
        </property>
      </activation>

      <!-- There are certain Java 8 bugs[1] that cause Mockito failures[2].
           Adding necessary dependencies to workaround them.
           [1] https://bugs.openjdk.org/browse/JDK-8152174
           [2] https://github.com/mockito/mockito/issues/1449 -->
      <dependencies>
        <dependency>
          <groupId>org.jspecify</groupId>
          <artifactId>jspecify</artifactId>
          <version>${jspecify.version}</version>
          <scope>test</scope>
        </dependency>
      </dependencies>

      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-surefire-plugin</artifactId>
            <executions>
              <!-- Modifies only the `default-test` run -->
              <execution>
                <id>default-test</id>
                <configuration>
                  <jdkToolchain>
                    <version>[1.8, 9)</version>
                  </jdkToolchain>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>

    </profile>

    <!-- `plugin-processing` profile containing configuration specific to `@Plugin`-annotated members -->
    <profile>

      <id>plugin-processing</id>

      <!-- Profile gets activated using a file instead of, say, a property defined by the child `pom.xml`.
           Since a Maven property lookup requires model interpolation and that happens after the profile activation phase.
           See: https://maven.apache.org/ref/3.9.6/maven-model-builder -->
      <activation>
        <file>
          <exists>.log4j-plugin-processing-activator</exists>
        </file>
      </activation>

      <properties>
        <log4j.docgen.pluginDescriptorsDir.skipped>${maven.multiModuleProjectDirectory}/target/plugin-descriptors/skipped</log4j.docgen.pluginDescriptorsDir.skipped>
        <log4j.docgen.pluginDescriptorsDir>${log4j.docgen.pluginDescriptorsDir.phase2}</log4j.docgen.pluginDescriptorsDir>
      </properties>

      <build>
        <plugins>

          <!-- This is a workaround to effectively disable Log4j Docgen `DescriptorGenerator` plugin processor.
               Once Log4j Docgen `>0.9.0` is released (containing the new `log4j.docgen.skip` argument to `DescriptorGenerator`):
               1. Remove this `build-helper:bsh-property` execution
               2. Remove the `log4j.docgen.pluginDescriptorsDir.skipped` property
               3. In the `PluginProcessor` execution configuration
                  - Add `-Alog4j.docgen.skip=${log4j.docgen.skip}` argument
                  - Set `-Alog4j.docgen.descriptorFilePath=${log4j.docgen.pluginDescriptorsDir}/${project.artifactId}-plugins.xml` argument -->
          <plugin>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>build-helper-maven-plugin</artifactId>
            <executions>
              <execution>
                <id>define-log4jDocgenDescriptorFilepath</id>
                <goals>
                  <goal>bsh-property</goal>
                </goals>
                <phase>process-resources</phase>
                <configuration>
                  <properties>
                    <property>log4jDocgenDescriptorFilepath</property>
                  </properties>
                  <source><![CDATA[
                    Properties properties = project.getProperties();
                    String pluginDescriptorsDir = "true".equals(properties.getProperty("log4j.docgen.skip"))
                            ? properties.getProperty("log4j.docgen.pluginDescriptorsDir.skipped")
                            : properties.getProperty("log4j.docgen.pluginDescriptorsDir");
                    String log4jDocgenDescriptorFilepath = String.format("%s/%s-plugins.xml", new Object[] {
                        pluginDescriptorsDir, project.getArtifactId()
                    });
                  ]]></source>
                </configuration>
              </execution>
            </executions>
          </plugin>

          <!-- We will compile sources as usual and make a second pass to process plugins, because...
               `log4j-core` contains `PluginProcessor`, that is responsible for generating `Log4j2Plugins.dat` from `@Plugin`-annotated members.
               `log4j-core` also contains `@Plugin`-annotated members too.
               That is, we need `log4j-core` to build `log4j-core`.
               To work around this chicken-and-egg problem, we build as follows:

               1. Compile sources using the `default-compile` default compilation execution.
                  This will generate the `PluginProcessor` class.

               2. Make a second compilation pass using the generated `PluginProcessor`. -->
          <plugin>

            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-compiler-plugin</artifactId>

            <executions>

              <!-- 1st pass: compile sources as usual.
                   This needs to be explicitly stated here to set the order of execution. -->
              <execution>
                <id>default-compile</id>
              </execution>

              <!-- 1st pass for tests: compile sources as usual.
                   This needs to be explicitly stated here to set the order of execution. -->
              <execution>
                <id>default-testCompile</id>
              </execution>

              <!-- 2nd pass: exclusively generate plugin descriptors -->
              <execution>
                <id>generate-plugin-descriptors</id>
                <goals>
                  <goal>compile</goal>
                  <goal>testCompile</goal>
                </goals>
                <configuration combine.self="override">
                  <annotationProcessorPaths>
                    <!-- Include `org.apache.logging.log4j.docgen.processor.DescriptorGenerator` that generates `<artifactId>-plugins.xml` -->
                    <path>
                      <groupId>org.apache.logging.log4j</groupId>
                      <artifactId>log4j-docgen</artifactId>
                      <version>${log4j-docgen.version}</version>
                    </path>
                    <!-- Include `log4j-core` providing `org.apache.logging.log4j.core.config.plugins.processor.PluginProcessor` that generates `Log4j2Plugins.dat` -->
                    <path>
                      <groupId>org.apache.logging.log4j</groupId>
                      <artifactId>log4j-core</artifactId>
                      <version>${project.version}</version>
                    </path>
                  </annotationProcessorPaths>
                  <annotationProcessors>
                    <!-- Process sources using `org.apache.logging.log4j.docgen.processor.DescriptorGenerator` to generate `<artifactId>-plugins.xml`.
                         `DescriptorGenerator` must precede `PluginProcessor`, since the latter *claims* the `@Plugin`.
                         Once claimed, `javac` doesn't pass those sources to other processors. -->
                    <processor>org.apache.logging.log4j.docgen.processor.DescriptorGenerator</processor>
                    <!-- Process sources using `org.apache.logging.log4j.core.config.plugins.processor.PluginProcessor` to generate `Log4j2Plugins.dat` -->
                    <processor>org.apache.logging.log4j.core.config.plugins.processor.PluginProcessor</processor>
                    <!-- Generates GraalVM reachability metadata -->
                    <processor>org.apache.logging.log4j.core.config.plugins.processor.GraalVmProcessor</processor>
                  </annotationProcessors>
                  <compilerArgs>
                    <!-- Provide `org.apache.logging.log4j.docgen.processor.DescriptorGenerator` arguments: -->
                    <arg>-Alog4j.docgen.descriptorFilePath=${log4jDocgenDescriptorFilepath}</arg>
                    <arg>-Alog4j.docgen.groupId=${project.groupId}</arg>
                    <arg>-Alog4j.docgen.artifactId=${project.artifactId}</arg>
                    <arg>-Alog4j.docgen.version=${project.version}</arg>
                    <arg>-Alog4j.docgen.description=${project.description}</arg>
                    <arg>-Alog4j.docgen.typeFilter.excludePattern=${log4j.docgen.typeFilter.excludePattern}</arg>
                    <!-- Provide arguments for the GraalVM processor -->
                    <arg>-Alog4j.graalvm.groupId=${project.groupId}</arg>
                    <arg>-Alog4j.graalvm.artifactId=${project.artifactId}</arg>
                  </compilerArgs>
                  <proc>only</proc>
                </configuration>
              </execution>

            </executions>

          </plugin>

        </plugins>
      </build>

    </profile>

  </profiles>

</project>
