pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion> 
  <parent>
    <groupId>com.fasterxml.jackson</groupId>
    <artifactId>jackson-parent</artifactId>
    <version>2.18-SNAPSHOT</version>
  </parent>
  <groupId>com.fasterxml.jackson.util</groupId>
  <artifactId>jackson-compat-minor</artifactId>
  <name>Jackson-JDK-compat-test</name>
  <version>2.18-SNAPSHOT</version>
  <packaging>jar</packaging>
  <description>Test suite for tracking compatibility between adjacent minor versions of
Jackson components
</description>
  <url>https://github.com/FasterXML/jackson-compat-minor</url>    
  <scm>
    <connection>scm:git:git@github.com:FasterXML/jackson-compat-minor.git</connection>
    <developerConnection>scm:git:git@github.com:FasterXML/jackson-compat-minor.git</developerConnection>
    <url>https://github.com/FasterXML/jackson-compat-minor</url>    
    <tag>HEAD</tag>
  </scm>
  <properties>
    <!-- Basic idea: new(er) version of core components, older of dataformats
      -->
    <version.annotations>2.18.0-SNAPSHOT</version.annotations>
    <version.core>2.18.0-SNAPSHOT</version.core>
    <version.databind>2.18.0-SNAPSHOT</version.databind>

    <!-- 14-May-2019, tatu: Versions 2.10.x, 2.9.x and 2.8.x work;
              2.7.x fails for Guava + Avro combination
              2.6.x fails for Smile, XML and YAML
    -->
    <!-- 04-Jun-2020, tatu: Jackson 2.12.0-SNAPSHOT still working with
              2.11.x, 2.10.x, 2.9.x, 2.8.x
    -->
    <!-- 10-Jan-2021, tatu: Jackson 2.13.0-SNAPSHOT still working with
             2.12.x - 2.8.x
    -->
<!--
    <version.dataformats>${version.core}</version.dataformats>
    <version.dataformats>2.14.2</version.dataformats>
    <version.dataformats>2.13.5</version.dataformats>
    <version.dataformats>2.12.5</version.dataformats>
    <version.dataformats>2.11.4</version.dataformats>
    <version.dataformats>2.10.5</version.dataformats>
    <version.dataformats>2.9.10</version.dataformats>
-->
    <version.dataformats>${version.core}</version.dataformats>
    <version.datatypes>${version.dataformats}</version.datatypes>
    <version.jacksonjr>${version.dataformats}</version.jacksonjr>

    <version.spring>4.3.26.RELEASE</version.spring>
  </properties>

  <dependencies>
     <!-- 16-Oct-2020, tatu: To directly test older/newer Guava library, can NOT
            change property, unfortunately, as that would only affect parent pom
            (jackson-bom), but not dependency via Guava datatype module.
           Instead will have to directly override
     -->
<!-- uncomment to force different underlying Guava version
     <dependency>
       <groupId>com.google.guava</groupId>
       <artifactId>guava</artifactId>
       <version>31.1-jre</version>
     </dependency>
-->

    <dependency>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-annotations</artifactId>
      <version>${version.annotations}</version>
    </dependency>
    <dependency>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-core</artifactId>
      <version>${version.core}</version>
    </dependency>
    <dependency>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-databind</artifactId>
      <version>${version.databind}</version>
    </dependency>

    <!-- JAXB sort of ubiquitous -->
    <dependency>
      <groupId>com.fasterxml.jackson.module</groupId>
      <artifactId>jackson-module-jaxb-annotations</artifactId>
      <version>${version.dataformats}</version>
    </dependency>

    <!-- first, try to ensure dataformats work -->
    <dependency>
      <groupId>com.fasterxml.jackson.dataformat</groupId>
      <artifactId>jackson-dataformat-avro</artifactId>
      <version>${version.dataformats}</version>
    </dependency>
    <dependency>
      <groupId>com.fasterxml.jackson.dataformat</groupId>
      <artifactId>jackson-dataformat-cbor</artifactId>
      <version>${version.dataformats}</version>
    </dependency>
    <dependency>
      <groupId>com.fasterxml.jackson.dataformat</groupId>
      <artifactId>jackson-dataformat-csv</artifactId>
      <version>${version.dataformats}</version>
    </dependency>
    <dependency>
      <groupId>com.fasterxml.jackson.dataformat</groupId>
      <artifactId>jackson-dataformat-protobuf</artifactId>
      <version>${version.dataformats}</version>
    </dependency>
    <dependency>
      <groupId>com.fasterxml.jackson.dataformat</groupId>
      <artifactId>jackson-dataformat-smile</artifactId>
      <version>${version.dataformats}</version>
    </dependency>
    <dependency>
      <groupId>com.fasterxml.jackson.dataformat</groupId>
      <artifactId>jackson-dataformat-xml</artifactId>
      <version>${version.dataformats}</version>
    </dependency>
    <dependency>
      <groupId>com.fasterxml.jackson.dataformat</groupId>
      <artifactId>jackson-dataformat-yaml</artifactId>
      <version>${version.dataformats}</version>
    </dependency>

    <!-- Then Jackson-jr -->
    <dependency>
      <groupId>com.fasterxml.jackson.jr</groupId>
      <artifactId>jackson-jr-objects</artifactId>
      <version>${version.jacksonjr}</version>
    </dependency>

    <!-- Also small set of choice datatypes -->
    <dependency>
      <groupId>com.fasterxml.jackson.datatype</groupId>
      <artifactId>jackson-datatype-guava</artifactId>
      <version>${version.datatypes}</version>
    </dependency>
    <dependency>
      <groupId>com.fasterxml.jackson.datatype</groupId>
      <artifactId>jackson-datatype-joda</artifactId>
      <version>${version.datatypes}</version>
    </dependency>
    <!-- added for 2.11 -->
    <dependency>
      <groupId>com.fasterxml.jackson.datatype</groupId>
      <artifactId>jackson-datatype-json-org</artifactId>
      <version>${version.datatypes}</version>
    </dependency>

    <!-- maven-core for comparable version -->
    <dependency>
      <groupId>org.apache.maven</groupId>
      <artifactId>maven-core</artifactId>
      <version>3.6.3</version>
    </dependency>

    <!-- 04-Jun-2020, tatu: And why not Protobuf value type support too! -->
    <dependency>
      <groupId>com.hubspot.jackson</groupId>
      <artifactId>jackson-datatype-protobuf</artifactId>
      <version>0.9.12</version>
    </dependency>

    <!-- 23-Feb-2016, tatu: Looks like we better use Woodstox as Stax impl, too -->    
    <dependency>
      <groupId>com.fasterxml.woodstox</groupId>
      <artifactId>woodstox-core</artifactId>
      <version>6.2.1</version>
      <scope>test</scope>
    </dependency>

    <!--  19-Apr-2020, tatu: Possibly temporary add to play with Groovy AstBuilder -->
    <dependency>
        <groupId>org.codehaus.groovy</groupId>
        <artifactId>groovy</artifactId>
        <version>3.0.2</version>
    </dependency>

    <!-- and good old junit too -->
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <version>${version.junit}</version>
      <scope>test</scope>
    </dependency>

    <!--
      -  30-May-2018, tatu: Vuln Testing needs more deps
      -->

    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>slf4j-api</artifactId>
      <version>1.7.25</version>
    </dependency>
    <dependency>
      <groupId>ch.qos.logback</groupId>
      <artifactId>logback-classic</artifactId>
      <version>1.2.3</version>
    </dependency>

    <!--  Vulns: Spring -->
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
      <version>${version.spring}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aop</artifactId>
      <version>${version.spring}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-beans</artifactId>
      <version>${version.spring}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-web</artifactId>
      <version>${version.spring}</version>
    </dependency>
    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>javax.servlet-api</artifactId>
      <version>3.1.0</version>
    </dependency>

    <!--  Vulns: C3P0 -->
    <dependency>
      <groupId>com.mchange</groupId>
      <artifactId>c3p0</artifactId>
      <version>0.9.5.3</version>
    </dependency>

    <!--  Vulns: iBatis/myBatis -->
    <dependency>
      <groupId>org.mybatis</groupId>
      <artifactId>mybatis</artifactId>
      <version>3.4.6</version>
    </dependency>

    <dependency>
      <groupId>javax</groupId>
      <artifactId>javaee-api</artifactId>
      <version>7.0</version>
    </dependency>

    <!--  Vuln: JODD framework, sql sid -->
    <dependency>
      <groupId>org.jodd</groupId>
      <artifactId>jodd-db</artifactId>
      <version>3.7.1</version>
    </dependency>

    <!-- 23-Jul-2017: batch of 4 vulns:
    
        * blaze-ds
        * slf4j-ext
        * JDK (DRSHelper)
        * Axis2 (jaxws
    -->

    <dependency>
	   <groupId>com.adobe.blazeds</groupId>
	   <artifactId>blazeds-opt</artifactId>
	   <version>3.2.0.3978</version>
    </dependency>
    <dependency>
        <groupId>com.adobe.blazeds</groupId>
	   <artifactId>blazeds-core</artifactId>
        <version>3.2.0.3978</version>
    </dependency>
    <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-ext</artifactId>
        <version>1.8.0-beta2</version>
    </dependency>
    <dependency>
        <groupId>org.apache.axis2</groupId>
        <artifactId>axis2-jaxws</artifactId>
        <version>1.7.8</version>
    </dependency>

    <!--  Vuln #2186 -->
    <dependency>
        <groupId>org.jboss</groupId>
        <artifactId>jboss-common-core</artifactId>
        <version>2.5.0.Final</version>
    </dependency>
    <dependency>
      <groupId>org.apache.openjpa</groupId>
      <artifactId>openjpa</artifactId>
      <version>2.4.0</version>
    </dependency>
    <dependency>
      <groupId>org.apache.axis2</groupId>
      <artifactId>axis2-transport-jms</artifactId>
      <version>1.7.8</version>
    </dependency>
    <!-- /Vuln #2186 -->

    <!-- Vuln #2326 -->
    <dependency>
      <groupId>mysql</groupId>
      <artifactId>mysql-connector-java</artifactId>
      <version>8.0.15</version>
    </dependency>

    <!-- Vuln #2341 -->
    <dependency>
      <groupId>org.jdom</groupId>
      <artifactId>jdom</artifactId>
      <version>1.1.3</version>
    </dependency>
    <dependency>
      <groupId>org.jdom</groupId>
      <artifactId>jdom2</artifactId>
      <version>2.0.6</version>
    </dependency>

    <!-- #2387, #2460, #2526: EHCache -->
    <dependency>
      <groupId>net.sf.ehcache</groupId>
      <artifactId>ehcache</artifactId>
      <version>2.10.6</version>
    </dependency>
    <dependency>
      <groupId>hibernate</groupId>
      <artifactId>hibernate</artifactId>
      <version>3.1rc2</version>
      <exclusions>
        <exclusion>
          <groupId>javax.transaction</groupId>
          <artifactId>jta</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <!-- #2410: HikariCP -->
    <dependency>
      <groupId>com.zaxxer</groupId>
      <artifactId>HikariCP</artifactId>
      <version>3.3.1</version>
    </dependency>

    <!-- #2420: CXF JAX-RS Provider -->
    <dependency>
      <groupId>org.apache.cxf</groupId>
      <artifactId>cxf-rt-frontend-jaxrs</artifactId>
      <version>3.1.2</version>
    </dependency>

    <!-- #2462: commons-configuration, -2 -->
    <dependency>
      <groupId>commons-configuration</groupId>
      <artifactId>commons-configuration</artifactId>
      <version>1.10</version>
    </dependency>
    <dependency>
      <groupId>org.apache.commons</groupId>
      <artifactId>commons-configuration2</artifactId>
      <version>2.3</version>
    </dependency>

    <!-- #2469: Xalan2 -->
    <dependency>
      <groupId>xalan</groupId>
      <artifactId>xalan</artifactId>
      <version>2.7.2</version>
    </dependency>

    <!-- #2478: commons-dbcp, p6spy -->
    <!-- #2986: commons-dbcp2 -->
    <dependency>
      <groupId>commons-dbcp</groupId>
      <artifactId>commons-dbcp</artifactId>
      <version>1.4</version>
    </dependency>
    <dependency>
      <groupId>org.apache.commons</groupId>
      <artifactId>commons-dbcp2</artifactId>
      <version>2.8.0</version>
    </dependency>
    <dependency>
      <groupId>p6spy</groupId>
      <artifactId>p6spy</artifactId>
      <version>3.8.6</version>
    </dependency>

    <!-- #2498: log4j-extras -->
    <dependency>
      <groupId>log4j</groupId>
      <artifactId>apache-log4j-extras</artifactId>
      <version>1.2.17</version>
    </dependency>

    <!--  #2620: xbean/reflect -->
    <dependency>
        <groupId>org.apache.xbean</groupId>
        <artifactId>xbean-reflect</artifactId>
        <version>4.15</version>
    </dependency>

    <!--  #2631: shaded HikariConfig -->
    <dependency>
        <groupId>org.apache.hadoop</groupId>
        <artifactId>hadoop-client-minicluster</artifactId>
        <version>3.2.1</version>
    </dependency>

    <!--  #2634: ibatis-sqlmap, anteros-core -->
    <dependency>
        <groupId>org.apache.ibatis</groupId>
        <artifactId>ibatis-sqlmap</artifactId>
        <version>2.3.4.726</version>
    </dependency>

	<dependency>
	    <groupId>br.com.anteros</groupId>
	    <artifactId>Anteros-Core</artifactId>
	    <version>1.2.1</version>
	</dependency>
	<dependency>
	    <groupId>br.com.anteros</groupId>
	    <artifactId>Anteros-DBCP</artifactId>
	    <version>1.0.1</version>
	</dependency>

    <!-- 2648: shiro-core -->
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-core</artifactId>
        <version>1.5.1</version>
    </dependency>

    <!-- 2658: ignite-jta, quartz-core -->
    <dependency>
        <groupId>org.apache.ignite</groupId>
        <artifactId>ignite-jta</artifactId>
        <version>2.7.6</version>
    </dependency>
    <dependency>
        <groupId>org.quartz-scheduler</groupId>
        <artifactId>quartz</artifactId>
        <version>2.3.2</version>
    </dependency>

    <!-- 2659: aries-transaction-jms -->
    <dependency>
        <groupId>org.apache.aries.transaction</groupId>
        <artifactId>org.apache.aries.transaction.jms</artifactId>
        <version>2.0.0</version>
    </dependency>

    <!-- 2660: caucho.quercus -->
    <dependency>
        <groupId>com.caucho</groupId>
        <artifactId>quercus</artifactId>
        <version>4.0.63</version>
    </dependency>

    <!-- 2662: bus-proxy -->
    <dependency>
        <groupId>org.aoju</groupId>
        <artifactId>bus-proxy</artifactId>
        <version>5.6.9</version>
    </dependency>

    <!-- 2664: activemq, activemq-jms-pool -->
    <dependency>
        <groupId>org.apache.activemq</groupId>
        <artifactId>activemq-jms-pool</artifactId>
        <version>5.15.11</version>
    </dependency>
    <dependency>
        <groupId>org.apache.activemq</groupId>
        <artifactId>activemq-pool</artifactId>
        <version>5.15.11</version>
    </dependency>
    <dependency>
        <groupId>org.apache.activemq</groupId>
        <artifactId>activemq-core</artifactId>
        <version>5.7.0</version>
    </dependency>

    <!-- 2666: commons-proxy -->
    <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-proxy</artifactId>
        <version>1.0</version>
    </dependency>

    <!-- 2682: commons-jelly -->
    <dependency>
        <groupId>commons-jelly</groupId>
        <artifactId>commons-jelly</artifactId>
        <version>1.0</version>
    </dependency>

    <!-- 2688: apache-drill: specific version matters (newer ones don't have it) -->
    <dependency>
        <groupId>org.apache.drill.exec</groupId>
        <artifactId>drill-jdbc-all</artifactId>
        <version>1.4.0</version>
    </dependency>

    <!-- #2704: Xalan2 via JAXP RI -->
	<dependency>
	    <groupId>com.sun.xml.parsers</groupId>
	    <artifactId>jaxp-ri</artifactId>
	    <version>1.4</version>
	</dependency>

    <!-- #2765: org.jsecurity -->
    <dependency>
        <groupId>org.jsecurity</groupId>
        <artifactId>jsecurity</artifactId>
        <version>0.9.0</version>
    </dependency>

    <!-- #2798: com.pastdev.httpcomponents -->
    <dependency>
        <groupId>com.pastdev.httpcomponents</groupId>
        <artifactId>configuration</artifactId>
        <version>0.1.3</version>
    </dependency>

    <!-- #2826: -->
    <dependency>
        <groupId>com.nqadmin.rowset</groupId>
        <artifactId>jdbcrowsetimpl</artifactId>
        <version>1.0.1</version>
    </dependency>

    <!-- #2827: -->
    <dependency>
        <groupId>org.arrahtec</groupId>
        <artifactId>profiler-core</artifactId>
        <version>6.1.7</version>
    </dependency>

    <!--  or, this would ALSO work, renamed but similar contents -->
<!--     <dependency>
        <groupId>org.arrahtec</groupId>
        <artifactId>osdq-core</artifactId>
        <version>6.1.9</version>
    </dependency>
-->

    <!-- #2996 -->
    <dependency>
        <groupId>com.newrelic.agent.java</groupId>
        <artifactId>newrelic-agent</artifactId>
        <version>3.31.1</version>
    </dependency>

    <!-- #2997 -->
    <dependency>
        <groupId>tomcat</groupId>
        <artifactId>naming-factory-dbcp</artifactId>
        <version>5.5.23</version>
    </dependency>

    <!-- #2998 -->
    <dependency>
        <groupId>org.apache.tomcat</groupId>
        <artifactId>tomcat-dbcp</artifactId>
        <version>10.0.0</version>
    </dependency>

    <!-- #2999 -->
    <dependency>
        <groupId>org.glassfish.web</groupId>
        <artifactId>javax.servlet.jsp.jstl</artifactId>
        <version>1.2.5</version>
    </dependency>

    <!-- #3003 -->
    <dependency>
        <groupId>org.docx4j.org.apache</groupId>
        <artifactId>xalan-interpretive</artifactId>
        <version>8.0.0</version>
    </dependency>

    <!-- #3270 would require:
    <dependency>
        <groupId>com.vaadin</groupId>
        <artifactId>vaadin-server</artifactId>
        <version>7.7.14</version>
    </dependency>
    <dependency>
        <groupId>com.vaadin</groupId>
        <artifactId>vaadin-shared</artifactId>
        <version>7.7.14</version>
    </dependency>
    -->

  </dependencies>

  <repositories>
    <!-- to resolve snapshot versions, need this: -->
    <repository>
      <id>sonatype-nexus-snapshots</id>
      <name>Sonatype Nexus Snapshots</name>
      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
      <releases><enabled>false</enabled></releases>
      <snapshots><enabled>true</enabled></snapshots>
    </repository>

<!--  
   <repository>
    <id>maven.oracle.com</id>
    <name>oracle-maven-repo</name>
    <url>https://www.datanucleus.org/downloads/maven2/</url>
    <layout>default</layout>
    <releases>
      <enabled>true</enabled>
      <updatePolicy>always</updatePolicy>
    </releases>
   </repository>
-->
   <repository>
    <id>wso2</id>
    <name>wso2-maven-repo</name>
    <url>https://dist.wso2.org/maven2/</url>
   </repository>
  </repositories>

</project>