pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>3.5.6</version>
    <!-- lookup parent from repository -->
  </parent>

  <groupId>org.owasp</groupId>
  <artifactId>wrongsecrets</artifactId>
  <version>1.12.9-SNAPSHOT</version>

  <name>OWASP WrongSecrets</name>
  <description>Examples with how to not use secrets</description>
  <url>https://owasp.org/www-project-wrongsecrets/</url>
  <organization>
    <name>The Open Web Application Security Project (OWASP)</name>
    <url>https://owasp.org/</url>
  </organization>
  <licenses>
    <license>
      <name>AGPLv3 License</name>
      <url>https://opensource.org/license/agpl-v3/</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <scm>
    <url>https://github.com/OWASP/wrongsecrets</url>
  </scm>
  <issueManagement>
    <system>GitHub Issue Tracking</system>
    <url>https://github.com/OWASP/wrongsecrets/issues</url>
  </issueManagement>

  <!--    <distributionManagement>-->
  <!--        <snapshotRepository>-->
  <!--            <id>ossrh</id>-->
  <!--            <url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>-->
  <!--        </snapshotRepository>-->
  <!--    </distributionManagement>-->
  <properties>
    <KeePassJava2.version>2.2.4</KeePassJava2.version>
    <asciidoctor.maven.plugin.version>3.2.0</asciidoctor.maven.plugin.version>
    <asciidoctorj.version>3.0.0</asciidoctorj.version>
    <aws.sdk.version>2.35.8</aws.sdk.version>
    <bootstrap.version>5.3.8</bootstrap.version>
    <com.azure.spring.version>6.0.0</com.azure.spring.version>
    <cyclonedx.core.version>11.0.0</cyclonedx.core.version>
    <datatables.version>2.3.2</datatables.version>
    <dependency-check-maven.version>12.1.8</dependency-check-maven.version>
    <gatling-maven-plugin.version>4.20.6</gatling-maven-plugin.version>
    <gatling.version>3.14.6</gatling.version>
    <gcp.sdk.version>7.3.2</gcp.sdk.version>
    <github.button.version>2.14.1</github.button.version>
    <io.netty.version>4.1.118.Final</io.netty.version>
    <java.version>25</java.version>
    <jquery.version>3.7.1</jquery.version>
    <jruby.version>10.0.2.0</jruby.version>
    <lombok.version>1.18.42</lombok.version>
    <maven-compiler-plugin.version>3.14.1</maven-compiler-plugin.version>
    <maven.compiler.proc>full</maven.compiler.proc>
    <maven.compiler.target>25</maven.compiler.target>
    <spring.cloud-version>2025.0.0</spring.cloud-version>
    <spring.security.version>6.2.3</spring.security.version>
    <system-stubs-jupiter.version>2.1.8</system-stubs-jupiter.version>
    <thymeleaf-extras-springsecurity6.version>3.1.3.RELEASE</thymeleaf-extras-springsecurity6.version>
    <thymeleaf.layout.version>3.4.0</thymeleaf.layout.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-dependencies</artifactId>
        <version>${spring.cloud-version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>org.testcontainers</groupId>
        <artifactId>testcontainers-bom</artifactId>
        <version>${testcontainers.version}</version>
      </dependency>

      <dependency>
        <groupId>com.google.cloud</groupId>
        <artifactId>spring-cloud-gcp-dependencies</artifactId>
        <version>${gcp.sdk.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>com.azure.spring</groupId>
        <artifactId>spring-cloud-azure-dependencies</artifactId>
        <version>${com.azure.spring.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>io.netty</groupId>
        <artifactId>netty-bom</artifactId>
        <version>${io.netty.version}</version>
        <!-- Explicitly define the Netty version to be in sync with the Azure one otherwise a warning is shown -->
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.projectlombok</groupId>
      <artifactId>lombok</artifactId>
      <version>${lombok.version}</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>

    <dependency>
      <groupId>com.fasterxml.jackson.dataformat</groupId>
      <artifactId>jackson-dataformat-yaml</artifactId>
    </dependency>
    <dependency>
      <groupId>nz.net.ultraq.thymeleaf</groupId>
      <artifactId>thymeleaf-layout-dialect</artifactId>
      <version>${thymeleaf.layout.version}</version>
    </dependency>
    <dependency>
      <groupId>org.thymeleaf.extras</groupId>
      <artifactId>thymeleaf-extras-springsecurity6</artifactId>
      <version>${thymeleaf-extras-springsecurity6.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>${spring-security.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
      <version>${spring-security.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-test</artifactId>
      <version>${spring-security.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.testcontainers</groupId>
      <artifactId>vault</artifactId>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.testcontainers</groupId>
      <artifactId>junit-jupiter</artifactId>
    </dependency>
    <dependency>
      <groupId>org.testcontainers</groupId>
      <artifactId>testcontainers</artifactId>
      <version>1.21.3</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.cloud</groupId>
      <artifactId>spring-cloud-starter-vault-config</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.cloud</groupId>
      <artifactId>spring-cloud-vault-config</artifactId>
    </dependency>
    <dependency>
      <groupId>software.amazon.awssdk</groupId>
      <artifactId>sts</artifactId>
      <version>${aws.sdk.version}</version>
    </dependency>
    <dependency>
      <groupId>software.amazon.awssdk</groupId>
      <artifactId>ssm</artifactId>
      <version>${aws.sdk.version}</version>
    </dependency>
    <dependency>
      <groupId>org.linguafranca.pwdb</groupId>
      <artifactId>KeePassJava2</artifactId>
      <version>${KeePassJava2.version}</version>
    </dependency>
    <dependency>
      <groupId>org.asciidoctor</groupId>
      <artifactId>asciidoctorj-api</artifactId>
      <version>${asciidoctorj.version}</version>
    </dependency>
    <dependency>
      <groupId>org.asciidoctor</groupId>
      <artifactId>asciidoctorj</artifactId>
      <version>${asciidoctorj.version}</version>
    </dependency>
    <dependency>
      <groupId>org.jruby</groupId>
      <artifactId>jruby-complete</artifactId>
      <version>${jruby.version}</version>
    </dependency>
    <dependency>
      <groupId>org.jruby</groupId>
      <artifactId>jruby</artifactId>
      <version>${jruby.version}</version>
    </dependency>
    <dependency>
      <groupId>org.jruby</groupId>
      <artifactId>jruby-stdlib</artifactId>
      <version>${jruby.version}</version>
    </dependency>
    <dependency>
      <groupId>org.jruby</groupId>
      <artifactId>jruby-base</artifactId>
      <version>${jruby.version}</version>
    </dependency>
    <dependency>
      <groupId>org.webjars</groupId>
      <artifactId>bootstrap</artifactId>
      <version>${bootstrap.version}</version>
    </dependency>
    <dependency>
      <groupId>org.webjars.npm</groupId>
      <artifactId>github-buttons</artifactId>
      <version>${github.button.version}</version>
    </dependency>
    <dependency>
      <groupId>org.webjars</groupId>
      <artifactId>datatables</artifactId>
      <version>${datatables.version}</version>
    </dependency>
    <dependency>
      <groupId>org.webjars</groupId>
      <artifactId>jquery</artifactId>
      <version>${jquery.version}</version>
    </dependency>
    <!--        <dependency>-->
    <!--            <groupId>org.springframework.boot</groupId>-->
    <!--            <artifactId>spring-boot-devtools</artifactId>-->
    <!--            <optional>true</optional>-->
    <!--        </dependency>-->
    <dependency>
      <groupId>com.google.cloud</groupId>
      <artifactId>google-cloud-secretmanager</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springdoc</groupId>
      <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
      <version>2.8.13</version>
    </dependency>
    <dependency>
      <groupId>com.azure.spring</groupId>
      <artifactId>spring-cloud-azure-starter-keyvault-secrets</artifactId>
    </dependency>

    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-test</artifactId>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>uk.org.webcompere</groupId>
      <artifactId>system-stubs-jupiter</artifactId>
      <version>${system-stubs-jupiter.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>io.gatling.highcharts</groupId>
      <artifactId>gatling-charts-highcharts</artifactId>
      <version>${gatling.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.cyclonedx</groupId>
      <artifactId>cyclonedx-core-java</artifactId>
      <version>${cyclonedx.core.version}</version>
    </dependency>

    <dependency>
      <groupId>org.owasp</groupId>
      <artifactId>dependency-check-maven</artifactId>
      <version>${dependency-check-maven.version}</version>
      <type>maven-plugin</type>
    </dependency>
    <dependency>
      <groupId>com.tngtech.archunit</groupId>
      <artifactId>archunit-junit5</artifactId>
      <version>1.4.1</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>com.github.spotbugs</groupId>
      <artifactId>spotbugs-annotations</artifactId>
      <version>4.9.7</version>
    </dependency>
    <dependency>
      <groupId>io.github.wimdeblauwe</groupId>
      <artifactId>testcontainers-cypress</artifactId>
      <version>1.9.1</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.vault</groupId>
      <artifactId>spring-vault-core</artifactId>
      <version>3.2.0</version>
    </dependency>
  </dependencies>

  <build>
    <testResources>
      <testResource>
        <directory>src/test/resources</directory>
      </testResource>
      <testResource>
        <targetPath>e2e</targetPath>
        <directory>src/test/e2e</directory>
      </testResource>
    </testResources>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-checkstyle-plugin</artifactId>
          <version>3.6.0</version>
          <dependencies>
            <dependency>
              <groupId>com.puppycrawl.tools</groupId>
              <artifactId>checkstyle</artifactId>
              <version>11.1.0</version>
            </dependency>
          </dependencies>
        </plugin>
        <plugin>
          <groupId>com.github.spotbugs</groupId>
          <artifactId>spotbugs-maven-plugin</artifactId>
          <version>4.9.7.0</version>
          <configuration>
            <omitVisitors>FindReturnRef</omitVisitors>
            <plugins>
              <plugin>
                <groupId>com.h3xstream.findsecbugs</groupId>
                <artifactId>findsecbugs-plugin</artifactId>
                <version>1.14.0</version>
              </plugin>
            </plugins>
          </configuration>
          <dependencies>
            <!-- overwrite dependency on spotbugs if you want to specify the version of spotbugs -->
            <dependency>
              <groupId>com.github.spotbugs</groupId>
              <artifactId>spotbugs</artifactId>
              <version>4.9.7</version>
            </dependency>
          </dependencies>
        </plugin>
      </plugins>
    </pluginManagement>
    <plugins>
      <plugin>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-maven-plugin</artifactId>
        <configuration>
          <excludeDevtools>true</excludeDevtools>
          <!-- See http://docs.spring.io/spring-boot/docs/current/reference/html/howto-build.html#howto-extract-specific-libraries-when-an-executable-jar-runs -->
          <requiresUnpack>
            <dependency>
              <groupId>org.asciidoctor</groupId>
              <artifactId>asciidoctorj</artifactId>
            </dependency>
            <dependency>
              <groupId>org.jruby</groupId>
              <artifactId>jruby-complete</artifactId>
            </dependency>
          </requiresUnpack>
          <jvmArguments>
            <!-- -Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000-->
          </jvmArguments>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-checkstyle-plugin</artifactId>
        <version>3.6.0</version>
        <configuration>
          <consoleOutput>true</consoleOutput>
          <failsOnError>true</failsOnError>
          <configLocation>config/checkstyle/checkstyle.xml</configLocation>
          <suppressionsLocation>config/checkstyle/suppressions.xml</suppressionsLocation>
          <suppressionsFileExpression>checkstyle.suppressions.file</suppressionsFileExpression>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.asciidoctor</groupId>
        <artifactId>asciidoctor-maven-plugin</artifactId>
        <version>${asciidoctor.maven.plugin.version}</version>
        <configuration>
          <baseDir>${project.basedir}</baseDir>
          <sourceDirectory>src/main/resources/explanations</sourceDirectory>
          <outputDirectory>${project.build.outputDirectory}/explanations</outputDirectory>
          <!-- https://github.com/asciidoctor/asciidoctor-maven-examples/blob/main/asciidoc-to-html-example/pom.xml -->
        </configuration>
        <executions>
          <execution>
            <id>asciidoc-to-html</id>
            <goals>
              <goal>process-asciidoc</goal>
            </goals>
            <phase>compile</phase>
            <configuration>
              <standalone>false</standalone>
              <attributes>
                <docType>null</docType>
              </attributes>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.cyclonedx</groupId>
        <artifactId>cyclonedx-maven-plugin</artifactId>
        <version>2.9.1</version>
        <configuration>
          <projectType>library</projectType>
          <schemaVersion>1.3</schemaVersion>
          <includeBomSerialNumber>true</includeBomSerialNumber>
          <includeCompileScope>true</includeCompileScope>
          <includeProvidedScope>true</includeProvidedScope>
          <includeRuntimeScope>true</includeRuntimeScope>
          <includeSystemScope>true</includeSystemScope>
          <includeTestScope>false</includeTestScope>
          <includeLicenseText>false</includeLicenseText>
          <outputFormat>all</outputFormat>
          <outputName>bom</outputName>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>makeAggregateBom</goal>
            </goals>
            <phase>install</phase>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.owasp</groupId>
        <artifactId>dependency-check-maven</artifactId>
        <version>${dependency-check-maven.version}</version>
        <configuration>
          <nvdApiKey>27a3071a-9d40-42f2-ac92-74bebbc4bdeb</nvdApiKey>
          <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
          <ossIndexServerId>ossindex</ossIndexServerId>
          <!-- server id configured in settings.xml-->
          <ossindexAnalyzerEnabled>true</ossindexAnalyzerEnabled>
          <!--disable when getting 401 errors-->
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>com.github.eirslett</groupId>
        <artifactId>frontend-maven-plugin</artifactId>
        <version>1.15.4</version>
        <executions>
          <execution>
            <id>install node and npm</id>
            <goals>
              <goal>install-node-and-npm</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <nodeVersion>v24.5.0</nodeVersion>
              <!-- download node from https://nodejs.org/dist/ -->
              <workingDirectory>js</workingDirectory>
            </configuration>
          </execution>
          <execution>
            <id>npm install</id>
            <goals>
              <goal>npm</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <arguments>install</arguments>
              <workingDirectory>js</workingDirectory>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.springdoc</groupId>
        <artifactId>springdoc-openapi-maven-plugin</artifactId>
        <version>1.5</version>
      </plugin>
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>exec-maven-plugin</artifactId>
        <version>3.6.1</version>
        <configuration>
          <executable>./js/node_modules/.bin/javascript-obfuscator${script.extension}</executable>
          <arguments>
            <argument>./js/index.js</argument>
            <argument>--output</argument>
            <argument>./target/classes/static/js/index.js</argument>
          </arguments>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>exec</goal>
            </goals>
            <phase>generate-resources</phase>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>${maven-compiler-plugin.version}</version>
        <configuration>
          <source>23</source>
          <target>23</target>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>tidy-maven-plugin</artifactId>
        <version>1.4.0</version>
        <executions>
          <execution>
            <id>validate</id>
            <goals>
              <goal>check</goal>
            </goals>
            <phase>validate</phase>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>com.diffplug.spotless</groupId>
        <artifactId>spotless-maven-plugin</artifactId>
        <version>3.0.0</version>
        <configuration>
          <formats>
            <format>
              <includes>
                <include>.gitignore</include>
              </includes>
              <trimTrailingWhitespace></trimTrailingWhitespace>
              <endWithNewline></endWithNewline>
              <indent>
                <tabs>true</tabs>
                <spacesPerTab>4</spacesPerTab>
              </indent>
            </format>
          </formats>
          <java>
            <includes>
              <include>src/main/java/**/*.java</include>
              <include>src/test/java/**/*.java</include>
            </includes>
            <removeUnusedImports></removeUnusedImports>
            <googleJavaFormat>
              <style>GOOGLE</style>
              <reflowLongStrings>true</reflowLongStrings>
            </googleJavaFormat>
          </java>
          <pom>
            <sortPom>
              <encoding>UTF-8</encoding>
              <lineSeparator>${line.separator}</lineSeparator>
              <expandEmptyElements>true</expandEmptyElements>
              <spaceBeforeCloseEmptyElement>false</spaceBeforeCloseEmptyElement>
              <keepBlankLines>true</keepBlankLines>
              <nrOfIndentSpace>2</nrOfIndentSpace>
              <indentBlankLines>false</indentBlankLines>
              <indentSchemaLocation>false</indentSchemaLocation>
              <predefinedSortOrder>recommended_2008_06</predefinedSortOrder>
              <sortProperties>true</sortProperties>
              <sortModules>true</sortModules>
              <sortExecutions>true</sortExecutions>
            </sortPom>
          </pom>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>io.gatling</groupId>
        <artifactId>gatling-maven-plugin</artifactId>
        <version>${gatling-maven-plugin.version}</version>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <version>3.5.4</version>
        <configuration>
          <argLine>-Dspring.profiles.active=test,maven-test</argLine>
        </configuration>
      </plugin>
    </plugins>
  </build>

  <!-- Required by exec-maven-plugin to run NPM *.CMD script on Windows  -->
  <profiles>
    <profile>
      <id>Windows</id>
      <activation>
        <os>
          <family>Windows</family>
        </os>
      </activation>
      <properties>
        <script.extension>.cmd</script.extension>
      </properties>
    </profile>
    <profile>
      <id>unix</id>
      <activation>
        <os>
          <family>unix</family>
        </os>
      </activation>
      <properties>
        <script.extension></script.extension>
      </properties>
    </profile>
  </profiles>
</project>