<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>4.1.0</version>
        <relativePath/>
    </parent>

    <groupId>net.thebennett.platform</groupId>
    <artifactId>platform-parent</artifactId>
    <version>0.1.12</version>
    <packaging>pom</packaging>
    <name>The Bennett Platform :: Parent</name>
    <description>Shared parent POM: Java/Spring versions, dependency and plugin management for all apps.</description>

    <properties>
        <java.version>25</java.version>
        <maven.compiler.release>25</maven.compiler.release>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <aws.sdk.version>2.51.4</aws.sdk.version>
        <!-- Override Spring Boot's managed driver to patch CVE-2026-54291 (fixed in 42.7.12). -->
        <postgresql.version>42.7.12</postgresql.version>
        <!-- Pulled in transitively by the AWS SDK's netty-nio-client. 4.2.15 carried four HIGH CVEs
             (2026-59901, -55831, -55833, -56745) and 4.2.16 a CRITICAL (2026-75595); 4.2.17 clears them. -->
        <netty.version>4.2.17.Final</netty.version>
        <!-- Spring Boot 4.1.0 ships Tomcat 11.0.22 (CVE-2026-65182, -65905, -68525, all CRITICAL) and
             4.1.1 still only 11.0.24. Trivy fails every app's merge gate on these until the embed
             jars are 11.0.25, so the version is set here rather than in each app. -->
        <tomcat.version>11.0.25</tomcat.version>
        <!-- CVE-2026-54399 (HIGH): the AWS SDK's apache5-client still pins httpcore5 5.4.2, which every
             app with the storage starter carries. 5.4.3 fixes it; -h2 is released as a matched pair. -->
        <httpcore5.version>5.4.3</httpcore5.version>
        <!-- Frontend standard: Vite + React + TS SPA built into the jar. An app opts in by declaring
             the two managed plugins below; set -DskipFrontend=true for backend-only iterations. -->
        <node.version>v22.12.0</node.version>
        <skipFrontend>false</skipFrontend>
        <frontend-maven-plugin.version>2.0.2</frontend-maven-plugin.version>
    </properties>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.apache.httpcomponents.core5</groupId>
                <artifactId>httpcore5</artifactId>
                <version>${httpcore5.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.httpcomponents.core5</groupId>
                <artifactId>httpcore5-h2</artifactId>
                <version>${httpcore5.version}</version>
            </dependency>
            <!-- AWS SDK v2 (S3 / MinIO) version alignment -->
            <dependency>
                <groupId>software.amazon.awssdk</groupId>
                <artifactId>bom</artifactId>
                <version>${aws.sdk.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <pluginManagement>
            <plugins>
                <!-- Standard SPA build: an app with a frontend/ (Vite) dir declares this bare plugin and
                     inherits node install + npm install + `npm run build` (at prepare-package). -->
                <plugin>
                    <groupId>com.github.eirslett</groupId>
                    <artifactId>frontend-maven-plugin</artifactId>
                    <version>${frontend-maven-plugin.version}</version>
                    <configuration>
                        <workingDirectory>frontend</workingDirectory>
                        <installDirectory>target</installDirectory>
                        <skip>${skipFrontend}</skip>
                    </configuration>
                    <executions>
                        <execution>
                            <id>install-node-and-npm</id>
                            <goals><goal>install-node-and-npm</goal></goals>
                            <configuration><nodeVersion>${node.version}</nodeVersion></configuration>
                        </execution>
                        <execution>
                            <id>npm-install</id>
                            <goals><goal>npm</goal></goals>
                            <configuration><arguments>install --no-audit --no-fund</arguments></configuration>
                        </execution>
                        <execution>
                            <id>npm-build</id>
                            <phase>prepare-package</phase>
                            <goals><goal>npm</goal></goals>
                            <configuration><arguments>run build</arguments></configuration>
                        </execution>
                    </executions>
                </plugin>
                <!-- Copy the built SPA (frontend/dist) into the jar's static/ so Spring serves it. -->
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-resources-plugin</artifactId>
                    <executions>
                        <execution>
                            <id>copy-frontend</id>
                            <phase>prepare-package</phase>
                            <goals><goal>copy-resources</goal></goals>
                            <configuration>
                                <skip>${skipFrontend}</skip>
                                <outputDirectory>${project.build.outputDirectory}/static</outputDirectory>
                                <resources>
                                    <resource><directory>frontend/dist</directory></resource>
                                </resources>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>
            </plugins>
        </pluginManagement>
    </build>

</project>
