<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at
  http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied.  See the License for the
specific language governing permissions and limitations
under the License.
-->
<project
        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
        xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

    <parent>
        <groupId>org.apache.flink</groupId>
        <artifactId>flink-connector-parent</artifactId>
        <version>1.0.0</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>

    <groupId>io.confluent.flink</groupId>
    <artifactId>flink-connector-kafka-parent</artifactId>
    <version>3.4.0-1.20-cp4</version>
    <name>Flink : Connectors : Kafka : Parent</name>
    <packaging>pom</packaging>
    <inceptionYear>2022</inceptionYear>

    <scm>
        <url>https://github.com/apache/flink-connector-kafka</url>
        <connection>git@github.com:apache/flink-connector-kafka.git</connection>
        <developerConnection>
            scm:git:https://gitbox.apache.org/repos/asf/flink-connector-kafka.git
        </developerConnection>
    </scm>

    <modules>
        <module>flink-connector-kafka</module>
        <module>flink-sql-connector-kafka</module>
        <module>flink-connector-kafka-e2e-tests</module>
        <module>flink-python</module>
    </modules>

    <properties>
      <extension.groupId>junit</extension.groupId>
        <extension.artifactId>junit</extension.artifactId>
        <extension.version>4.11</extension.version>
        <flink.version>1.20.0-cp1</flink.version>
        <kafka.version>3.9.2</kafka.version>
        <confluent.version>7.4.4</confluent.version>

        <!-- Single source of truth for every jackson artifact: the bom imported below governs
             jackson-core, -databind, -annotations and the datatypes. Do not pin individual
             jackson artifacts alongside it, or core and databind drift out of alignment.
             CVE fixes carried by this version:
               jackson-core:     GHSA-72hv-8253-57qq, GHSA-r7wm-3cxj-wff9
               jackson-databind: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515,
                                 CVE-2026-59888, CVE-2026-59889, GHSA-mhm7-754m-9p8w -->
        <jackson-bom.version>2.18.9</jackson-bom.version>
        <junit4.version>4.13.2</junit4.version>
        <junit5.version>5.9.1</junit5.version>
        <assertj.version>3.23.1</assertj.version>
        <testcontainers.version>1.17.2</testcontainers.version>
        <mockito.version>3.4.6</mockito.version>
        <powermock.version>2.0.9</powermock.version>
        <hamcrest.version>1.3</hamcrest.version>
        <byte-buddy.version>1.12.10</byte-buddy.version>
        <commons-cli.version>1.5.0</commons-cli.version>
        <scala.binary.version>2.12</scala.binary.version>
        <scala-reflect.version>2.12.7</scala-reflect.version>
        <scala-library.version>2.12.7</scala-library.version>
        <snappy-java.version>1.1.10.5</snappy-java.version>
        <avro.version>1.11.4</avro.version>
        <guava.version>32.1.2-jre</guava.version>

        <japicmp.skip>false</japicmp.skip>
        <japicmp.referenceVersion>1.17.0</japicmp.referenceVersion>

        <slf4j.version>1.7.32</slf4j.version>
        <log4j.version>2.17.1</log4j.version>

        <flink.parent.artifactId>flink-connector-kafka-parent</flink.parent.artifactId>

        <!-- This property should contain the add-opens/add-exports commands required for the tests
         in the given connector's module to pass.
         It MUST be a space-separated list not containing any newlines,
         of entries in the form '[-]{2}add-[opens|exports]=<module>/<package>=ALL-UNNAMED'.-->
        <flink.connector.module.config/>
        <flink.surefire.baseArgLine>-XX:+UseG1GC -Xms256m -XX:+IgnoreUnrecognizedVMOptions ${flink.connector.module.config}</flink.surefire.baseArgLine>
    </properties>

    <dependencies>
        <!-- Root dependencies for all projects -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-core</artifactId>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
        </dependency>
        <dependency>
            <!--	Java 8 Date/time	-->
            <groupId>com.fasterxml.jackson.datatype</groupId>
            <artifactId>jackson-datatype-jsr310</artifactId>
        </dependency>
        <dependency>
            <!--	Java 8 Datatypes	-->
            <groupId>com.fasterxml.jackson.datatype</groupId>
            <artifactId>jackson-datatype-jdk8</artifactId>
        </dependency>

        <!-- Logging API -->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <scope>provided</scope>
        </dependency>

        <!-- 'javax.annotation' classes like '@Nullable' -->
        <dependency>
            <groupId>com.google.code.findbugs</groupId>
            <artifactId>jsr305</artifactId>
            <scope>provided</scope>
        </dependency>

        <!-- Test dependencies -->
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.junit.vintage</groupId>
            <artifactId>junit-vintage-engine</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>${mockito.version}</version>
            <type>jar</type>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>junit-jupiter</artifactId>
            <scope>test</scope>
        </dependency>

        <!-- Tests will have log4j as the default logging framework available -->

        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-slf4j-impl</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>io.confluent.flink</groupId>
            <artifactId>flink-test-utils-junit</artifactId>
            <scope>test</scope>
        </dependency>

        <!-- ArchUit test dependencies -->
        <dependency>
            <groupId>io.confluent.flink</groupId>
            <artifactId>flink-architecture-tests-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>io.confluent.flink</groupId>
            <artifactId>flink-architecture-tests-production</artifactId>
            <scope>test</scope>
        </dependency>

    </dependencies>

    <!-- This section defines the module versions that are used if nothing else is specified. -->

    <dependencyManagement>

        <dependencies>
            <!-- For dependency convergence -->
            <dependency>
                <groupId>net.bytebuddy</groupId>
                <artifactId>byte-buddy</artifactId>
                <version>${byte-buddy.version}</version>
            </dependency>

            <dependency>
                <groupId>net.bytebuddy</groupId>
                <artifactId>byte-buddy-agent</artifactId>
                <version>${byte-buddy.version}</version>
            </dependency>

            <dependency>
                <groupId>commons-cli</groupId>
                <artifactId>commons-cli</artifactId>
                <version>${commons-cli.version}</version>
            </dependency>

            <dependency>
                <groupId>org.scala-lang</groupId>
                <artifactId>scala-reflect</artifactId>
                <version>${scala-reflect.version}</version>
            </dependency>

            <dependency>
                <groupId>org.scala-lang</groupId>
                <artifactId>scala-library</artifactId>
                <version>${scala-library.version}</version>
            </dependency>

            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>kafka-clients</artifactId>
                <version>${kafka.version}</version>
            </dependency>

            <dependency>
                <groupId>org.xerial.snappy</groupId>
                <artifactId>snappy-java</artifactId>
                <version>${snappy-java.version}</version>
            </dependency>

            <dependency>
                <groupId>org.javassist</groupId>
                <artifactId>javassist</artifactId>
                <version>3.27.0-GA</version>
            </dependency>

            <dependency>
                <groupId>org.apache.avro</groupId>
                <artifactId>avro</artifactId>
                <version>${avro.version}</version>
            </dependency>

            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-lang3</artifactId>
                <version>3.18.0</version>
            </dependency>

			<dependency>
				<groupId>com.google.guava</groupId>
				<artifactId>guava</artifactId>
				<version>${guava.version}</version>
			</dependency>

            <!-- Flink dependencies -->
            <dependency>
                <groupId>io.confluent.flink</groupId>
                <artifactId>flink-test-utils</artifactId>
                <version>${flink.version}</version>
                <scope>test</scope>
                <exclusions>
                    <exclusion>
                        <groupId>log4j</groupId>
                        <artifactId>log4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-log4j12</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>io.confluent.flink</groupId>
                <artifactId>flink-test-utils-junit</artifactId>
                <version>${flink.version}</version>
                <scope>test</scope>
            </dependency>

            <!-- Flink ArchUnit -->

            <dependency>
                <groupId>io.confluent.flink</groupId>
                <artifactId>flink-architecture-tests-base</artifactId>
                <version>${flink.version}</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>io.confluent.flink</groupId>
                <artifactId>flink-architecture-tests-test</artifactId>
                <version>${flink.version}</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>io.confluent.flink</groupId>
                <artifactId>flink-architecture-tests-production</artifactId>
                <version>${flink.version}</version>
                <scope>test</scope>
            </dependency>

            <!-- This manages the 'javax.annotation' annotations (JSR305) -->
            <dependency>
                <groupId>com.google.code.findbugs</groupId>
                <artifactId>jsr305</artifactId>
                <version>1.3.9</version>
            </dependency>

            <dependency>
                <groupId>commons-codec</groupId>
                <artifactId>commons-codec</artifactId>
                <version>1.15</version>
            </dependency>

            <dependency>
                <groupId>org.apache.httpcomponents</groupId>
                <artifactId>httpcore</artifactId>
                <version>4.4.14</version>
            </dependency>

            <dependency>
                <groupId>org.apache.httpcomponents</groupId>
                <artifactId>httpclient</artifactId>
                <version>4.5.13</version>
            </dependency>

            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>${slf4j.version}</version>
            </dependency>

            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-slf4j-impl</artifactId>
                <version>${log4j.version}</version>
            </dependency>

            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-api</artifactId>
                <version>${log4j.version}</version>
            </dependency>

            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-core</artifactId>
                <version>${log4j.version}</version>
            </dependency>

            <!-- For dependency convergence -->
            <dependency>
                <groupId>com.fasterxml.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <type>pom</type>
                <scope>import</scope>
                <version>${jackson-bom.version}</version>
            </dependency>

            <!-- CVE fix: CVE-2025-12183 -->
            <!-- flink-runtime still requests the archived org.lz4:lz4-java. 1.8.1 ships no jar,
                 only a relocation POM to at.yawk.lz4:lz4-java, so pinning it keeps the vulnerable
                 org.lz4 jar off the classpath and hands that path to the fork managed below. -->
            <dependency>
                <groupId>org.lz4</groupId>
                <artifactId>lz4-java</artifactId>
                <version>1.8.1</version>
            </dependency>

            <!-- CVE fix: CVE-2026-59949 -->
            <!-- Maintained fork of the archived org.lz4 project, same net.jpountz packages.
                 Governs every lz4 path: kafka-clients requests at.yawk.lz4 directly, and
                 flink-runtime's org.lz4 request is re-managed here after relocation. -->
            <dependency>
                <groupId>at.yawk.lz4</groupId>
                <artifactId>lz4-java</artifactId>
                <version>1.11.1</version>
            </dependency>

            <!-- For dependency convergence -->
            <dependency>
                <groupId>org.junit</groupId>
                <artifactId>junit-bom</artifactId>
                <version>${junit5.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <dependency>
                <groupId>junit</groupId>
                <artifactId>junit</artifactId>
                <version>${junit4.version}</version>
            </dependency>

            <dependency>
                <groupId>org.assertj</groupId>
                <artifactId>assertj-core</artifactId>
                <version>${assertj.version}</version>
                <scope>test</scope>
            </dependency>

            <!-- For dependency convergence -->
            <dependency>
                <groupId>com.esotericsoftware.kryo</groupId>
                <artifactId>kryo</artifactId>
                <version>2.24.0</version>
            </dependency>

            <!-- For dependency convergence -->
            <dependency>
                <groupId>org.objenesis</groupId>
                <artifactId>objenesis</artifactId>
                <version>2.1</version>
            </dependency>

            <!-- For dependency convergence -->
            <dependency>
                <groupId>org.yaml</groupId>
                <artifactId>snakeyaml</artifactId>
                <version>2.2</version>
            </dependency>

            <!-- For dependency convergence -->
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-compress</artifactId>
                <version>1.26.1</version>
            </dependency>

            <!-- For dependency convergence -->
            <dependency>
                <groupId>commons-io</groupId>
                <artifactId>commons-io</artifactId>
                <version>2.15.1</version>
            </dependency>

            <dependency>
                <groupId>org.testcontainers</groupId>
                <artifactId>testcontainers-bom</artifactId>
                <version>${testcontainers.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

        </dependencies>
    </dependencyManagement>

    <build>
      <extensions>
        <extension>
            <groupId>${extension.groupId}</groupId>
            <artifactId>${extension.artifactId}</artifactId>
            <version>${extension.version}</version>
        </extension>
      </extensions>

        <plugins>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>exec-maven-plugin</artifactId>
                <inherited>false</inherited>
                <dependencies>
                    <dependency>
                        <groupId>io.confluent.flink</groupId>
                        <artifactId>flink-ci-tools</artifactId>
                        <version>${flink.version}</version>
                    </dependency>
                </dependencies>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
            </plugin>

            <plugin>
                <!-- activate API compatibility checks -->
                <groupId>io.github.zentol.japicmp</groupId>
                <artifactId>japicmp-maven-plugin</artifactId>
            </plugin>

            <plugin>
                <groupId>org.apache.rat</groupId>
                <artifactId>apache-rat-plugin</artifactId>
                <inherited>false</inherited>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>com.diffplug.spotless</groupId>
                <artifactId>spotless-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-shade-plugin</artifactId>
            </plugin>

            <plugin>
                <groupId>org.commonjava.maven.plugins</groupId>
                <artifactId>directory-maven-plugin</artifactId>
        <executions>
        <execution>
        <id>directories</id>
        <goals>
        </goals>
        <phase>initialize</phase>
        <configuration>
        <property>rootDir</property>
        <phase>initialize</phase>
        <project>
        <groupId>io.confluent.flink</groupId>
        <artifactId>flink-connector-kafka</artifactId>
        </project>
        </configuration>
        </execution>
      </executions>
            </plugin>
        </plugins>
    </build>

      <profiles>
        <profile>
        <id>confluent</id>
        <properties>
            <extension.groupId>io.confluent.flink</extension.groupId>
            <extension.artifactId>aws-maven</extension.artifactId>
            <extension.version>5.0.1.INTERNAL</extension.version>
        </properties>
        <distributionManagement>
        <repository>
            <id>aws-release</id>
            <name>AWS Release Repository</name>
            <url>${confluent.release.repo}</url>
        </repository>
        <snapshotRepository>
            <id>aws-snapshot</id>
            <name>AWS Snapshot Repository</name>
            <url>${confluent.snapshot.repo}</url>
        </snapshotRepository>
        </distributionManagement>
        </profile>
      </profiles>
</project>
