build.gradle

plugins {
    id 'io.spring.dependency-management' version '1.0.9.RELEASE'
    id 'org.springframework.boot' version '2.5.15'
    id 'java'
    id "org.owasp.dependencycheck" version "5.3.1"
}

apply from: 'project-properties.gradle'
apply from: "$scriptsUrl/build-docker.gradle"
apply from: "$scriptsUrl/build-info.gradle"
apply from: "$scriptsUrl/build-commons.gradle"
//apply from: "$scriptsUrl/build-quality.gradle"
apply from: "$scriptsUrl/release-service.gradle"
apply from: "$scriptsUrl/signing.gradle"

repositories {
    mavenCentral { url "https://repo1.maven.org/maven2" }

    if (!releaseMode) {
        maven { url 'https://jitpack.io' }
    }
}

//https://nvd.nist.gov/vuln/detail/CVE-2020-10683 (dom4j 2.1.3 version dependency) AND https://nvd.nist.gov/vuln/detail/CVE-2019-14900
ext['hibernate.version'] = '5.4.18.Final'
//https://nvd.nist.gov/vuln/detail/CVE-2020-10693
ext['hibernate-validator.version'] = '6.1.5.Final'
//https://nvd.nist.gov/vuln/detail/CVE-2020-13692
//ext['postgresql.version'] = '42.2.13'
//https://nvd.nist.gov/vuln/detail/CVE-2020-9488
ext['log4j2.version'] = '2.21.1'


dependencyManagement {
    imports {
        mavenBom(releaseMode ? 'com.epam.reportportal:commons-bom:' + '5.11.7' : 'com.epam.reportportal:commons-bom:5.11.7')
    }
}

dependencies {
    if (releaseMode) {
        implementation 'com.epam.reportportal:commons-dao'
        implementation 'com.epam.reportportal:commons-rules'
        implementation 'com.epam.reportportal:commons-model'
    } else {
        implementation 'com.epam.reportportal:commons-dao'
        implementation 'com.epam.reportportal:commons-rules'
        implementation 'com.epam.reportportal:commons-model'
    }

    //Fix CVE-2021-41079, CVE-2022-23181, CVE-2021-33037, CVE-2021-30640, CVE-2022-42252, CVE-2023-46589, CVE-2024-24549
    implementation 'org.apache.tomcat.embed:tomcat-embed-core:9.0.86'
    implementation 'org.apache.tomcat.embed:tomcat-embed-el:9.0.86'
    implementation 'org.apache.tomcat.embed:tomcat-embed-websocket:9.0.86'
    //Fix CVE-2020-15522
    implementation 'org.bouncycastle:bcprov-jdk15on:1.69'
    //Fix CVE-2015-7501, CVE-2015-4852
    implementation 'org.apache.commons:commons-collections4:4.4'
    //Fix CVE-2018-10237
    implementation 'com.google.guava:guava:31.1-jre'
    //Fix CVE-2020-13956
    implementation 'org.apache.httpcomponents:httpclient:4.5.14'
    //Fix CVE-2022-40152
    implementation 'com.fasterxml.woodstox:woodstox-core:6.5.1'

    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'org.springframework.boot:spring-boot-starter-actuator'
    implementation 'org.springframework.boot:spring-boot-starter-security'
    implementation 'org.springframework.boot:spring-boot-starter-amqp'
    //Fix CVE-2023-34050
    implementation 'org.springframework.amqp:spring-amqp:2.4.17'
    //Fix CVE-2023-40827, CVE-2023-40828, CVE-2023-40826
    implementation 'org.springframework:spring-webmvc:5.3.33'
    implementation 'org.springframework:spring-web:5.3.33'

    ///// Security
    //https://nvd.nist.gov/vuln/detail/CVE-2020-5407 AND https://nvd.nist.gov/vuln/detail/CVE-2020-5408
    implementation 'org.springframework.security:spring-security-core:5.8.5'
    implementation 'org.springframework.security:spring-security-config:5.8.5'
    implementation 'org.springframework.security:spring-security-web:5.8.5'
    //

    implementation 'org.springframework.security:spring-security-oauth2-client'
    //Fix CVE-2023-1370
    implementation 'net.minidev:json-smart:2.4.10'
    //Fix CVE-2022-22969
    implementation 'org.springframework.security.oauth:spring-security-oauth2:2.5.2.RELEASE'
    implementation 'org.springframework.security:spring-security-jwt:1.0.11.RELEASE'
    implementation 'org.springframework.security:spring-security-ldap'
    // TODO: consider migration to spring-security-saml2-service-provider
    implementation 'org.springframework.security.extensions:spring-security-saml2-core:2.0.0.M31'
//  Temporary fix of https://nvd.nist.gov/vuln/detail/CVE-2019-12400
    implementation 'org.apache.santuario:xmlsec:3.0.3'
    //Fix CVE-2015-7501, CVE-2015-4852
    implementation 'org.apache.commons:commons-collections4:4.4'

    //Fix CVE-2023-6378, CVE-2023-6481, CVE-2023-6378, CVE-2023-6481
    implementation 'ch.qos.logback:logback-classic:1.2.13'
    implementation 'ch.qos.logback:logback-core:1.2.13'

    implementation 'org.apache.tika:tika-core'

    implementation 'javax.inject:javax.inject:1'
    implementation 'io.springfox:springfox-swagger2'
    implementation 'org.apache.commons:commons-compress:1.26.0'
    implementation 'org.cryptacular:cryptacular:1.1.4'
    // TODO: snakeyaml 2.0 supported by Spring Boot 3 only
    implementation 'org.yaml:snakeyaml:1.33'
    implementation 'org.hibernate:hibernate-core:5.4.24.Final'
    implementation 'org.springframework:spring-core:5.3.30'
    implementation "com.rabbitmq:http-client:5.2.0"

    // Lombok
    compileOnly 'org.projectlombok:lombok:1.18.32'
    annotationProcessor 'org.projectlombok:lombok:1.18.32'
}

processResources {
    dependsOn(gitInfo)
    filesMatching('application.properties') {
        expand(project.properties)
    }
}

bootJar {
    System.getenv().containsKey("K8S") ? getArchiveFileName().set('app.jar') : archiveClassifier.set('exec')
}
jar.enabled(true)
jar.archiveClassifier.set('')


publish.dependsOn build
publish.mustRunAfter build