pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.agentclientprotocol</groupId>
    <artifactId>acp-java-sdk</artifactId>
    <version>0.19.0-SNAPSHOT</version>
    <packaging>pom</packaging>

    <name>ACP Java SDK</name>
    <description>Java implementation of the Agent Client Protocol (ACP) specification - enables building and connecting to ACP-compliant coding agents</description>
    <url>https://github.com/agentclientprotocol/java-sdk</url>

    <modules>
        <module>acp-annotations</module>
        <module>acp-core</module>
        <module>acp-json-jackson2</module>
        <module>acp-json-jackson3</module>
        <module>acp-agent-support</module>
        <module>acp-test</module>
        <module>acp-streamable-http-jetty</module>
    </modules>

    <licenses>
        <license>
            <name>Apache License, Version 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0</url>
        </license>
    </licenses>

    <scm>
        <url>https://github.com/agentclientprotocol/java-sdk</url>
        <connection>scm:git:git://github.com/agentclientprotocol/java-sdk.git</connection>
        <developerConnection>scm:git:git@github.com:agentclientprotocol/java-sdk.git</developerConnection>
    </scm>

    <developers>
        <developer>
            <id>markpollack</id>
            <name>Mark Pollack</name>
            <email>mark@springframework.org</email>
            <roles>
                <role>lead</role>
            </roles>
        </developer>
        <developer>
            <id>tzolov</id>
            <name>Christian Tzolov</name>
            <email>christian@springframework.org</email>
            <roles>
                <role>developer</role>
            </roles>
        </developer>
    </developers>

    <properties>
        <java.version>17</java.version>
        <!-- release, not source/target: compiles against the Java 17 API even when the build
             runs on a newer JDK (the errorprone profile below runs only on JDK 21+). -->
        <maven.compiler.release>${java.version}</maven.compiler.release>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

        <!-- Dependency versions -->
        <reactor.version>2025.0.7</reactor.version>
        <jackson.version>2.22.3</jackson.version>
        <!-- Jackson 3 for acp-json-jackson3: the version Spring Boot 4.1 manages. It reads
             the jackson-annotations 2.x that jackson.version manages. -->
        <jackson3.version>3.1.7</jackson3.version>

        <slf4j.version>2.0.18</slf4j.version>
        <jspecify.version>1.0.0</jspecify.version>
        <jetty.version>12.1.12</jetty.version>

        <!-- Test dependency versions -->
        <junit.version>5.14.4</junit.version>
        <assertj.version>3.27.7</assertj.version>
        <archunit.version>1.4.1</archunit.version>
        <mockito.version>5.23.0</mockito.version>
        <logback.version>1.6.3</logback.version>
        <lincheck.version>3.7</lincheck.version>

        <!-- Plugin versions -->
        <maven-compiler-plugin.version>3.15.0</maven-compiler-plugin.version>
        <maven-surefire-plugin.version>3.5.6</maven-surefire-plugin.version>
        <maven-failsafe-plugin.version>3.5.6</maven-failsafe-plugin.version>
        <maven-source-plugin.version>3.4.0</maven-source-plugin.version>
        <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
        <maven-gpg-plugin.version>3.2.8</maven-gpg-plugin.version>
        <central-publishing-maven-plugin.version>0.11.0</central-publishing-maven-plugin.version>
        <jacoco-maven-plugin.version>0.8.15</jacoco-maven-plugin.version>
        <!-- Coverage floors; each module overrides them with its own (see the JaCoCo plugin) -->
        <jacoco.minimum.line>1.00</jacoco.minimum.line>
        <jacoco.minimum.branch>1.00</jacoco.minimum.branch>
        <owasp.version>13.0.0</owasp.version>
        <cyclonedx-maven-plugin.version>2.9.3</cyclonedx-maven-plugin.version>
        <maven-pmd-plugin.version>3.28.0</maven-pmd-plugin.version>
        <pmd.version>7.28.0</pmd.version>
        <cpd.minimumTokens>100</cpd.minimumTokens>
        <!-- spotbugs-maven-plugin 4.10.x requires Maven 3.8.9+, and the wrapper is 3.8.6; the
             4.9.8.x plugin runs the current SpotBugs engine below. -->
        <spotbugs-maven-plugin.version>4.9.8.5</spotbugs-maven-plugin.version>
        <spotbugs.version>4.10.4</spotbugs.version>

        <!-- Error Prone and NullAway (errorprone profile, JDK 21+ only) -->
        <errorprone.version>2.50.0</errorprone.version>
        <nullaway.version>0.13.8</nullaway.version>
        <!-- Surefire's own default, declared so the coverage gate can skip with the tests. -->
        <skipTests>false</skipTests>
    </properties>

    <dependencyManagement>
        <dependencies>
            <!-- Reactor BOM -->
            <dependency>
                <groupId>io.projectreactor</groupId>
                <artifactId>reactor-bom</artifactId>
                <version>${reactor.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- Jackson BOM -->
            <dependency>
                <groupId>com.fasterxml.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${jackson.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- Jackson 3 BOM. Imported after the Jackson 2 BOM, so jackson-annotations
                 (managed by both) comes from jackson.version. -->
            <dependency>
                <groupId>tools.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${jackson3.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- ACP modules -->
            <dependency>
                <groupId>com.agentclientprotocol</groupId>
                <artifactId>acp-core</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>com.agentclientprotocol</groupId>
                <artifactId>acp-json-jackson2</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>com.agentclientprotocol</groupId>
                <artifactId>acp-json-jackson3</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>com.agentclientprotocol</groupId>
                <artifactId>acp-test</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>com.agentclientprotocol</groupId>
                <artifactId>acp-streamable-http-jetty</artifactId>
                <version>${project.version}</version>
            </dependency>

            <!-- Null-marking annotations (@NullMarked, @Nullable). Annotations only; NullAway
                 enforces them in the errorprone profile. -->
            <dependency>
                <groupId>org.jspecify</groupId>
                <artifactId>jspecify</artifactId>
                <version>${jspecify.version}</version>
            </dependency>

            <!-- Logging -->
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>${slf4j.version}</version>
            </dependency>

            <!-- Jetty WebSocket -->
            <dependency>
                <groupId>org.eclipse.jetty.websocket</groupId>
                <artifactId>jetty-websocket-jetty-server</artifactId>
                <version>${jetty.version}</version>
            </dependency>
            <dependency>
                <groupId>org.eclipse.jetty.websocket</groupId>
                <artifactId>jetty-websocket-jetty-api</artifactId>
                <version>${jetty.version}</version>
            </dependency>
            <dependency>
                <groupId>org.eclipse.jetty</groupId>
                <artifactId>jetty-server</artifactId>
                <version>${jetty.version}</version>
            </dependency>
            <dependency>
                <groupId>org.eclipse.jetty.ee10</groupId>
                <artifactId>jetty-ee10-servlet</artifactId>
                <version>${jetty.version}</version>
            </dependency>
            <dependency>
                <groupId>org.eclipse.jetty.http2</groupId>
                <artifactId>jetty-http2-server</artifactId>
                <version>${jetty.version}</version>
            </dependency>

            <!-- Test dependencies -->
            <dependency>
                <groupId>org.junit.jupiter</groupId>
                <artifactId>junit-jupiter</artifactId>
                <version>${junit.version}</version>
            </dependency>
            <dependency>
                <groupId>org.assertj</groupId>
                <artifactId>assertj-core</artifactId>
                <version>${assertj.version}</version>
            </dependency>
            <dependency>
                <groupId>com.tngtech.archunit</groupId>
                <artifactId>archunit-junit5</artifactId>
                <version>${archunit.version}</version>
            </dependency>
            <dependency>
                <groupId>org.mockito</groupId>
                <artifactId>mockito-core</artifactId>
                <version>${mockito.version}</version>
            </dependency>
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-classic</artifactId>
                <version>${logback.version}</version>
            </dependency>
            <!-- Model checker for the concurrent state machines (test scope, acp-core and
                 acp-streamable-http-jetty) -->
            <dependency>
                <groupId>org.jetbrains.lincheck</groupId>
                <artifactId>lincheck</artifactId>
                <version>${lincheck.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <resources>
            <!-- Module's own resources -->
            <resource>
                <directory>src/main/resources</directory>
            </resource>
            <!-- Ship LICENSE and NOTICE inside every artifact (Apache-2.0 section 4) -->
            <resource>
                <directory>${maven.multiModuleProjectDirectory}</directory>
                <targetPath>META-INF</targetPath>
                <includes>
                    <include>LICENSE</include>
                    <include>NOTICE</include>
                </includes>
            </resource>
        </resources>

        <plugins>
            <!-- Attach one module-rooted SBOM to every artifact. The release-manager
                 independently checks it against a clean external consumer. -->
            <plugin>
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
                <version>${cyclonedx-maven-plugin.version}</version>
                <executions>
                    <execution>
                        <id>consumer-cyclonedx-sbom</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>makeBom</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <skipNotDeployed>false</skipNotDeployed>
                    <projectType>library</projectType>
                    <schemaVersion>1.6</schemaVersion>
                    <includeBomSerialNumber>true</includeBomSerialNumber>
                    <includeCompileScope>true</includeCompileScope>
                    <includeRuntimeScope>true</includeRuntimeScope>
                    <includeProvidedScope>false</includeProvidedScope>
                    <includeSystemScope>false</includeSystemScope>
                    <includeTestScope>false</includeTestScope>
                    <includeLicenseText>false</includeLicenseText>
                    <outputFormat>json</outputFormat>
                    <outputName>${project.artifactId}-${project.version}-cyclonedx</outputName>
                    <classifier>cyclonedx</classifier>
                </configuration>
            </plugin>

            <!-- Java compiler -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>${maven-compiler-plugin.version}</version>
                <configuration>
                    <release>${java.version}</release>
                </configuration>
            </plugin>

            <!-- Surefire for tests -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>${maven-surefire-plugin.version}</version>
            </plugin>

            <!-- Integration tests (*IT). Surefire's defaults do not match *IT, so
                 without this plugin those classes are silently never executed. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
                <version>${maven-failsafe-plugin.version}</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>integration-test</goal>
                            <goal>verify</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- Attach sources -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <version>${maven-source-plugin.version}</version>
                <executions>
                    <execution>
                        <id>attach-sources</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- Attach javadocs -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>${maven-javadoc-plugin.version}</version>
                <configuration>
                    <doclint>none</doclint>
                    <quiet>true</quiet>
                </configuration>
                <executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- PMD size, complexity and duplication gate: pmd:check and pmd:cpd-check fail
                 verify on any violation. Rules and thresholds, each with its reason, are in
                 config/pmd/ruleset.xml; CPD's token threshold is cpd.minimumTokens above. Main
                 sources only. Fix a violation in the code: there is no baseline. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <version>${maven-pmd-plugin.version}</version>
                <dependencies>
                    <dependency>
                        <groupId>net.sourceforge.pmd</groupId>
                        <artifactId>pmd-core</artifactId>
                        <version>${pmd.version}</version>
                    </dependency>
                    <dependency>
                        <groupId>net.sourceforge.pmd</groupId>
                        <artifactId>pmd-java</artifactId>
                        <version>${pmd.version}</version>
                    </dependency>
                </dependencies>
                <configuration>
                    <rulesets>
                        <ruleset>${maven.multiModuleProjectDirectory}/config/pmd/ruleset.xml</ruleset>
                    </rulesets>
                    <targetJdk>${java.version}</targetJdk>
                    <includeTests>false</includeTests>
                    <minimumTokens>${cpd.minimumTokens}</minimumTokens>
                    <printFailingErrors>true</printFailingErrors>
                    <failOnViolation>true</failOnViolation>
                    <linkXRef>false</linkXRef>
                </configuration>
                <executions>
                    <execution>
                        <id>pmd-gate</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                            <goal>cpd-check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- SpotBugs gate: spotbugs:check fails verify on main sources, in every module and
                 on every JDK the build runs on (17 and 21; unlike the errorprone profile it does
                 not need JDK 21). The analysis reports findings up to rank 20; the include filter
                 config/spotbugs/spotbugs-include.xml keeps the ones that fail the build:
                 - every pattern of rank 9 or less (SpotBugs' "scariest" 1-4 and "scary" 5-9
                   bands). Rank, not confidence, is the gate: rank combines the pattern's severity
                   with its confidence, so it keeps the bugs and drops the long tail (exposed
                   arrays, missing static on inner classes, serialization advice) that a
                   confidence threshold alone would keep;
                 - a listed set of multithreaded-correctness patterns at any rank (inconsistent
                   synchronization, wait/notify and lock misuse, wrong lock objects), which
                   SpotBugs ranks 14 to 17 and the rank gate alone would miss.
                 One analysis and one filter, not two check executions: check forks the
                 spotbugs goal with the plugin-level configuration only, so a second check
                 execution with its own filter would analyse with the first one's settings and
                 then pass silently on a report that was never written.
                 threshold Medium (the default) also drops low-confidence findings; effort Max
                 runs the interprocedural detectors. find-sec-bugs is not used: on this code base
                 it adds no finding at rank 9 or less, and its findings below that are the
                 library's purpose (spawning the configured agent process, writing JSON-RPC
                 responses). A false positive is excluded narrowly (class, method, pattern), with
                 its reason, in config/spotbugs/spotbugs-exclude.xml. -->
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>${spotbugs-maven-plugin.version}</version>
                <dependencies>
                    <dependency>
                        <groupId>com.github.spotbugs</groupId>
                        <artifactId>spotbugs</artifactId>
                        <version>${spotbugs.version}</version>
                    </dependency>
                </dependencies>
                <configuration>
                    <effort>Max</effort>
                    <threshold>Medium</threshold>
                    <maxRank>20</maxRank>
                    <includeFilterFile>${maven.multiModuleProjectDirectory}/config/spotbugs/spotbugs-include.xml</includeFilterFile>
                    <includeTests>false</includeTests>
                    <excludeFilterFile>${maven.multiModuleProjectDirectory}/config/spotbugs/spotbugs-exclude.xml</excludeFilterFile>
                    <failOnError>true</failOnError>
                </configuration>
                <executions>
                    <execution>
                        <id>spotbugs-gate</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- JaCoCo code coverage. Each module's report (target/site/jacoco/index.html) and
                 gate count that module's own classes, exercised by that module's own tests:
                 acp-core code reached only from another module's tests is not counted, and the
                 JSON modules, which run acp-core's contract suite against their mapper, count
                 only their mapper classes. Nothing is excluded. The integration harness
                 (integration-testing/) is outside the Maven build and is not counted.

                 The gate (check, in verify) fails when a module's LINE or BRANCH covered ratio
                 falls below its floor. Every module declares jacoco.minimum.line and
                 jacoco.minimum.branch; the default below is full coverage, so a new module
                 fails until it declares measured floors. A floor is the coverage measured from a clean verify less a margin of
                 2 points, rounded down to a whole percent: enough for the run-to-run variation
                 of the concurrent tests (a branch or two), too little to lose a test class
                 unnoticed. Raise a floor when coverage rises; lower one only with a reason in
                 the commit. -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>${jacoco-maven-plugin.version}</version>
                <executions>
                    <execution>
                        <id>prepare-agent</id>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                    </execution>
                    <!-- In verify, after the integration tests (failsafe appends to the same
                         execution data) and before the gate, so the report shows what the
                         gate checks. -->
                    <execution>
                        <id>report</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>coverage-gate</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                        <configuration>
                            <!-- No gate without tests: with -DskipTests the check would read
                                 whatever execution data an earlier run left in target (a
                                 -Dtest run's partial coverage, for one) and fail the build. -->
                            <skip>${skipTests}</skip>
                            <rules>
                                <rule>
                                    <element>BUNDLE</element>
                                    <limits>
                                        <limit>
                                            <counter>LINE</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>${jacoco.minimum.line}</minimum>
                                        </limit>
                                        <limit>
                                            <counter>BRANCH</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>${jacoco.minimum.branch}</minimum>
                                        </limit>
                                    </limits>
                                </rule>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <!-- Error Prone: Error Prone's own bug checks and NullAway, at ERROR, on main sources.
             Error Prone 2.50 runs only on JDK 21+, while the SDK targets Java 17 and its
             release build runs on JDK 17, so the profile activates by JDK: every build on
             JDK 21+ (including the CI job that exists for it) is checked, and a JDK 17
             build compiles exactly as before. The javac internals Error Prone needs are
             opened in .mvn/jvm.config. Scope:
             - Error Prone's default-enabled checks, and failOnWarning (javac -Werror), so a
               check whose default severity is WARNING fails the build like an ERROR one.
               -Werror also fails on javac's own default warnings (removal, for one), which
               are worth failing on too; suggestions stay notes. A new Error Prone version
               brings its new checks in at ERROR: triage them on upgrade.
             - Checks that are pure style for this code base are disabled by name below,
               each with its reason. A real exception is a @SuppressWarnings with a reason.
             - Beyond the defaults, two bug finders that fit this code base:
               CheckReturnValue over reactor.core.publisher: a Mono or Flux operator whose
               result is dropped never runs. Results that are fine to drop (subscribe's
               Disposable, a terminal tryEmit*, fluent sink callbacks) are listed with
               reasons in config/errorprone/reactor-ignorable-results.txt.
               SystemOut: the stdio transport owns System.out, and anything else printed
               there corrupts the JSON-RPC stream.
             - NullAway: only @NullMarked packages (OnlyNullMarked), in JSpecify mode.
             - only default-compile: test sources are deliberately unchecked;
             - never fork the compiler (compiler-plugin then hides every diagnostic). -->
        <profile>
            <id>errorprone</id>
            <activation>
                <jdk>[21,)</jdk>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-compiler-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>default-compile</id>
                                <configuration>
                                    <failOnWarning>true</failOnWarning>
                                    <compilerArgs>
                                        <arg>-XDcompilePolicy=simple</arg>
                                        <arg>--should-stop=ifError=FLOW</arg>
                                        <arg>-XDaddTypeAnnotationsToSymbol=true</arg>
                                        <!-- Disabled, as style for this code base:
                                             StatementSwitchToExpressionSwitch: arrow or colon switch is a style choice. -->
                                        <arg>-Xplugin:ErrorProne -Xep:StatementSwitchToExpressionSwitch:OFF -Xep:SystemOut:ERROR -XepOpt:CheckReturnValue:Packages=reactor.core.publisher -XepOpt:CheckReturnValue:ApiExclusionList=${maven.multiModuleProjectDirectory}/config/errorprone/reactor-ignorable-results.txt -Xep:NullAway:ERROR -XepOpt:NullAway:JSpecifyMode=true -XepOpt:NullAway:OnlyNullMarked=true</arg>
                                    </compilerArgs>
                                    <annotationProcessorPaths>
                                        <path>
                                            <groupId>com.google.errorprone</groupId>
                                            <artifactId>error_prone_core</artifactId>
                                            <version>${errorprone.version}</version>
                                        </path>
                                        <path>
                                            <groupId>com.uber.nullaway</groupId>
                                            <artifactId>nullaway</artifactId>
                                            <version>${nullaway.version}</version>
                                        </path>
                                    </annotationProcessorPaths>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <!-- Release profile for Maven Central Portal publishing -->
        <profile>
            <id>release</id>
            <build>
                <plugins>
                    <!-- Maven Central Portal publishing plugin -->
                    <plugin>
                        <groupId>org.sonatype.central</groupId>
                        <artifactId>central-publishing-maven-plugin</artifactId>
                        <version>${central-publishing-maven-plugin.version}</version>
                        <extensions>true</extensions>
                        <configuration>
                            <publishingServerId>central</publishingServerId>
                            <autoPublish>true</autoPublish>
                        </configuration>
                    </plugin>

                    <!-- GPG signing -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>${maven-gpg-plugin.version}</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                                <configuration>
                                    <gpgArguments>
                                        <arg>--pinentry-mode</arg>
                                        <arg>loopback</arg>
                                    </gpgArguments>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>owasp</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <version>${owasp.version}</version>
                        <configuration>
                            <failBuildOnCVSS>7.0</failBuildOnCVSS>
                            <ossindexAnalyzerEnabled>false</ossindexAnalyzerEnabled>
                        </configuration>
                        <executions>
                            <execution>
                                <goals>
                                    <goal>check</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>

    <distributionManagement>
        <snapshotRepository>
            <id>central</id>
            <url>https://central.sonatype.com/repository/maven-snapshots/</url>
        </snapshotRepository>
    </distributionManagement>

</project>