pom.xml - commons-xml - Git at Google

 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
 this work for additional information regarding copyright ownership.
 The ASF licenses this file to You under the Apache License, Version 2.0
 (the "License"); you may not use this file except in compliance with
 the License.  You may obtain a copy of the License at

      https://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">
   <modelVersion>4.0.0</modelVersion>
   <parent>
     <groupId>org.apache.commons</groupId>
     <artifactId>commons-parent</artifactId>
     <version>102</version>
   </parent>
   <artifactId>commons-xml</artifactId>
   <version>0.1.0-SNAPSHOT</version>
   <name>Apache Commons XML</name>
   <url>https://commons.apache.org/sandbox/commons-xml/</url>
   <inceptionYear>2026</inceptionYear>
   <description>Apache Commons XML provides secure-by-default JAXP factory creation, abstracting over
     implementation-specific XXE hardening differences between the stock JDK and external JAXP implementations
     (Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).</description>
   <scm>
     <connection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</developerConnection>
     <url>https://gitbox.apache.org/repos/asf?p=commons-xml.git</url>
     <tag>rel/commons-xml-${project.version}</tag>
   </scm>
   <properties>
     <!-- Release-related properties -->
     <commons.release.version>0.1.0</commons.release.version>
     <commons.release.desc>(Java 8+)</commons.release.desc>
     <commons.rc.version>RC1</commons.rc.version>
     <!-- japicmp baseline: disable for first release
     <commons.bc.version>0.1.1</commons.bc.version> -->
     <japicmp.skip>true</japicmp.skip>
     <commons.release.next>0.1.2</commons.release.next>
     <commons.componentid>xml</commons.componentid>
     <commons.packageId>xml</commons.packageId>
     <commons.module.name>org.apache.commons.xml</commons.module.name>
     <commons.jira.id>COMMONSXML</commons.jira.id>
     <!-- Sandbox component: publish the site under the sandbox tree (the parent defaults to proper/). -->
     <commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/sandbox/commons-xml</commons.scmPubUrl>
     <!-- OSGi bundle metadata: override commons-parent's org.apache.commons.* defaults. -->
     <commons.osgi.symbolicName>org.apache.commons.xml</commons.osgi.symbolicName>
     <commons.osgi.export>org.apache.commons.xml.*;version=${project.version};-noimport:=true</commons.osgi.export>
     <commons.osgi.import>
       net.sf.saxon.*;resolution:=optional,
       org.apache.xerces.*;resolution:=optional,
       *
     </commons.osgi.import>
     <project.build.outputTimestamp>2026-04-22T00:00:00Z</project.build.outputTimestamp>
     <!-- Java baseline -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
     <!-- GraalVM native-image tooling; used by the `native-xalan` profile only. -->
     <commons.graalvm.buildtools.version>1.1.3</commons.graalvm.buildtools.version>
     <!-- Optional JAXP implementations used by bundled providers. -->
     <commons.saxon.version>12.9</commons.saxon.version>
     <commons.woodstox.version>7.1.1</commons.woodstox.version>
     <commons.xalan.version>2.7.3</commons.xalan.version>
     <commons.xerces.version>2.12.2</commons.xerces.version>
   </properties>
   <dependencies>
     <!--
       Saxon-HE supplies types we reference at compile time (the Saxon provider). It is not part of the consumer
       contract: it is declared in provided scope, so callers who want Saxon-HE for XSLT/XPath bring it themselves
       and it is never pulled in transitively.
     -->
     <dependency>
       <groupId>net.sf.saxon</groupId>
       <artifactId>Saxon-HE</artifactId>
       <version>${commons.saxon.version}</version>
       <scope>provided</scope>
     </dependency>
     <dependency>
       <groupId>org.junit.jupiter</groupId>
       <artifactId>junit-jupiter</artifactId>
       <scope>test</scope>
     </dependency>
   </dependencies>
   <build>
     <defaultGoal>clean checkstyle:check spotbugs:check pmd:check javadoc:javadoc verify</defaultGoal>
     <pluginManagement>
       <plugins>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-checkstyle-plugin</artifactId>
           <configuration>
             <configLocation>${basedir}/src/conf/checkstyle.xml</configLocation>
             <enableRulesSummary>false</enableRulesSummary>
             <!-- Later:
             <includeTestSourceDirectory>true</includeTestSourceDirectory> -->
           </configuration>
         </plugin>
         <plugin>
           <groupId>com.github.spotbugs</groupId>
           <artifactId>spotbugs-maven-plugin</artifactId>
           <configuration>
             <excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
           </configuration>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-pmd-plugin</artifactId>
           <configuration>
             <rulesets>
               <ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
             </rulesets>
           </configuration>
         </plugin>
       </plugins>
     </pluginManagement>
     <plugins>
       <!--
         Run the test suite seven times, each with a distinct JAXP combination:

           - test-saxon:         Saxon-HE (TrAX, XPath) over stock JDK SAX
           - test-saxon-xerces:  Saxon-HE (TrAX, XPath) over stock JDK SAX or Apache Xerces SAX
                                 (Saxon prefers the JDK SAX provider but may resolve to Xerces)
           - test-stockjdk:      stock JDK factories only (every group except xpath3)
           - test-woodstox:      Woodstox (StAX)
           - test-xalan:         Apache Xalan (TrAX, XPath) over stock JDK SAX
           - test-xalan-xerces:  Apache Xalan (TrAX, XPath) over Apache Xerces SAX
           - test-xerces:        Apache Xerces (DOM, SAX, Schema)
       -->
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
         <!--
           Make the underlying JAXP factories as permissive as the JDK allows. Hardened factories produced by
           XmlFactories should still block every attack the test suite throws at them; if a test passes only
           because the JDK's defaults intervened, we want it to fail here so the gap shows up.

           Inherited by every execution defined below.
         -->
         <configuration>
           <systemPropertyVariables>
             <!-- Allow all protocols for external DTDs, schemas, and stylesheets. -->
             <javax.xml.accessExternalDTD>all</javax.xml.accessExternalDTD>
             <javax.xml.accessExternalSchema>all</javax.xml.accessExternalSchema>
             <javax.xml.accessExternalStylesheet>all</javax.xml.accessExternalStylesheet>
           </systemPropertyVariables>
         </configuration>
         <executions>
           <execution>
             <id>default-test</id>
             <phase>none</phase>
           </execution>
           <execution>
             <id>test-saxon</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/saxon</reportsDirectory>
               <!-- Saxon contributes TrAX (transformer + stylesheet) and XPath; xpath3 covers Saxon-only XPath 3.1 functions. -->
               <groups>trax,xpath3</groups>
             </configuration>
           </execution>
           <execution>
             <id>test-saxon-xerces</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/saxon-xerces</reportsDirectory>
               <!-- Same groups as test-saxon, but with Apache Xerces also visible to Saxon's SAX-provider lookup. -->
               <groups>trax,xpath3</groups>
               <additionalClasspathDependencies>
                 <dependency>
                   <groupId>xerces</groupId>
                   <artifactId>xercesImpl</artifactId>
                   <version>${commons.xerces.version}</version>
                 </dependency>
               </additionalClasspathDependencies>
             </configuration>
           </execution>
           <execution>
             <id>test-stockjdk</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/stockjdk</reportsDirectory>
               <!-- Run every tagged and untagged test except xpath3, which needs Saxon on the classpath. -->
               <excludedGroups>xpath3</excludedGroups>
               <classpathDependencyExcludes>
                 <exclude>net.sf.saxon:Saxon-HE</exclude>
               </classpathDependencyExcludes>
             </configuration>
           </execution>
           <execution>
             <id>test-woodstox</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/woodstox</reportsDirectory>
               <!-- Woodstox only contributes StAX. -->
               <groups>stax</groups>
               <additionalClasspathDependencies>
                 <dependency>
                   <groupId>com.fasterxml.woodstox</groupId>
                   <artifactId>woodstox-core</artifactId>
                   <version>${commons.woodstox.version}</version>
                 </dependency>
               </additionalClasspathDependencies>
               <classpathDependencyExcludes>
                 <exclude>net.sf.saxon:Saxon-HE</exclude>
               </classpathDependencyExcludes>
             </configuration>
           </execution>
           <execution>
             <id>test-xalan</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/xalan</reportsDirectory>
               <!-- Xalan contributes TrAX and XPath. -->
               <groups>xpath,trax</groups>
               <additionalClasspathDependencies>
                 <dependency>
                   <groupId>xalan</groupId>
                   <artifactId>serializer</artifactId>
                   <version>${commons.xalan.version}</version>
                 </dependency>
                 <dependency>
                   <groupId>xalan</groupId>
                   <artifactId>xalan</artifactId>
                   <version>${commons.xalan.version}</version>
                 </dependency>
               </additionalClasspathDependencies>
               <classpathDependencyExcludes>
                 <exclude>net.sf.saxon:Saxon-HE</exclude>
               </classpathDependencyExcludes>
             </configuration>
           </execution>
           <execution>
             <id>test-xalan-xerces</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/xalan-xerces</reportsDirectory>
               <!-- Same groups as test-xalan, but with Apache Xerces winning Xalan's internal SAX-provider lookup. -->
               <groups>xpath,trax</groups>
               <additionalClasspathDependencies>
                 <dependency>
                   <groupId>xalan</groupId>
                   <artifactId>serializer</artifactId>
                   <version>${commons.xalan.version}</version>
                 </dependency>
                 <dependency>
                   <groupId>xalan</groupId>
                   <artifactId>xalan</artifactId>
                   <version>${commons.xalan.version}</version>
                 </dependency>
                 <dependency>
                   <groupId>xerces</groupId>
                   <artifactId>xercesImpl</artifactId>
                   <version>${commons.xerces.version}</version>
                 </dependency>
               </additionalClasspathDependencies>
               <classpathDependencyExcludes>
                 <exclude>net.sf.saxon:Saxon-HE</exclude>
               </classpathDependencyExcludes>
             </configuration>
           </execution>
           <execution>
             <id>test-xerces</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/xerces</reportsDirectory>
               <!-- Xerces only contributes DOM/SAX/Schema; the rest is JDK-bundled and already covered by test-stockjdk. -->
               <groups>dom,sax,schema</groups>
               <additionalClasspathDependencies>
                 <dependency>
                   <groupId>xerces</groupId>
                   <artifactId>xercesImpl</artifactId>
                   <version>${commons.xerces.version}</version>
                 </dependency>
               </additionalClasspathDependencies>
               <classpathDependencyExcludes>
                 <exclude>net.sf.saxon:Saxon-HE</exclude>
               </classpathDependencyExcludes>
             </configuration>
           </execution>
         </executions>
       </plugin>
       <!-- Do not publish a test-jar: the test classes are not part of the consumer contract. -->
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-jar-plugin</artifactId>
         <executions>
           <execution>
             <id>default</id>
             <phase>none</phase>
           </execution>
         </executions>
       </plugin>
       <!--
         commons-parent's create-source-jar execution attaches both the main sources (jar-no-fork) and the test
         sources (test-jar-no-fork) in one execution. Disable it and re-bind a main-sources-only execution, so the
         published artifact keeps the required sources jar but drops the test-sources jar.
       -->
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-source-plugin</artifactId>
         <executions>
           <execution>
             <id>create-source-jar</id>
             <phase>none</phase>
           </execution>
           <execution>
             <id>create-main-source-jar</id>
             <phase>package</phase>
             <goals>
               <goal>jar-no-fork</goal>
             </goals>
           </execution>
         </executions>
       </plugin>
       <!-- jdeps makes Saxon.HE a hard requires; flip it to static (optional). The trailing * keeps the rest. -->
       <plugin>
         <groupId>org.moditect</groupId>
         <artifactId>moditect-maven-plugin</artifactId>
         <executions>
           <execution>
             <id>add-module-infos</id>
             <configuration>
               <module>
                 <moduleInfo>
                   <requires>
                     static Saxon.HE;
                     *;
                   </requires>
                 </moduleInfo>
               </module>
             </configuration>
           </execution>
         </executions>
       </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-checkstyle-plugin</artifactId>
       </plugin>
     </plugins>
   </build>
   <reporting>
     <plugins>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-checkstyle-plugin</artifactId>
       </plugin>
       <plugin>
         <groupId>com.github.spotbugs</groupId>
         <artifactId>spotbugs-maven-plugin</artifactId>
         <configuration>
           <excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
         </configuration>
       </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-pmd-plugin</artifactId>
         <configuration>
           <rulesets>
             <ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
           </rulesets>
         </configuration>
       </plugin>
     </plugins>
   </reporting>
   <profiles>
     <!--
       Regression guard for the generated OSGi and JPMS descriptors.
       The JPMS test requires JDK 9+
     -->
     <profile>
       <id>java11-tests</id>
       <activation>
         <jdk>[11,)</jdk>
       </activation>
       <build>
         <plugins>
           <!-- Compile the src/test/java11 source root at release 11; the default test sources stay at release 8. -->
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-compiler-plugin</artifactId>
             <executions>
               <execution>
                 <id>testCompile-java11</id>
                 <phase>test-compile</phase>
                 <goals>
                   <goal>testCompile</goal>
                 </goals>
                 <configuration>
                   <release>11</release>
                   <compileSourceRoots>
                     <compileSourceRoot>${project.basedir}/src/test/java11</compileSourceRoot>
                   </compileSourceRoots>
                 </configuration>
               </execution>
             </executions>
           </plugin>
           <!-- Run DescriptorIT against the packaged jar; no OSGi framework or separate JPMS module needed. -->
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-failsafe-plugin</artifactId>
             <executions>
               <execution>
                 <id>verify-descriptors</id>
                 <goals>
                   <goal>integration-test</goal>
                   <goal>verify</goal>
                 </goals>
                 <configuration>
                   <systemPropertyVariables>
                     <buildJar>${project.build.directory}/${project.build.finalName}.jar</buildJar>
                   </systemPropertyVariables>
                 </configuration>
               </execution>
             </executions>
           </plugin>
         </plugins>
       </build>
     </profile>

     <!--
       Dependency versions only compatible with JDK 17+.
       -->
     <profile>
       <id>java17-dependencies</id>
       <activation>
         <jdk>[17,)</jdk>
       </activation>

       <properties>
         <commons.saxon.version>13.0</commons.saxon.version>
       </properties>
     </profile>
     <!--
       Runs the test suite as a GraalVM native image; activate with -Pnative-xalan on a GraalVM JDK.

       Worth a job because native-image resolves JAXP providers under the closed-world assumption: the lookup a JVM
       performs at run time through ServiceLoader is decided at build time instead.

       A native binary carries one classpath, so only `test-stockjdk` runs; the other JAXP combinations stay on the
       JVM matrix. Its `xpath3` group is excluded there already, and that group needs Saxon, which is dropped here.
     -->
     <profile>
       <id>native-xalan</id>
       <dependencies>
         <dependency>
           <groupId>org.graalvm.buildtools</groupId>
           <artifactId>junit-platform-native</artifactId>
           <version>${commons.graalvm.buildtools.version}</version>
           <scope>test</scope>
         </dependency>
         <!--
           Apache Xalan supplies TrAX. The stock JDK's XSLTC compiles each stylesheet into translet bytecode and
           defines the class at run time, which a closed-world image cannot do; Xalan interprets instead. Declared as
           project dependencies, not surefire's additionalClasspathDependencies, which native-image never sees.
         -->
         <dependency>
           <groupId>xalan</groupId>
           <artifactId>xalan</artifactId>
           <version>${commons.xalan.version}</version>
           <scope>test</scope>
         </dependency>
         <dependency>
           <groupId>xalan</groupId>
           <artifactId>serializer</artifactId>
           <version>${commons.xalan.version}</version>
           <scope>test</scope>
         </dependency>
       </dependencies>
       <build>
         <plugins>
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-surefire-plugin</artifactId>
             <executions>
               <!--
                 Only `test-stockjdk` is left running, unconfigured: it registers the tests the native binary replays.
                 The profile's Xalan dependencies are on its classpath, so it is Xalan, not XSLTC, that supplies TrAX
                 in both the JVM and the native run.

                 Every other execution is silenced; their classpath swaps have no native equivalent.
               -->
               <execution>
                 <id>test-xalan</id>
                 <phase>none</phase>
               </execution>
               <execution>
                 <id>test-saxon</id>
                 <phase>none</phase>
               </execution>
               <execution>
                 <id>test-saxon-xerces</id>
                 <phase>none</phase>
               </execution>
               <execution>
                 <id>test-woodstox</id>
                 <phase>none</phase>
               </execution>
               <execution>
                 <id>test-xalan-xerces</id>
                 <phase>none</phase>
               </execution>
               <execution>
                 <id>test-xerces</id>
                 <phase>none</phase>
               </execution>
             </executions>
           </plugin>
           <plugin>
             <groupId>org.graalvm.buildtools</groupId>
             <artifactId>native-maven-plugin</artifactId>
             <version>${commons.graalvm.buildtools.version}</version>
             <extensions>true</extensions>
             <configuration>
               <!-- The bundled metadata pins older JUnit versions, whose class-initialization directives
                    conflict with the JUnit this project resolves. -->
               <metadataRepository>
                 <enabled>false</enabled>
               </metadataRepository>
               <!-- Xalan reflects on org.apache.xalan.templates.* setters and reads its serializer defaults from
                    property files; static analysis sees none of it. The agent records what the JVM run touched, and
                    the native binary replays those same tests, so the metadata covers it by construction. -->
               <agent>
                 <enabled>true</enabled>
               </agent>
               <!-- Match `test-stockjdk`, which drops Saxon-HE. Saxon's JAXP entry points carry no reachability
                    metadata, so every ServiceLoader lookup would fail on a missing no-arg constructor. -->
               <exclusions>
                 <exclusion>
                   <groupId>net.sf.saxon</groupId>
                   <artifactId>Saxon-HE</artifactId>
                 </exclusion>
               </exclusions>
               <buildArgs>
                 <!-- The JUnit platform feature discovers tests while the image is built, which initializes TestTag. -->
                 <buildArg>--initialize-at-build-time=org.junit.platform.engine.TestTag</buildArg>
                 <!-- Embed the fixtures explicitly: the agent records only resources a run actually opened. -->
                 <buildArg>-H:IncludeResources=leaked/.*</buildArg>
               </buildArgs>
             </configuration>
             <executions>
               <execution>
                 <id>test-native</id>
                 <phase>test</phase>
                 <goals>
                   <goal>test</goal>
                 </goals>
               </execution>
             </executions>
           </plugin>
         </plugins>
       </build>
     </profile>
   </profiles>
   <developers>
     <developer>
       <id>ppkarwasz</id>
       <name>Piotr P. Karwasz</name>
       <email>pkarwasz-pom@apache.org</email>
     </developer>
     <developer>
       <id>ggregory</id>
       <name>Gary Gregory</name>
       <email>ggregory at apache.org</email>
       <url>https://www.garygregory.com</url>
       <organization>The Apache Software Foundation</organization>
       <organizationUrl>https://www.apache.org/</organizationUrl>
       <roles>
         <role>PMC Member</role>
       </roles>
       <timezone>America/New_York</timezone>
       <properties>
         <picUrl>https://people.apache.org/~ggregory/img/garydgregory80.png</picUrl>
       </properties>
     </developer>
   </developers>
 </project>
	<?xml version="1.0" encoding="UTF-8"?>
	<!--
	Licensed to the Apache Software Foundation (ASF) under one or more
	contributor license agreements. See the NOTICE file distributed with
	this work for additional information regarding copyright ownership.
	The ASF licenses this file to You under the Apache License, Version 2.0
	(the "License"); you may not use this file except in compliance with
	the License. You may obtain a copy of the License at

	https://www.apache.org/licenses/LICENSE-2.0

	Unless required by applicable law or agreed to in writing, software
	distributed under the License is distributed on an "AS IS" BASIS,
	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	See the License for the specific language governing permissions and
	limitations under the License.
	-->
	<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<parent>
	<groupId>org.apache.commons</groupId>
	<artifactId>commons-parent</artifactId>
	<version>102</version>
	</parent>
	<artifactId>commons-xml</artifactId>
	<version>0.1.0-SNAPSHOT</version>
	<name>Apache Commons XML</name>
	<url>https://commons.apache.org/sandbox/commons-xml/</url>
	<inceptionYear>2026</inceptionYear>
	<description>Apache Commons XML provides secure-by-default JAXP factory creation, abstracting over
	implementation-specific XXE hardening differences between the stock JDK and external JAXP implementations
	(Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).</description>
	<scm>
	<connection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</connection>
	<developerConnection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</developerConnection>
	<url>https://gitbox.apache.org/repos/asf?p=commons-xml.git</url>
	<tag>rel/commons-xml-${project.version}</tag>
	</scm>
	<properties>
	<!-- Release-related properties -->
	<commons.release.version>0.1.0</commons.release.version>
	<commons.release.desc>(Java 8+)</commons.release.desc>
	<commons.rc.version>RC1</commons.rc.version>
	<!-- japicmp baseline: disable for first release
	<commons.bc.version>0.1.1</commons.bc.version> -->
	<japicmp.skip>true</japicmp.skip>
	<commons.release.next>0.1.2</commons.release.next>
	<commons.componentid>xml</commons.componentid>
	<commons.packageId>xml</commons.packageId>
	<commons.module.name>org.apache.commons.xml</commons.module.name>
	<commons.jira.id>COMMONSXML</commons.jira.id>
	<!-- Sandbox component: publish the site under the sandbox tree (the parent defaults to proper/). -->
	<commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/sandbox/commons-xml</commons.scmPubUrl>
	<!-- OSGi bundle metadata: override commons-parent's org.apache.commons.* defaults. -->
	<commons.osgi.symbolicName>org.apache.commons.xml</commons.osgi.symbolicName>
	<commons.osgi.export>org.apache.commons.xml.*;version=${project.version};-noimport:=true</commons.osgi.export>
	<commons.osgi.import>
	net.sf.saxon.*;resolution:=optional,
	org.apache.xerces.*;resolution:=optional,
	*
	</commons.osgi.import>
	<project.build.outputTimestamp>2026-04-22T00:00:00Z</project.build.outputTimestamp>
	<!-- Java baseline -->
	<maven.compiler.source>1.8</maven.compiler.source>
	<maven.compiler.target>1.8</maven.compiler.target>
	<!-- GraalVM native-image tooling; used by the `native-xalan` profile only. -->
	<commons.graalvm.buildtools.version>1.1.3</commons.graalvm.buildtools.version>
	<!-- Optional JAXP implementations used by bundled providers. -->
	<commons.saxon.version>12.9</commons.saxon.version>
	<commons.woodstox.version>7.1.1</commons.woodstox.version>
	<commons.xalan.version>2.7.3</commons.xalan.version>
	<commons.xerces.version>2.12.2</commons.xerces.version>
	</properties>
	<dependencies>
	<!--
	Saxon-HE supplies types we reference at compile time (the Saxon provider). It is not part of the consumer
	contract: it is declared in provided scope, so callers who want Saxon-HE for XSLT/XPath bring it themselves
	and it is never pulled in transitively.
	-->
	<dependency>
	<groupId>net.sf.saxon</groupId>
	<artifactId>Saxon-HE</artifactId>
	<version>${commons.saxon.version}</version>
	<scope>provided</scope>
	</dependency>
	<dependency>
	<groupId>org.junit.jupiter</groupId>
	<artifactId>junit-jupiter</artifactId>
	<scope>test</scope>
	</dependency>
	</dependencies>
	<build>
	<defaultGoal>clean checkstyle:check spotbugs:check pmd:check javadoc:javadoc verify</defaultGoal>
	<pluginManagement>
	<plugins>
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-checkstyle-plugin</artifactId>
	<configuration>
	<configLocation>${basedir}/src/conf/checkstyle.xml</configLocation>
	<enableRulesSummary>false</enableRulesSummary>
	<!-- Later:
	<includeTestSourceDirectory>true</includeTestSourceDirectory> -->
	</configuration>
	</plugin>
	<plugin>
	<groupId>com.github.spotbugs</groupId>
	<artifactId>spotbugs-maven-plugin</artifactId>
	<configuration>
	<excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
	</configuration>
	</plugin>
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-pmd-plugin</artifactId>
	<configuration>
	<rulesets>
	<ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
	</rulesets>
	</configuration>
	</plugin>
	</plugins>
	</pluginManagement>
	<plugins>
	<!--
	Run the test suite seven times, each with a distinct JAXP combination:

	- test-saxon: Saxon-HE (TrAX, XPath) over stock JDK SAX
	- test-saxon-xerces: Saxon-HE (TrAX, XPath) over stock JDK SAX or Apache Xerces SAX
	(Saxon prefers the JDK SAX provider but may resolve to Xerces)
	- test-stockjdk: stock JDK factories only (every group except xpath3)
	- test-woodstox: Woodstox (StAX)
	- test-xalan: Apache Xalan (TrAX, XPath) over stock JDK SAX
	- test-xalan-xerces: Apache Xalan (TrAX, XPath) over Apache Xerces SAX
	- test-xerces: Apache Xerces (DOM, SAX, Schema)
	-->
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-surefire-plugin</artifactId>
	<!--
	Make the underlying JAXP factories as permissive as the JDK allows. Hardened factories produced by
	XmlFactories should still block every attack the test suite throws at them; if a test passes only
	because the JDK's defaults intervened, we want it to fail here so the gap shows up.

	Inherited by every execution defined below.
	-->
	<configuration>
	<systemPropertyVariables>
	<!-- Allow all protocols for external DTDs, schemas, and stylesheets. -->
	<javax.xml.accessExternalDTD>all</javax.xml.accessExternalDTD>
	<javax.xml.accessExternalSchema>all</javax.xml.accessExternalSchema>
	<javax.xml.accessExternalStylesheet>all</javax.xml.accessExternalStylesheet>
	</systemPropertyVariables>
	</configuration>
	<executions>
	<execution>
	<id>default-test</id>
	<phase>none</phase>
	</execution>
	<execution>
	<id>test-saxon</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/saxon</reportsDirectory>
	<!-- Saxon contributes TrAX (transformer + stylesheet) and XPath; xpath3 covers Saxon-only XPath 3.1 functions. -->
	<groups>trax,xpath3</groups>
	</configuration>
	</execution>
	<execution>
	<id>test-saxon-xerces</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/saxon-xerces</reportsDirectory>
	<!-- Same groups as test-saxon, but with Apache Xerces also visible to Saxon's SAX-provider lookup. -->
	<groups>trax,xpath3</groups>
	<additionalClasspathDependencies>
	<dependency>
	<groupId>xerces</groupId>
	<artifactId>xercesImpl</artifactId>
	<version>${commons.xerces.version}</version>
	</dependency>
	</additionalClasspathDependencies>
	</configuration>
	</execution>
	<execution>
	<id>test-stockjdk</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/stockjdk</reportsDirectory>
	<!-- Run every tagged and untagged test except xpath3, which needs Saxon on the classpath. -->
	<excludedGroups>xpath3</excludedGroups>
	<classpathDependencyExcludes>
	<exclude>net.sf.saxon:Saxon-HE</exclude>
	</classpathDependencyExcludes>
	</configuration>
	</execution>
	<execution>
	<id>test-woodstox</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/woodstox</reportsDirectory>
	<!-- Woodstox only contributes StAX. -->
	<groups>stax</groups>
	<additionalClasspathDependencies>
	<dependency>
	<groupId>com.fasterxml.woodstox</groupId>
	<artifactId>woodstox-core</artifactId>
	<version>${commons.woodstox.version}</version>
	</dependency>
	</additionalClasspathDependencies>
	<classpathDependencyExcludes>
	<exclude>net.sf.saxon:Saxon-HE</exclude>
	</classpathDependencyExcludes>
	</configuration>
	</execution>
	<execution>
	<id>test-xalan</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/xalan</reportsDirectory>
	<!-- Xalan contributes TrAX and XPath. -->
	<groups>xpath,trax</groups>
	<additionalClasspathDependencies>
	<dependency>
	<groupId>xalan</groupId>
	<artifactId>serializer</artifactId>
	<version>${commons.xalan.version}</version>
	</dependency>
	<dependency>
	<groupId>xalan</groupId>
	<artifactId>xalan</artifactId>
	<version>${commons.xalan.version}</version>
	</dependency>
	</additionalClasspathDependencies>
	<classpathDependencyExcludes>
	<exclude>net.sf.saxon:Saxon-HE</exclude>
	</classpathDependencyExcludes>
	</configuration>
	</execution>
	<execution>
	<id>test-xalan-xerces</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/xalan-xerces</reportsDirectory>
	<!-- Same groups as test-xalan, but with Apache Xerces winning Xalan's internal SAX-provider lookup. -->
	<groups>xpath,trax</groups>
	<additionalClasspathDependencies>
	<dependency>
	<groupId>xalan</groupId>
	<artifactId>serializer</artifactId>
	<version>${commons.xalan.version}</version>
	</dependency>
	<dependency>
	<groupId>xalan</groupId>
	<artifactId>xalan</artifactId>
	<version>${commons.xalan.version}</version>
	</dependency>
	<dependency>
	<groupId>xerces</groupId>
	<artifactId>xercesImpl</artifactId>
	<version>${commons.xerces.version}</version>
	</dependency>
	</additionalClasspathDependencies>
	<classpathDependencyExcludes>
	<exclude>net.sf.saxon:Saxon-HE</exclude>
	</classpathDependencyExcludes>
	</configuration>
	</execution>
	<execution>
	<id>test-xerces</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/xerces</reportsDirectory>
	<!-- Xerces only contributes DOM/SAX/Schema; the rest is JDK-bundled and already covered by test-stockjdk. -->
	<groups>dom,sax,schema</groups>
	<additionalClasspathDependencies>
	<dependency>
	<groupId>xerces</groupId>
	<artifactId>xercesImpl</artifactId>
	<version>${commons.xerces.version}</version>
	</dependency>
	</additionalClasspathDependencies>
	<classpathDependencyExcludes>
	<exclude>net.sf.saxon:Saxon-HE</exclude>
	</classpathDependencyExcludes>
	</configuration>
	</execution>
	</executions>
	</plugin>
	<!-- Do not publish a test-jar: the test classes are not part of the consumer contract. -->
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-jar-plugin</artifactId>
	<executions>
	<execution>
	<id>default</id>
	<phase>none</phase>
	</execution>
	</executions>
	</plugin>
	<!--
	commons-parent's create-source-jar execution attaches both the main sources (jar-no-fork) and the test
	sources (test-jar-no-fork) in one execution. Disable it and re-bind a main-sources-only execution, so the
	published artifact keeps the required sources jar but drops the test-sources jar.
	-->
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-source-plugin</artifactId>
	<executions>
	<execution>
	<id>create-source-jar</id>
	<phase>none</phase>
	</execution>
	<execution>
	<id>create-main-source-jar</id>
	<phase>package</phase>
	<goals>
	<goal>jar-no-fork</goal>
	</goals>
	</execution>
	</executions>
	</plugin>
	<!-- jdeps makes Saxon.HE a hard requires; flip it to static (optional). The trailing * keeps the rest. -->
	<plugin>
	<groupId>org.moditect</groupId>
	<artifactId>moditect-maven-plugin</artifactId>
	<executions>
	<execution>
	<id>add-module-infos</id>
	<configuration>
	<module>
	<moduleInfo>
	<requires>
	static Saxon.HE;
	*;
	</requires>
	</moduleInfo>
	</module>
	</configuration>
	</execution>
	</executions>
	</plugin>
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-checkstyle-plugin</artifactId>
	</plugin>
	</plugins>
	</build>
	<reporting>
	<plugins>
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-checkstyle-plugin</artifactId>
	</plugin>
	<plugin>
	<groupId>com.github.spotbugs</groupId>
	<artifactId>spotbugs-maven-plugin</artifactId>
	<configuration>
	<excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
	</configuration>
	</plugin>
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-pmd-plugin</artifactId>
	<configuration>
	<rulesets>
	<ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
	</rulesets>
	</configuration>
	</plugin>
	</plugins>
	</reporting>
	<profiles>
	<!--
	Regression guard for the generated OSGi and JPMS descriptors.
	The JPMS test requires JDK 9+
	-->
	<profile>
	<id>java11-tests</id>
	<activation>
	<jdk>[11,)</jdk>
	</activation>
	<build>
	<plugins>
	<!-- Compile the src/test/java11 source root at release 11; the default test sources stay at release 8. -->
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-compiler-plugin</artifactId>
	<executions>
	<execution>
	<id>testCompile-java11</id>
	<phase>test-compile</phase>
	<goals>
	<goal>testCompile</goal>
	</goals>
	<configuration>
	<release>11</release>
	<compileSourceRoots>
	<compileSourceRoot>${project.basedir}/src/test/java11</compileSourceRoot>
	</compileSourceRoots>
	</configuration>
	</execution>
	</executions>
	</plugin>
	<!-- Run DescriptorIT against the packaged jar; no OSGi framework or separate JPMS module needed. -->
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-failsafe-plugin</artifactId>
	<executions>
	<execution>
	<id>verify-descriptors</id>
	<goals>
	<goal>integration-test</goal>
	<goal>verify</goal>
	</goals>
	<configuration>
	<systemPropertyVariables>
	<buildJar>${project.build.directory}/${project.build.finalName}.jar</buildJar>
	</systemPropertyVariables>
	</configuration>
	</execution>
	</executions>
	</plugin>
	</plugins>
	</build>
	</profile>

	<!--
	Dependency versions only compatible with JDK 17+.
	-->
	<profile>
	<id>java17-dependencies</id>
	<activation>
	<jdk>[17,)</jdk>
	</activation>

	<properties>
	<commons.saxon.version>13.0</commons.saxon.version>
	</properties>
	</profile>
	<!--
	Runs the test suite as a GraalVM native image; activate with -Pnative-xalan on a GraalVM JDK.

	Worth a job because native-image resolves JAXP providers under the closed-world assumption: the lookup a JVM
	performs at run time through ServiceLoader is decided at build time instead.

	A native binary carries one classpath, so only `test-stockjdk` runs; the other JAXP combinations stay on the
	JVM matrix. Its `xpath3` group is excluded there already, and that group needs Saxon, which is dropped here.
	-->
	<profile>
	<id>native-xalan</id>
	<dependencies>
	<dependency>
	<groupId>org.graalvm.buildtools</groupId>
	<artifactId>junit-platform-native</artifactId>
	<version>${commons.graalvm.buildtools.version}</version>
	<scope>test</scope>
	</dependency>
	<!--
	Apache Xalan supplies TrAX. The stock JDK's XSLTC compiles each stylesheet into translet bytecode and
	defines the class at run time, which a closed-world image cannot do; Xalan interprets instead. Declared as
	project dependencies, not surefire's additionalClasspathDependencies, which native-image never sees.
	-->
	<dependency>
	<groupId>xalan</groupId>
	<artifactId>xalan</artifactId>
	<version>${commons.xalan.version}</version>
	<scope>test</scope>
	</dependency>
	<dependency>
	<groupId>xalan</groupId>
	<artifactId>serializer</artifactId>
	<version>${commons.xalan.version}</version>
	<scope>test</scope>
	</dependency>
	</dependencies>
	<build>
	<plugins>
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-surefire-plugin</artifactId>
	<executions>
	<!--
	Only `test-stockjdk` is left running, unconfigured: it registers the tests the native binary replays.
	The profile's Xalan dependencies are on its classpath, so it is Xalan, not XSLTC, that supplies TrAX
	in both the JVM and the native run.

	Every other execution is silenced; their classpath swaps have no native equivalent.
	-->
	<execution>
	<id>test-xalan</id>
	<phase>none</phase>
	</execution>
	<execution>
	<id>test-saxon</id>
	<phase>none</phase>
	</execution>
	<execution>
	<id>test-saxon-xerces</id>
	<phase>none</phase>
	</execution>
	<execution>
	<id>test-woodstox</id>
	<phase>none</phase>
	</execution>
	<execution>
	<id>test-xalan-xerces</id>
	<phase>none</phase>
	</execution>
	<execution>
	<id>test-xerces</id>
	<phase>none</phase>
	</execution>
	</executions>
	</plugin>
	<plugin>
	<groupId>org.graalvm.buildtools</groupId>
	<artifactId>native-maven-plugin</artifactId>
	<version>${commons.graalvm.buildtools.version}</version>
	<extensions>true</extensions>
	<configuration>
	<!-- The bundled metadata pins older JUnit versions, whose class-initialization directives
	conflict with the JUnit this project resolves. -->
	<metadataRepository>
	<enabled>false</enabled>
	</metadataRepository>
	<!-- Xalan reflects on org.apache.xalan.templates.* setters and reads its serializer defaults from
	property files; static analysis sees none of it. The agent records what the JVM run touched, and
	the native binary replays those same tests, so the metadata covers it by construction. -->
	<agent>
	<enabled>true</enabled>
	</agent>
	<!-- Match `test-stockjdk`, which drops Saxon-HE. Saxon's JAXP entry points carry no reachability
	metadata, so every ServiceLoader lookup would fail on a missing no-arg constructor. -->
	<exclusions>
	<exclusion>
	<groupId>net.sf.saxon</groupId>
	<artifactId>Saxon-HE</artifactId>
	</exclusion>
	</exclusions>
	<buildArgs>
	<!-- The JUnit platform feature discovers tests while the image is built, which initializes TestTag. -->
	<buildArg>--initialize-at-build-time=org.junit.platform.engine.TestTag</buildArg>
	<!-- Embed the fixtures explicitly: the agent records only resources a run actually opened. -->
	<buildArg>-H:IncludeResources=leaked/.*</buildArg>
	</buildArgs>
	</configuration>
	<executions>
	<execution>
	<id>test-native</id>
	<phase>test</phase>
	<goals>
	<goal>test</goal>
	</goals>
	</execution>
	</executions>
	</plugin>
	</plugins>
	</build>
	</profile>
	</profiles>
	<developers>
	<developer>
	<id>ppkarwasz</id>
	<name>Piotr P. Karwasz</name>
	<email>pkarwasz-pom@apache.org</email>
	</developer>
	<developer>
	<id>ggregory</id>
	<name>Gary Gregory</name>
	<email>ggregory at apache.org</email>
	<url>https://www.garygregory.com</url>
	<organization>The Apache Software Foundation</organization>
	<organizationUrl>https://www.apache.org/</organizationUrl>
	<roles>
	<role>PMC Member</role>
	</roles>
	<timezone>America/New_York</timezone>
	<properties>
	<picUrl>https://people.apache.org/~ggregory/img/garydgregory80.png</picUrl>
	</properties>
	</developer>
	</developers>
	</project>