pom.xml - commons-xml - Git at Google

 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
 this work for additional information regarding copyright ownership.
 The ASF licenses this file to You under the Apache License, Version 2.0
 (the "License"); you may not use this file except in compliance with
 the License.  You may obtain a copy of the License at

      https://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">
   <modelVersion>4.0.0</modelVersion>
   <parent>
     <groupId>org.apache.commons</groupId>
     <artifactId>commons-parent</artifactId>
     <version>102</version>
   </parent>
   <artifactId>commons-xml</artifactId>
   <version>0.1.0-SNAPSHOT</version>
   <name>Apache Commons XML</name>
   <url>https://commons.apache.org/sandbox/commons-xml/</url>
   <inceptionYear>2026</inceptionYear>
   <description>Apache Commons XML provides secure-by-default JAXP factory creation, abstracting over
     implementation-specific XXE hardening differences between the stock JDK and external JAXP implementations
     (Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).</description>
   <scm>
     <connection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</developerConnection>
     <url>https://gitbox.apache.org/repos/asf?p=commons-xml.git</url>
     <tag>rel/commons-xml-${project.version}</tag>
   </scm>
   <properties>
     <!-- Release-related properties -->
     <commons.release.version>0.1.0</commons.release.version>
     <commons.release.desc>(Java 8+)</commons.release.desc>
     <commons.rc.version>RC1</commons.rc.version>
     <!-- japicmp baseline: disable for first release
     <commons.bc.version>0.1.1</commons.bc.version> -->
     <japicmp.skip>true</japicmp.skip>
     <commons.release.next>0.1.2</commons.release.next>
     <commons.componentid>xml</commons.componentid>
     <commons.packageId>xml</commons.packageId>
     <commons.module.name>org.apache.commons.xml</commons.module.name>
     <commons.jira.id>COMMONSXML</commons.jira.id>
     <!-- Sandbox component: publish the site under the sandbox tree (the parent defaults to proper/). -->
     <commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/sandbox/commons-xml</commons.scmPubUrl>
     <!-- OSGi bundle metadata: override commons-parent's org.apache.commons.* defaults. -->
     <commons.osgi.symbolicName>org.apache.commons.xml</commons.osgi.symbolicName>
     <commons.osgi.export>org.apache.commons.xml.*;version=${project.version};-noimport:=true</commons.osgi.export>
     <commons.osgi.import>
       net.sf.saxon.*;resolution:=optional,
       org.apache.xerces.*;resolution:=optional,
       *
     </commons.osgi.import>
     <project.build.outputTimestamp>2026-04-22T00:00:00Z</project.build.outputTimestamp>
     <!-- Java baseline -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
     <!-- Optional JAXP implementations used by bundled providers. -->
     <commons.saxon.version>12.9</commons.saxon.version>
     <commons.woodstox.version>7.1.1</commons.woodstox.version>
     <commons.xalan.version>2.7.3</commons.xalan.version>
     <commons.xerces.version>2.12.2</commons.xerces.version>
   </properties>
   <dependencies>
     <!--
       Saxon-HE supplies types we reference at compile time (the Saxon provider). It is not part of the consumer
       contract: it is declared in provided scope, so callers who want Saxon-HE for XSLT/XPath bring it themselves
       and it is never pulled in transitively.
     -->
     <dependency>
       <groupId>net.sf.saxon</groupId>
       <artifactId>Saxon-HE</artifactId>
       <version>${commons.saxon.version}</version>
       <scope>provided</scope>
     </dependency>
     <dependency>
       <groupId>org.junit.jupiter</groupId>
       <artifactId>junit-jupiter</artifactId>
       <scope>test</scope>
     </dependency>
   </dependencies>
   <build>
     <defaultGoal>clean checkstyle:check spotbugs:check pmd:check javadoc:javadoc verify</defaultGoal>
     <pluginManagement>
       <plugins>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-checkstyle-plugin</artifactId>
           <configuration>
             <configLocation>${basedir}/src/conf/checkstyle.xml</configLocation>
             <enableRulesSummary>false</enableRulesSummary>
             <!-- Later:
             <includeTestSourceDirectory>true</includeTestSourceDirectory> -->
           </configuration>
         </plugin>
         <plugin>
           <groupId>com.github.spotbugs</groupId>
           <artifactId>spotbugs-maven-plugin</artifactId>
           <configuration>
             <excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
           </configuration>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-pmd-plugin</artifactId>
           <configuration>
             <rulesets>
               <ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
             </rulesets>
           </configuration>
         </plugin>
       </plugins>
     </pluginManagement>
     <plugins>
       <!--
         Run the test suite seven times, each with a distinct JAXP combination:

           - test-saxon:         Saxon-HE (TrAX, XPath) over stock JDK SAX
           - test-saxon-xerces:  Saxon-HE (TrAX, XPath) over stock JDK SAX or Apache Xerces SAX
                                 (Saxon prefers the JDK SAX provider but may resolve to Xerces)
           - test-stockjdk:      stock JDK factories only (every group except xpath3)
           - test-woodstox:      Woodstox (StAX)
           - test-xalan:         Apache Xalan (TrAX, XPath) over stock JDK SAX
           - test-xalan-xerces:  Apache Xalan (TrAX, XPath) over Apache Xerces SAX
           - test-xerces:        Apache Xerces (DOM, SAX, Schema)
       -->
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
         <!--
           Make the underlying JAXP factories as permissive as the JDK allows. Hardened factories produced by
           XmlFactories should still block every attack the test suite throws at them; if a test passes only
           because the JDK's defaults intervened, we want it to fail here so the gap shows up.

           Inherited by every execution defined below.
         -->
         <configuration>
           <systemPropertyVariables>
             <!-- Allow all protocols for external DTDs, schemas, and stylesheets. -->
             <javax.xml.accessExternalDTD>all</javax.xml.accessExternalDTD>
             <javax.xml.accessExternalSchema>all</javax.xml.accessExternalSchema>
             <javax.xml.accessExternalStylesheet>all</javax.xml.accessExternalStylesheet>
           </systemPropertyVariables>
         </configuration>
         <executions>
           <execution>
             <id>default-test</id>
             <phase>none</phase>
           </execution>
           <execution>
             <id>test-saxon</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/saxon</reportsDirectory>
               <!-- Saxon contributes TrAX (transformer + stylesheet) and XPath; xpath3 covers Saxon-only XPath 3.1 functions. -->
               <groups>trax,xpath3</groups>
             </configuration>
           </execution>
           <execution>
             <id>test-saxon-xerces</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/saxon-xerces</reportsDirectory>
               <!-- Same groups as test-saxon, but with Apache Xerces also visible to Saxon's SAX-provider lookup. -->
               <groups>trax,xpath3</groups>
               <additionalClasspathDependencies>
                 <dependency>
                   <groupId>xerces</groupId>
                   <artifactId>xercesImpl</artifactId>
                   <version>${commons.xerces.version}</version>
                 </dependency>
               </additionalClasspathDependencies>
             </configuration>
           </execution>
           <execution>
             <id>test-stockjdk</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/stockjdk</reportsDirectory>
               <!-- Run every tagged and untagged test except xpath3, which needs Saxon on the classpath. -->
               <excludedGroups>xpath3</excludedGroups>
               <classpathDependencyExcludes>
                 <exclude>net.sf.saxon:Saxon-HE</exclude>
               </classpathDependencyExcludes>
             </configuration>
           </execution>
           <execution>
             <id>test-woodstox</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/woodstox</reportsDirectory>
               <!-- Woodstox only contributes StAX. -->
               <groups>stax</groups>
               <additionalClasspathDependencies>
                 <dependency>
                   <groupId>com.fasterxml.woodstox</groupId>
                   <artifactId>woodstox-core</artifactId>
                   <version>${commons.woodstox.version}</version>
                 </dependency>
               </additionalClasspathDependencies>
               <classpathDependencyExcludes>
                 <exclude>net.sf.saxon:Saxon-HE</exclude>
               </classpathDependencyExcludes>
             </configuration>
           </execution>
           <execution>
             <id>test-xalan</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/xalan</reportsDirectory>
               <!-- Xalan contributes TrAX and XPath. -->
               <groups>xpath,trax</groups>
               <additionalClasspathDependencies>
                 <dependency>
                   <groupId>xalan</groupId>
                   <artifactId>serializer</artifactId>
                   <version>${commons.xalan.version}</version>
                 </dependency>
                 <dependency>
                   <groupId>xalan</groupId>
                   <artifactId>xalan</artifactId>
                   <version>${commons.xalan.version}</version>
                 </dependency>
               </additionalClasspathDependencies>
               <classpathDependencyExcludes>
                 <exclude>net.sf.saxon:Saxon-HE</exclude>
               </classpathDependencyExcludes>
             </configuration>
           </execution>
           <execution>
             <id>test-xalan-xerces</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/xalan-xerces</reportsDirectory>
               <!-- Same groups as test-xalan, but with Apache Xerces winning Xalan's internal SAX-provider lookup. -->
               <groups>xpath,trax</groups>
               <additionalClasspathDependencies>
                 <dependency>
                   <groupId>xalan</groupId>
                   <artifactId>serializer</artifactId>
                   <version>${commons.xalan.version}</version>
                 </dependency>
                 <dependency>
                   <groupId>xalan</groupId>
                   <artifactId>xalan</artifactId>
                   <version>${commons.xalan.version}</version>
                 </dependency>
                 <dependency>
                   <groupId>xerces</groupId>
                   <artifactId>xercesImpl</artifactId>
                   <version>${commons.xerces.version}</version>
                 </dependency>
               </additionalClasspathDependencies>
               <classpathDependencyExcludes>
                 <exclude>net.sf.saxon:Saxon-HE</exclude>
               </classpathDependencyExcludes>
             </configuration>
           </execution>
           <execution>
             <id>test-xerces</id>
             <goals>
               <goal>test</goal>
             </goals>
             <configuration>
               <reportsDirectory>${project.build.directory}/surefire-reports/xerces</reportsDirectory>
               <!-- Xerces only contributes DOM/SAX/Schema; the rest is JDK-bundled and already covered by test-stockjdk. -->
               <groups>dom,sax,schema</groups>
               <additionalClasspathDependencies>
                 <dependency>
                   <groupId>xerces</groupId>
                   <artifactId>xercesImpl</artifactId>
                   <version>${commons.xerces.version}</version>
                 </dependency>
               </additionalClasspathDependencies>
               <classpathDependencyExcludes>
                 <exclude>net.sf.saxon:Saxon-HE</exclude>
               </classpathDependencyExcludes>
             </configuration>
           </execution>
         </executions>
       </plugin>
       <!-- Do not publish a test-jar: the test classes are not part of the consumer contract. -->
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-jar-plugin</artifactId>
         <executions>
           <execution>
             <id>default</id>
             <phase>none</phase>
           </execution>
         </executions>
       </plugin>
       <!--
         commons-parent's create-source-jar execution attaches both the main sources (jar-no-fork) and the test
         sources (test-jar-no-fork) in one execution. Disable it and re-bind a main-sources-only execution, so the
         published artifact keeps the required sources jar but drops the test-sources jar.
       -->
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-source-plugin</artifactId>
         <executions>
           <execution>
             <id>create-source-jar</id>
             <phase>none</phase>
           </execution>
           <execution>
             <id>create-main-source-jar</id>
             <phase>package</phase>
             <goals>
               <goal>jar-no-fork</goal>
             </goals>
           </execution>
         </executions>
       </plugin>
       <!-- jdeps makes Saxon.HE a hard requires; flip it to static (optional). The trailing * keeps the rest. -->
       <plugin>
         <groupId>org.moditect</groupId>
         <artifactId>moditect-maven-plugin</artifactId>
         <executions>
           <execution>
             <id>add-module-infos</id>
             <configuration>
               <module>
                 <moduleInfo>
                   <requires>
                     static Saxon.HE;
                     *;
                   </requires>
                 </moduleInfo>
               </module>
             </configuration>
           </execution>
         </executions>
       </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-checkstyle-plugin</artifactId>
       </plugin>
     </plugins>
   </build>
   <reporting>
     <plugins>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-checkstyle-plugin</artifactId>
       </plugin>
       <plugin>
         <groupId>com.github.spotbugs</groupId>
         <artifactId>spotbugs-maven-plugin</artifactId>
         <configuration>
           <excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
         </configuration>
       </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-pmd-plugin</artifactId>
         <configuration>
           <rulesets>
             <ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
           </rulesets>
         </configuration>
       </plugin>
     </plugins>
   </reporting>
   <profiles>
     <!--
       Regression guard for the generated OSGi and JPMS descriptors.
       The JPMS test requires JDK 9+
     -->
     <profile>
       <id>java11-tests</id>
       <activation>
         <jdk>[11,)</jdk>
       </activation>
       <build>
         <plugins>
           <!-- Compile the src/test/java11 source root at release 11; the default test sources stay at release 8. -->
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-compiler-plugin</artifactId>
             <executions>
               <execution>
                 <id>testCompile-java11</id>
                 <phase>test-compile</phase>
                 <goals>
                   <goal>testCompile</goal>
                 </goals>
                 <configuration>
                   <release>11</release>
                   <compileSourceRoots>
                     <compileSourceRoot>${project.basedir}/src/test/java11</compileSourceRoot>
                   </compileSourceRoots>
                 </configuration>
               </execution>
             </executions>
           </plugin>
           <!-- Run DescriptorIT against the packaged jar; no OSGi framework or separate JPMS module needed. -->
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-failsafe-plugin</artifactId>
             <executions>
               <execution>
                 <id>verify-descriptors</id>
                 <goals>
                   <goal>integration-test</goal>
                   <goal>verify</goal>
                 </goals>
                 <configuration>
                   <systemPropertyVariables>
                     <buildJar>${project.build.directory}/${project.build.finalName}.jar</buildJar>
                   </systemPropertyVariables>
                 </configuration>
               </execution>
             </executions>
           </plugin>
         </plugins>
       </build>
     </profile>

     <!--
       Dependency versions only compatible with JDK 17+.
       -->
     <profile>
       <id>java17-dependencies</id>
       <activation>
         <jdk>[17,)</jdk>
       </activation>

       <properties>
         <commons.saxon.version>13.0</commons.saxon.version>
       </properties>
     </profile>
   </profiles>
   <developers>
     <developer>
       <id>ppkarwasz</id>
       <name>Piotr P. Karwasz</name>
       <email>pkarwasz-pom@apache.org</email>
     </developer>
     <developer>
       <id>ggregory</id>
       <name>Gary Gregory</name>
       <email>ggregory at apache.org</email>
       <url>https://www.garygregory.com</url>
       <organization>The Apache Software Foundation</organization>
       <organizationUrl>https://www.apache.org/</organizationUrl>
       <roles>
         <role>PMC Member</role>
       </roles>
       <timezone>America/New_York</timezone>
       <properties>
         <picUrl>https://people.apache.org/~ggregory/img/garydgregory80.png</picUrl>
       </properties>
     </developer>
   </developers>
 </project>
	<?xml version="1.0" encoding="UTF-8"?>
	<!--
	Licensed to the Apache Software Foundation (ASF) under one or more
	contributor license agreements. See the NOTICE file distributed with
	this work for additional information regarding copyright ownership.
	The ASF licenses this file to You under the Apache License, Version 2.0
	(the "License"); you may not use this file except in compliance with
	the License. You may obtain a copy of the License at

	https://www.apache.org/licenses/LICENSE-2.0

	Unless required by applicable law or agreed to in writing, software
	distributed under the License is distributed on an "AS IS" BASIS,
	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	See the License for the specific language governing permissions and
	limitations under the License.
	-->
	<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<parent>
	<groupId>org.apache.commons</groupId>
	<artifactId>commons-parent</artifactId>
	<version>102</version>
	</parent>
	<artifactId>commons-xml</artifactId>
	<version>0.1.0-SNAPSHOT</version>
	<name>Apache Commons XML</name>
	<url>https://commons.apache.org/sandbox/commons-xml/</url>
	<inceptionYear>2026</inceptionYear>
	<description>Apache Commons XML provides secure-by-default JAXP factory creation, abstracting over
	implementation-specific XXE hardening differences between the stock JDK and external JAXP implementations
	(Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).</description>
	<scm>
	<connection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</connection>
	<developerConnection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</developerConnection>
	<url>https://gitbox.apache.org/repos/asf?p=commons-xml.git</url>
	<tag>rel/commons-xml-${project.version}</tag>
	</scm>
	<properties>
	<!-- Release-related properties -->
	<commons.release.version>0.1.0</commons.release.version>
	<commons.release.desc>(Java 8+)</commons.release.desc>
	<commons.rc.version>RC1</commons.rc.version>
	<!-- japicmp baseline: disable for first release
	<commons.bc.version>0.1.1</commons.bc.version> -->
	<japicmp.skip>true</japicmp.skip>
	<commons.release.next>0.1.2</commons.release.next>
	<commons.componentid>xml</commons.componentid>
	<commons.packageId>xml</commons.packageId>
	<commons.module.name>org.apache.commons.xml</commons.module.name>
	<commons.jira.id>COMMONSXML</commons.jira.id>
	<!-- Sandbox component: publish the site under the sandbox tree (the parent defaults to proper/). -->
	<commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/sandbox/commons-xml</commons.scmPubUrl>
	<!-- OSGi bundle metadata: override commons-parent's org.apache.commons.* defaults. -->
	<commons.osgi.symbolicName>org.apache.commons.xml</commons.osgi.symbolicName>
	<commons.osgi.export>org.apache.commons.xml.*;version=${project.version};-noimport:=true</commons.osgi.export>
	<commons.osgi.import>
	net.sf.saxon.*;resolution:=optional,
	org.apache.xerces.*;resolution:=optional,
	*
	</commons.osgi.import>
	<project.build.outputTimestamp>2026-04-22T00:00:00Z</project.build.outputTimestamp>
	<!-- Java baseline -->
	<maven.compiler.source>1.8</maven.compiler.source>
	<maven.compiler.target>1.8</maven.compiler.target>
	<!-- Optional JAXP implementations used by bundled providers. -->
	<commons.saxon.version>12.9</commons.saxon.version>
	<commons.woodstox.version>7.1.1</commons.woodstox.version>
	<commons.xalan.version>2.7.3</commons.xalan.version>
	<commons.xerces.version>2.12.2</commons.xerces.version>
	</properties>
	<dependencies>
	<!--
	Saxon-HE supplies types we reference at compile time (the Saxon provider). It is not part of the consumer
	contract: it is declared in provided scope, so callers who want Saxon-HE for XSLT/XPath bring it themselves
	and it is never pulled in transitively.
	-->
	<dependency>
	<groupId>net.sf.saxon</groupId>
	<artifactId>Saxon-HE</artifactId>
	<version>${commons.saxon.version}</version>
	<scope>provided</scope>
	</dependency>
	<dependency>
	<groupId>org.junit.jupiter</groupId>
	<artifactId>junit-jupiter</artifactId>
	<scope>test</scope>
	</dependency>
	</dependencies>
	<build>
	<defaultGoal>clean checkstyle:check spotbugs:check pmd:check javadoc:javadoc verify</defaultGoal>
	<pluginManagement>
	<plugins>
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-checkstyle-plugin</artifactId>
	<configuration>
	<configLocation>${basedir}/src/conf/checkstyle.xml</configLocation>
	<enableRulesSummary>false</enableRulesSummary>
	<!-- Later:
	<includeTestSourceDirectory>true</includeTestSourceDirectory> -->
	</configuration>
	</plugin>
	<plugin>
	<groupId>com.github.spotbugs</groupId>
	<artifactId>spotbugs-maven-plugin</artifactId>
	<configuration>
	<excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
	</configuration>
	</plugin>
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-pmd-plugin</artifactId>
	<configuration>
	<rulesets>
	<ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
	</rulesets>
	</configuration>
	</plugin>
	</plugins>
	</pluginManagement>
	<plugins>
	<!--
	Run the test suite seven times, each with a distinct JAXP combination:

	- test-saxon: Saxon-HE (TrAX, XPath) over stock JDK SAX
	- test-saxon-xerces: Saxon-HE (TrAX, XPath) over stock JDK SAX or Apache Xerces SAX
	(Saxon prefers the JDK SAX provider but may resolve to Xerces)
	- test-stockjdk: stock JDK factories only (every group except xpath3)
	- test-woodstox: Woodstox (StAX)
	- test-xalan: Apache Xalan (TrAX, XPath) over stock JDK SAX
	- test-xalan-xerces: Apache Xalan (TrAX, XPath) over Apache Xerces SAX
	- test-xerces: Apache Xerces (DOM, SAX, Schema)
	-->
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-surefire-plugin</artifactId>
	<!--
	Make the underlying JAXP factories as permissive as the JDK allows. Hardened factories produced by
	XmlFactories should still block every attack the test suite throws at them; if a test passes only
	because the JDK's defaults intervened, we want it to fail here so the gap shows up.

	Inherited by every execution defined below.
	-->
	<configuration>
	<systemPropertyVariables>
	<!-- Allow all protocols for external DTDs, schemas, and stylesheets. -->
	<javax.xml.accessExternalDTD>all</javax.xml.accessExternalDTD>
	<javax.xml.accessExternalSchema>all</javax.xml.accessExternalSchema>
	<javax.xml.accessExternalStylesheet>all</javax.xml.accessExternalStylesheet>
	</systemPropertyVariables>
	</configuration>
	<executions>
	<execution>
	<id>default-test</id>
	<phase>none</phase>
	</execution>
	<execution>
	<id>test-saxon</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/saxon</reportsDirectory>
	<!-- Saxon contributes TrAX (transformer + stylesheet) and XPath; xpath3 covers Saxon-only XPath 3.1 functions. -->
	<groups>trax,xpath3</groups>
	</configuration>
	</execution>
	<execution>
	<id>test-saxon-xerces</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/saxon-xerces</reportsDirectory>
	<!-- Same groups as test-saxon, but with Apache Xerces also visible to Saxon's SAX-provider lookup. -->
	<groups>trax,xpath3</groups>
	<additionalClasspathDependencies>
	<dependency>
	<groupId>xerces</groupId>
	<artifactId>xercesImpl</artifactId>
	<version>${commons.xerces.version}</version>
	</dependency>
	</additionalClasspathDependencies>
	</configuration>
	</execution>
	<execution>
	<id>test-stockjdk</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/stockjdk</reportsDirectory>
	<!-- Run every tagged and untagged test except xpath3, which needs Saxon on the classpath. -->
	<excludedGroups>xpath3</excludedGroups>
	<classpathDependencyExcludes>
	<exclude>net.sf.saxon:Saxon-HE</exclude>
	</classpathDependencyExcludes>
	</configuration>
	</execution>
	<execution>
	<id>test-woodstox</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/woodstox</reportsDirectory>
	<!-- Woodstox only contributes StAX. -->
	<groups>stax</groups>
	<additionalClasspathDependencies>
	<dependency>
	<groupId>com.fasterxml.woodstox</groupId>
	<artifactId>woodstox-core</artifactId>
	<version>${commons.woodstox.version}</version>
	</dependency>
	</additionalClasspathDependencies>
	<classpathDependencyExcludes>
	<exclude>net.sf.saxon:Saxon-HE</exclude>
	</classpathDependencyExcludes>
	</configuration>
	</execution>
	<execution>
	<id>test-xalan</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/xalan</reportsDirectory>
	<!-- Xalan contributes TrAX and XPath. -->
	<groups>xpath,trax</groups>
	<additionalClasspathDependencies>
	<dependency>
	<groupId>xalan</groupId>
	<artifactId>serializer</artifactId>
	<version>${commons.xalan.version}</version>
	</dependency>
	<dependency>
	<groupId>xalan</groupId>
	<artifactId>xalan</artifactId>
	<version>${commons.xalan.version}</version>
	</dependency>
	</additionalClasspathDependencies>
	<classpathDependencyExcludes>
	<exclude>net.sf.saxon:Saxon-HE</exclude>
	</classpathDependencyExcludes>
	</configuration>
	</execution>
	<execution>
	<id>test-xalan-xerces</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/xalan-xerces</reportsDirectory>
	<!-- Same groups as test-xalan, but with Apache Xerces winning Xalan's internal SAX-provider lookup. -->
	<groups>xpath,trax</groups>
	<additionalClasspathDependencies>
	<dependency>
	<groupId>xalan</groupId>
	<artifactId>serializer</artifactId>
	<version>${commons.xalan.version}</version>
	</dependency>
	<dependency>
	<groupId>xalan</groupId>
	<artifactId>xalan</artifactId>
	<version>${commons.xalan.version}</version>
	</dependency>
	<dependency>
	<groupId>xerces</groupId>
	<artifactId>xercesImpl</artifactId>
	<version>${commons.xerces.version}</version>
	</dependency>
	</additionalClasspathDependencies>
	<classpathDependencyExcludes>
	<exclude>net.sf.saxon:Saxon-HE</exclude>
	</classpathDependencyExcludes>
	</configuration>
	</execution>
	<execution>
	<id>test-xerces</id>
	<goals>
	<goal>test</goal>
	</goals>
	<configuration>
	<reportsDirectory>${project.build.directory}/surefire-reports/xerces</reportsDirectory>
	<!-- Xerces only contributes DOM/SAX/Schema; the rest is JDK-bundled and already covered by test-stockjdk. -->
	<groups>dom,sax,schema</groups>
	<additionalClasspathDependencies>
	<dependency>
	<groupId>xerces</groupId>
	<artifactId>xercesImpl</artifactId>
	<version>${commons.xerces.version}</version>
	</dependency>
	</additionalClasspathDependencies>
	<classpathDependencyExcludes>
	<exclude>net.sf.saxon:Saxon-HE</exclude>
	</classpathDependencyExcludes>
	</configuration>
	</execution>
	</executions>
	</plugin>
	<!-- Do not publish a test-jar: the test classes are not part of the consumer contract. -->
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-jar-plugin</artifactId>
	<executions>
	<execution>
	<id>default</id>
	<phase>none</phase>
	</execution>
	</executions>
	</plugin>
	<!--
	commons-parent's create-source-jar execution attaches both the main sources (jar-no-fork) and the test
	sources (test-jar-no-fork) in one execution. Disable it and re-bind a main-sources-only execution, so the
	published artifact keeps the required sources jar but drops the test-sources jar.
	-->
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-source-plugin</artifactId>
	<executions>
	<execution>
	<id>create-source-jar</id>
	<phase>none</phase>
	</execution>
	<execution>
	<id>create-main-source-jar</id>
	<phase>package</phase>
	<goals>
	<goal>jar-no-fork</goal>
	</goals>
	</execution>
	</executions>
	</plugin>
	<!-- jdeps makes Saxon.HE a hard requires; flip it to static (optional). The trailing * keeps the rest. -->
	<plugin>
	<groupId>org.moditect</groupId>
	<artifactId>moditect-maven-plugin</artifactId>
	<executions>
	<execution>
	<id>add-module-infos</id>
	<configuration>
	<module>
	<moduleInfo>
	<requires>
	static Saxon.HE;
	*;
	</requires>
	</moduleInfo>
	</module>
	</configuration>
	</execution>
	</executions>
	</plugin>
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-checkstyle-plugin</artifactId>
	</plugin>
	</plugins>
	</build>
	<reporting>
	<plugins>
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-checkstyle-plugin</artifactId>
	</plugin>
	<plugin>
	<groupId>com.github.spotbugs</groupId>
	<artifactId>spotbugs-maven-plugin</artifactId>
	<configuration>
	<excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
	</configuration>
	</plugin>
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-pmd-plugin</artifactId>
	<configuration>
	<rulesets>
	<ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
	</rulesets>
	</configuration>
	</plugin>
	</plugins>
	</reporting>
	<profiles>
	<!--
	Regression guard for the generated OSGi and JPMS descriptors.
	The JPMS test requires JDK 9+
	-->
	<profile>
	<id>java11-tests</id>
	<activation>
	<jdk>[11,)</jdk>
	</activation>
	<build>
	<plugins>
	<!-- Compile the src/test/java11 source root at release 11; the default test sources stay at release 8. -->
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-compiler-plugin</artifactId>
	<executions>
	<execution>
	<id>testCompile-java11</id>
	<phase>test-compile</phase>
	<goals>
	<goal>testCompile</goal>
	</goals>
	<configuration>
	<release>11</release>
	<compileSourceRoots>
	<compileSourceRoot>${project.basedir}/src/test/java11</compileSourceRoot>
	</compileSourceRoots>
	</configuration>
	</execution>
	</executions>
	</plugin>
	<!-- Run DescriptorIT against the packaged jar; no OSGi framework or separate JPMS module needed. -->
	<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-failsafe-plugin</artifactId>
	<executions>
	<execution>
	<id>verify-descriptors</id>
	<goals>
	<goal>integration-test</goal>
	<goal>verify</goal>
	</goals>
	<configuration>
	<systemPropertyVariables>
	<buildJar>${project.build.directory}/${project.build.finalName}.jar</buildJar>
	</systemPropertyVariables>
	</configuration>
	</execution>
	</executions>
	</plugin>
	</plugins>
	</build>
	</profile>

	<!--
	Dependency versions only compatible with JDK 17+.
	-->
	<profile>
	<id>java17-dependencies</id>
	<activation>
	<jdk>[17,)</jdk>
	</activation>

	<properties>
	<commons.saxon.version>13.0</commons.saxon.version>
	</properties>
	</profile>
	</profiles>
	<developers>
	<developer>
	<id>ppkarwasz</id>
	<name>Piotr P. Karwasz</name>
	<email>pkarwasz-pom@apache.org</email>
	</developer>
	<developer>
	<id>ggregory</id>
	<name>Gary Gregory</name>
	<email>ggregory at apache.org</email>
	<url>https://www.garygregory.com</url>
	<organization>The Apache Software Foundation</organization>
	<organizationUrl>https://www.apache.org/</organizationUrl>
	<roles>
	<role>PMC Member</role>
	</roles>
	<timezone>America/New_York</timezone>
	<properties>
	<picUrl>https://people.apache.org/~ggregory/img/garydgregory80.png</picUrl>
	</properties>
	</developer>
	</developers>
	</project>