<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>com.vaadin</groupId>
        <artifactId>vaadin-platform-parent</artifactId>
        <version>25.2-SNAPSHOT</version>
    </parent>
    <artifactId>vaadin-bom</artifactId>
    <packaging>pom</packaging>
    <name>Vaadin Platform (Bill of Materials)</name>
    <description>Vaadin Platform (Bill of Materials)</description>
    <url>https://vaadin.com</url>

    <properties>
        <flow.cdi.version>16.1-SNAPSHOT</flow.cdi.version>
        <vaadin.feature.pack.version>25.0-SNAPSHOT</vaadin.feature.pack.version>
        <vaadin.testbench.version>25.2-SNAPSHOT</vaadin.testbench.version>
        <appsec.kit.starter.version>4.0-SNAPSHOT</appsec.kit.starter.version>
        <kubernetes.kit.starter.version>3.1-SNAPSHOT</kubernetes.kit.starter.version>
        <observability.kit.starter.version>4.1-SNAPSHOT</observability.kit.starter.version>
        <sso.kit.starter.version>4.1-SNAPSHOT</sso.kit.starter.version>
        <swing.kit.version>3.0-SNAPSHOT</swing.kit.version>
        <vaadin.collaboration.engine.version>7.0-SNAPSHOT</vaadin.collaboration.engine.version>

        <slf4j.version>2.0.17</slf4j.version>
        <jna.version>5.18.1</jna.version>
        <!-- Security overrides: force fixed transitive versions -->
        <logback.security.version>1.5.35</logback.security.version>
        <tomcat.security.version>11.0.24</tomcat.security.version>
        <jackson2.security.version>2.22.1</jackson2.security.version>
        <jackson3.security.version>3.1.5</jackson3.security.version>
        <kotlin.security.version>2.4.0</kotlin.security.version>
    </properties>

    <distributionManagement>
        <repository>
            <id>vaadin-prereleases</id>
            <url>https://maven.vaadin.com/vaadin-prereleases/</url>
        </repository>
    </distributionManagement>

    <dependencyManagement>
        <dependencies>
            <!--
             Security overrides. These force fixed transitive versions ahead of
             Spring Boot / Flow / Hilla management. Declared before the
             vaadin-spring-bom import so the imported BOMs win. Remove each once
             the upstream (Spring Boot, Flow, Hilla) ships the fixed version.
            -->
            <!-- jackson 2.x, CVE-2026-54515 -->
            <dependency>
                <groupId>com.fasterxml.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${jackson2.security.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- jackson 3.x, CVE-2026-54515 -->
            <dependency>
                <groupId>tools.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${jackson3.security.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- kotlin, CVE-2026-53914 -->
            <dependency>
                <groupId>org.jetbrains.kotlin</groupId>
                <artifactId>kotlin-bom</artifactId>
                <version>${kotlin.security.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- logback, CVE-2026-10532 -->
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-core</artifactId>
                <version>${logback.security.version}</version>
            </dependency>
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-classic</artifactId>
                <version>${logback.security.version}</version>
            </dependency>
            <!-- tomcat embed, CVE-2026-53434/55276/53404/55955/55956/50229 -->
            <dependency>
                <groupId>org.apache.tomcat.embed</groupId>
                <artifactId>tomcat-embed-core</artifactId>
                <version>${tomcat.security.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.tomcat.embed</groupId>
                <artifactId>tomcat-embed-el</artifactId>
                <version>${tomcat.security.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.tomcat.embed</groupId>
                <artifactId>tomcat-embed-websocket</artifactId>
                <version>${tomcat.security.version}</version>
            </dependency>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-spring-bom</artifactId>
                <version>25.2-SNAPSHOT</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-testbench-bom</artifactId>
                <version>${vaadin.testbench.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-bom</artifactId>
                <version>${slf4j.version}</version>
                <scope>import</scope>
                <type>pom</type>
            </dependency>

            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-cdi</artifactId>
                <version>${flow.cdi.version}</version>
            </dependency>

            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-feature-pack-flow</artifactId>
                <version>${vaadin.feature.pack.version}</version>
            </dependency>

            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>appsec-kit-starter</artifactId>
                <version>${appsec.kit.starter.version}</version>
            </dependency>

            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>collaboration-engine</artifactId>
                <version>${vaadin.collaboration.engine.version}</version>
            </dependency>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>kubernetes-kit-starter</artifactId>
                <version>${kubernetes.kit.starter.version}</version>
            </dependency>

            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>sso-kit-starter</artifactId>
                <version>${sso.kit.starter.version}</version>
            </dependency>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>sso-kit-starter-hilla</artifactId>
                <version>${sso.kit.starter.version}</version>
            </dependency>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>observability-kit-starter</artifactId>
                <version>${observability.kit.starter.version}</version>
            </dependency>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>observability-kit-starter-hilla</artifactId>
                <version>${observability.kit.starter.version}</version>
            </dependency>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-swing-kit-flow</artifactId>
                <version>${swing.kit.version}</version>
            </dependency>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-swing-kit-client</artifactId>
                <version>${swing.kit.version}</version>
            </dependency>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-swing-kit-client-api</artifactId>
                <version>${swing.kit.version}</version>
            </dependency>

            <!-- JNA -->
            <dependency>
                <groupId>net.java.dev.jna</groupId>
                <artifactId>jna</artifactId>
                <version>${jna.version}</version>
            </dependency>
            <dependency>
                <groupId>net.java.dev.jna</groupId>
                <artifactId>jna-platform</artifactId>
                <version>${jna.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
</project>
