<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>com.vaadin</groupId>
        <artifactId>vaadin-platform-parent</artifactId>
        <version>24.10-SNAPSHOT</version>
    </parent>

    <artifactId>vaadin-spring-boot-starter</artifactId>
    <name>Spring Boot Starter</name>
    <description>Spring Boot Starter for Vaadin Flow applications.</description>

    <repositories>
        <!-- The order of definitions matters. Explicitly defining central here to make sure it has the highest priority. -->

        <!-- Main Maven repository -->
        <repository>
            <id>central</id>
            <url>https://repo.maven.apache.org/maven2</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
        <repository>
            <id>vaadin-prereleases</id>
            <url>https://maven.vaadin.com/vaadin-prereleases</url>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
        </repository>
    </repositories>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-spring-bom</artifactId>
                <type>pom</type>
                <scope>import</scope>
                <version>${project.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>vaadin-spring</artifactId>
        </dependency>
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>vaadin-core</artifactId>
        </dependency>
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>hilla</artifactId>
        </dependency>

        <!-- Spring -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <version>${spring.boot.version}</version>
            <!-- CVE-2022-1471 TEMPORARY FIX UNTIL https://github.com/spring-projects/spring-boot/issues/33457 -->
            <exclusions>
                <exclusion>
                    <groupId>org.yaml</groupId>
                    <artifactId>snakeyaml</artifactId>
                </exclusion>
                <!-- log4j-to-slf4j 2.24.3 (pinned by spring-boot ${spring.boot.version}) is reported
                     vulnerable to CVE-2026-34478, CVE-2026-34480, CVE-2025-68161, CVE-2026-34481.
                     Exclude it here and pin a non-vulnerable version below. Remove this workaround
                     once spring-boot bumps its log4j2.version past the affected range. -->
                <exclusion>
                    <groupId>org.apache.logging.log4j</groupId>
                    <artifactId>log4j-to-slf4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <!-- Pinned to override the vulnerable 2.24.3 transitively pulled by spring-boot-starter-logging.
             See the exclusion above. Drop this once spring-boot bumps log4j2.version. -->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-to-slf4j</artifactId>
            <version>2.25.4</version>
        </dependency>
        <!-- End Spring -->
    </dependencies>
</project>
