pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
>
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.sitenv</groupId>
    <artifactId>referenceccdavalidator</artifactId>
    <!-- 1.1.5 is upstream's number, but this fork is not upstream 1.1.5: it carries the
         Java 17 / jakarta.servlet / Spring 6 migration and the commons-lang3 shim, none
         of which is upstream. Reporting a bare 1.1.5 therefore points at source that
         cannot build this WAR. The qualifier keeps the lineage and states the divergence.
         finalName is referenceccdaservice, so the built WAR filename is unaffected. -->
    <version>1.1.5-medplum.1</version>
    <packaging>war</packaging>
    <name>Reference CCDA Validator</name>
    <properties>
        <!-- Generic properties -->
        <java.version>17</java.version>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <!-- Must match the medplum qualifier in the medplum/ forks of those two repos.
             Upstream declares both as the literal string "latestVersion", which
             resolves an upstream-built jar out of ~/.m2 just as happily as a
             fork-built one; the qualifier makes that mixup impossible rather than
             merely documented. -->
        <code.validator.version>latestVersion-medplum.1</code.validator.version>
        <content.validator.version>latestVersion-medplum.1</content.validator.version>
        <logback.version>1.6.1</logback.version>
        <spring.version>6.2.19</spring.version>
        <jackson.version>2.22.1</jackson.version>
        <springdoc.version>2.8.17</springdoc.version>
        <!-- springdoc reads Spring Boot's autoconfigure metadata even outside
             Boot; 3.5.x is the line that pairs with Spring Framework 6.2.x. -->
        <spring.boot.version>3.5.16</spring.boot.version>
        <maven.war.plugin.version>3.5.1</maven.war.plugin.version>
    </properties>
    <repositories>
        
        <repository>
            <id>mdix</id>
            <name>a0rydvwuacqh2-artifactory-primary-0-releases</name>
            <url>https://mdix.jfrog.io/artifactory/mdmiartifactory</url>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
            <releases>
                <enabled>true</enabled>
            </releases>
        </repository>
        
        <repository>
            <id>eclipse</id>
            <url>https://repo.eclipse.org/content/groups/releases</url>
        </repository>
    </repositories>
    <dependencies>
		<!-- START MDHT DEPENDENCIES -->
        <dependency>
            <groupId>org.eclipse.emf</groupId>
            <artifactId>org.eclipse.emf.ecore.xmi</artifactId>
            <version>2.5.0.v20100521-1846</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.uml2</groupId>
            <artifactId>org.eclipse.uml2.types</artifactId>
            <version>2.0.0.v20140910-1354</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.emf</groupId>
            <artifactId>org.eclipse.emf.common</artifactId>
            <version>2.27.0</version> <!-- Use the required version -->
        </dependency>
        <dependency>
            <groupId>org.eclipse.emf</groupId>
            <artifactId>org.eclipse.emf.ecore</artifactId>
            <version>2.27.0</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.ocl</groupId>
            <artifactId>org.eclipse.ocl</artifactId>
            <version>3.6.200.v20170522</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.ocl.ecore</groupId>
            <artifactId>org.eclipse.ocl.ecore</artifactId>
            <version>3.6.200.v20170522</version>
        </dependency>
        <dependency>
            <groupId>lpg.runtime.java</groupId>
            <artifactId>lpg.runtime.java</artifactId>
            <version>2.0.17.v201004271640</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.ocl.common</groupId>
            <artifactId>org.eclipse.ocl.common</artifactId>
            <version>1.4.200.v20160613</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.mdht</groupId>
            <artifactId>org.eclipse.mdht.emf.runtime</artifactId>
            <version>3.0.0-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.mdht</groupId>
            <artifactId>org.eclipse.mdht.uml.hl7.vocab</artifactId>
            <version>3.0.0-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.mdht</groupId>
            <artifactId>org.eclipse.mdht.uml.hl7.datatypes</artifactId>
            <version>3.0.0-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.mdht</groupId>
            <artifactId>org.eclipse.mdht.uml.hl7.rim</artifactId>
            <version>3.0.0-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.mdht</groupId>
            <artifactId>org.eclipse.mdht.uml.cda</artifactId>
            <version>3.0.0-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.mdht</groupId>
            <artifactId>org.openhealthtools.mdht.uml.cda.consol2</artifactId>
            <version>3.0.0-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>org.hl7.security.ds4p</groupId>
            <artifactId>org.hl7.security.ds4p.contentprofile</artifactId>
            <version>3.0.0-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.mdht</groupId>
            <artifactId>org.openhealthtools.mdht.uml.cda.mu2consol</artifactId>
            <version>3.0.0-SNAPSHOT</version>
        </dependency>
        <!--
            commons-lang 2.6 (CVE-2025-48924) is deliberately absent. The prebuilt
            org.hl7.security.ds4p.contentprofile jar above is the only remaining consumer
            of the 2.x package, and src/main/java/org/apache/commons/lang/StringUtils.java
            covers the single method it calls by delegating to commons-lang3. See that
            class before re-adding this dependency.
        -->
		<!-- END MDHT DEPENDENCIES -->
		<!-- START VOCAB DEPENDENCIES -->
        <dependency>
            <groupId>org.sitenv.vocabulary</groupId>
            <artifactId>codevalidator-api</artifactId>
            <version>${code.validator.version}</version>
        </dependency>
        <dependency>
            <groupId>org.sitenv.vocabulary</groupId>
            <artifactId>codevalidator-api</artifactId>
            <classifier>tests</classifier>
            <version>${code.validator.version}</version>
            <type>test-jar</type>
            <scope>test</scope>
        </dependency>
		<!-- END VOCAB DEPENDENCIES -->
		<!-- START CONTENT DEPENDENCIES -->
        <dependency>
            <groupId>org.sitenv</groupId>
            <artifactId>contentvalidator-api</artifactId>
            <version>${content.validator.version}</version>
        </dependency>
		<!-- END CONTENT DEPENDENCIES -->
		<!-- Core utilities used by other modules. Define this if you use Spring Utility APIs (org.springframework.core.*/org.springframework.util.*) -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-beans</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context-support</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <exclusions>
                <exclusion>
                    <groupId>commons-logging</groupId>
                    <artifactId>commons-logging</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
		<!-- Spring MVC for Servlet Environments (depends on spring-core, spring-beans, spring-context, spring-web) Define this if you use Spring MVC with a Servlet Container such as 
            Apache Tomcat (org.springframework.web.servlet.*) -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-test</artifactId>
        </dependency>
        <!-- Replaces springfox 2.5.0, which is abandoned (last release 2020),
             carries the CVE-2019-17495 Swagger UI XSS, and cannot work with
             Spring 6 because it targets javax.servlet and Spring 5 internals.
             Outside Spring Boot, springdoc additionally needs
             spring-boot-autoconfigure on the classpath and its configuration
             classes registered by hand (see ApplicationInitializer). -->
        <dependency>
            <groupId>org.springdoc</groupId>
            <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
            <version>${springdoc.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-autoconfigure</artifactId>
            <version>${spring.boot.version}</version>
        </dependency>
        <dependency>
            <groupId>jakarta.servlet</groupId>
            <artifactId>jakarta.servlet-api</artifactId>
            <version>6.0.0</version>
            <scope>provided</scope>
        </dependency>
        <!-- jsp-api is gone: this project contains no JSPs. commons-fileupload
             is gone too : Spring 6 removed CommonsMultipartResolver, and
             StandardServletMultipartResolver uses the container's own Servlet
             multipart support instead. That drops CVE-2023-24998 and
             CVE-2025-48976 rather than upgrading around them. -->
		<!-- Versions come from jackson-bom below. jackson-annotations is
		     released on its own cadence (2.22, not 2.22.1), so pinning each
		     artifact by hand splits the Jackson version, which is its own bug. -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-core</artifactId>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-annotations</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.20.0</version>
        </dependency>
		<!-- pull in logback-core and slf4j-api -->
        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
            <version>${logback.version}</version>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.13.1</version>
            <scope>test</scope>
        </dependency>
		<!-- https://mvnrepository.com/artifact/com.squareup.okhttp3/okhttp -->
		<!-- 4.12.0 is the last 4.x line; it pulls okio 3.6.0, which clears
		     CVE-2023-3635 in the okio 2.8.0 that 4.9.2 depended on. -->
        <dependency>
            <groupId>com.squareup.okhttp3</groupId>
            <artifactId>okhttp</artifactId>
            <version>4.12.0</version>
        </dependency>
		<!-- https://mvnrepository.com/artifact/org.json/json -->
        <dependency>
            <groupId>org.json</groupId>
            <artifactId>json</artifactId>
            <version>20260719</version>
        </dependency>
    </dependencies>
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-framework-bom</artifactId>
                <version>${spring.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${jackson.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <build>
        <finalName>referenceccdaservice</finalName>
        <resources>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>true</filtering>
            </resource>
        </resources>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-eclipse-plugin</artifactId>
                <version>2.8</version>
                <configuration>
                    <wtpversion>2.0</wtpversion>
                    <downloadSources>true</downloadSources>
                    <downloadJavadocs>true</downloadJavadocs>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.15.0</version>
                <configuration>
                    <release>${java.version}</release>
                    <!-- Spring 6 dropped parameter-name discovery from debug
                         info, so @RequestParam/@Bean parameters without an
                         explicit name need -parameters to resolve. -->
                    <parameters>true</parameters>
                </configuration>
            </plugin>
            <!-- Jetty 12's ee10 module is the Servlet 6.0 flavour, matching
                 jakarta.servlet-api 6.0. The goal prefix changes with it:
                 `mvn jetty-ee10:run`, not `mvn jetty:run`. PermSize/MaxPermSize
                 were removed from the JVM in Java 8 and are dropped here. -->
            <plugin>
                <groupId>org.eclipse.jetty.ee10</groupId>
                <artifactId>jetty-ee10-maven-plugin</artifactId>
                <version>12.0.30</version>
                <configuration>
                    <scan>3</scan>
                    <jvmArgs>-Xmx5120m -Xms5120m</jvmArgs>
                    <webApp>
                        <contextPath>/referenceccdaservice</contextPath>
                    </webApp>
                </configuration>
            </plugin>
            <plugin>
                <groupId>external.atlassian.jgitflow</groupId>
                <artifactId>jgitflow-maven-plugin</artifactId>
                <version>1.0-m5.1</version>
                <configuration>
                    <noDeploy>true</noDeploy>
                    <allowUntracked>true</allowUntracked>
                    <autoVersionSubmodules>true</autoVersionSubmodules>
                    <allowSnapshots>true</allowSnapshots>
                </configuration>
            </plugin>
            <!-- tomcat7-maven-plugin was removed. It last shipped in 2013,
                 speaks the Tomcat 7 manager API, and cannot deploy a
                 jakarta.servlet WAR to Tomcat 10.1+. Deploy by dropping the
                 WAR in webapps/, or via the Tomcat 10 manager directly. -->
        </plugins>
    </build>
    <profiles>
        <profile>
            <id>mdmiartifactory</id>
            <distributionManagement>
                <repository>
                    <id>mdix</id>
                    <name>7ed03140605b-releases</name>
                    <url>http://artifactory.mdixinc.net:8082/artifactory/mdmiartifactory/libs-release</url>
                </repository>
                <snapshotRepository>
                    <id>mdix</id>
                    <name>7ed03140605b-snapshots</name>
                    <url>http://artifactory.mdixinc.net:8081/artifactory/mdmiartifactory/libs-snapshot</url>
                </snapshotRepository>
            </distributionManagement>
        </profile>
        <profile>
            <id>local</id>
            <properties>
                <logging.type>DEBUG</logging.type>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-war-plugin</artifactId>
                        <version>${maven.war.plugin.version}</version>
                        <configuration>
                            <failOnMissingWebXml>false</failOnMissingWebXml>
                            <warSourceDirectory>${project.build.directory}/${project.build.finalName}</warSourceDirectory>
                            <filters>
                                <filter>src/main/profiles/local/environment.properties</filter>
                            </filters>
                            <webResources>
                                <resource>
                                    <directory>src/main/webapp</directory>
                                    <filtering>true</filtering>
                                </resource>
                            </webResources>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>test</id>
            <properties>
                <logging.type>DEBUG</logging.type>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-war-plugin</artifactId>
                        <version>${maven.war.plugin.version}</version>
                        <configuration>
                            <failOnMissingWebXml>false</failOnMissingWebXml>
                            <warSourceDirectory>${project.build.directory}/${project.build.finalName}</warSourceDirectory>
                            <filters>
                                <filter>src/main/profiles/test/environment.properties</filter>
                            </filters>
                            <webResources>
                                <resource>
                                    <directory>src/main/webapp</directory>
                                    <filtering>true</filtering>
                                </resource>
                            </webResources>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>prod</id>
            <activation>
                <activeByDefault>true</activeByDefault>
            </activation>
            <properties>
                <logging.type>INFO</logging.type>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-war-plugin</artifactId>
                        <version>${maven.war.plugin.version}</version>
                        <configuration>
                            <failOnMissingWebXml>false</failOnMissingWebXml>
                            <warSourceDirectory>${project.build.directory}/${project.build.finalName}</warSourceDirectory>
                            <filters>
                                <filter>src/main/profiles/prod/environment.properties</filter>
                            </filters>
                            <webResources>
                                <resource>
                                    <directory>src/main/webapp</directory>
                                    <filtering>true</filtering>
                                </resource>
                            </webResources>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
			<!-- This profile will build a zip file of the war and all of the necessary artifacts to deploy the validator. -->
            <id>distribution</id>
            <properties>
                <logging.type>INFO</logging.type>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <artifactId>maven-assembly-plugin</artifactId>
                        <version>2.5.3</version>
                        <configuration>
                            <descriptors>
                                <descriptor>src/main/java/org/sitenv/referenceccda/assembly/referenceccdaapi.xml</descriptor>
                            </descriptors>
                        </configuration>
                        <executions>
                            <execution>
                                <phase>package</phase>
                                <goals>
                                    <goal>single</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-war-plugin</artifactId>
                        <version>${maven.war.plugin.version}</version>
                        <configuration>
                            <failOnMissingWebXml>false</failOnMissingWebXml>
                            <warSourceDirectory>${project.build.directory}/${project.build.finalName}</warSourceDirectory>
                            <packagingExcludes>**/context.xml</packagingExcludes>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
			<!-- This profile copies the war over to a local tomcat webapps folder (specified in properties) after the build is run -->
            <id>webapps</id>
            <properties>
                <logging.type>INFO</logging.type>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>properties-maven-plugin</artifactId>
                        <version>1.0.0</version>
                        <executions>
                            <execution>
                                <phase>initialize</phase>
                                <goals>
                                    <goal>read-project-properties</goal>
                                </goals>
                                <configuration>
                                    <files>
                                        <file>src/main/profiles/webapps/environment.properties</file>
                                    </files>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-war-plugin</artifactId>
                        <version>${maven.war.plugin.version}</version>
                        <configuration>
                            <failOnMissingWebXml>false</failOnMissingWebXml>
                            <warSourceDirectory>${project.build.directory}/${project.build.finalName}</warSourceDirectory>
                            <filters>
                                <filter>src/main/profiles/webapps/environment.properties</filter>
                            </filters>
                            <webResources>
                                <resource>
                                    <directory>src/main/webapp</directory>
                                    <filtering>true</filtering>
                                </resource>
                            </webResources>
                            <outputDirectory>${local.tomcat.webapps.directory}</outputDirectory>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>