<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>org.atmosphere</groupId>
    <artifactId>atmosphere-project</artifactId>
    <packaging>pom</packaging>
    <name>atmosphere-project</name>
    <description>Atmosphere Framework</description>
    <version>4.0.44</version>
    <url>https://github.com/Atmosphere/atmosphere</url>
    <scm>
        <connection>scm:git:git@github.com:Atmosphere/atmosphere.git</connection>
        <developerConnection>scm:git:git@github.com:Atmosphere/atmosphere.git</developerConnection>
        <url>https://github.com/Atmosphere/atmosphere</url>
     <tag>HEAD</tag>
  </scm>
    <developers>
        <developer>
            <id>jfarcand</id>
            <name>Jeanfrancois Arcand</name>
            <email>jfarcand@apache.org</email>
        </developer>
        <developer>
            <id>psandoz</id>
            <name>Paul Sandoz</name>
        </developer>
        <developer>
            <id>neotyk</id>
            <name>Hubert Iwaniuk</name>
        </developer>
        <developer>
            <id>slovdahl</id>
            <name>Sebastian Lövdahl</name>
        </developer>
    </developers>
    <issueManagement>
        <system>GitHub Issues</system>
        <url>https://github.com/Atmosphere/atmosphere/issues</url>
    </issueManagement>
    <mailingLists>
        <mailingList>
            <name>atmosphere Dev List</name>
            <archive>https://groups.google.com/group/atmosphere-framework</archive>
        </mailingList>
        <mailingList>
            <name>atmosphere Support List</name>
            <archive>https://groups.google.com/group/atmosphere-framework</archive>
        </mailingList>
    </mailingLists>
    <licenses>
        <license>
            <name>Apache License 2.0</name>
            <url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
            <distribution>repo</distribution>
        </license>
    </licenses>
    <distributionManagement>
        <snapshotRepository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots/</url>
        </snapshotRepository>
    </distributionManagement>
    <build>
        <sourceDirectory>src/main/java</sourceDirectory>
        <scriptSourceDirectory>src/main/scripts</scriptSourceDirectory>
        <testSourceDirectory>src/test/java</testSourceDirectory>
        <outputDirectory>target/classes</outputDirectory>
        <testOutputDirectory>target/test-classes</testOutputDirectory>
        <defaultGoal>install</defaultGoal>
        <resources>
            <resource>
                <directory>src/main/resources</directory>
            </resource>
        </resources>
        <testResources>
            <testResource>
                <directory>src/test/resources</directory>
            </testResource>
        </testResources>
        <directory>target</directory>
        <finalName>${project.artifactId}-${project.version}</finalName>
        <plugins>
            <plugin>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.15.0</version>
                <configuration>
                    <release>21</release>
                    <showWarnings>true</showWarnings>
                    <compilerArgs>
                        <arg>-Xlint:all,-processing,-serial</arg>
                        <arg>-Werror</arg>
                        <arg>-parameters</arg>
                    </compilerArgs>
                </configuration>
                <dependencies>
                    <!-- Override vulnerable plexus-utils 4.0.2 from plexus-compiler-javac (CVE GHSA-4gpf-vj5f-4c6h) -->
                    <dependency>
                        <groupId>org.codehaus.plexus</groupId>
                        <artifactId>plexus-utils</artifactId>
                        <version>4.0.3</version>
                    </dependency>
                </dependencies>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.5.0</version>
                <executions>
                    <execution>
                        <id>enforce-maven</id>
                        <goals><goal>enforce</goal></goals>
                        <configuration>
                            <rules>
                                <requireMavenVersion>
                                    <version>3.6.3</version>
                                </requireMavenVersion>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
                <dependencies>
                    <!-- Override vulnerable plexus-utils 4.0.1 (CVE GHSA-4gpf-vj5f-4c6h) -->
                    <dependency>
                        <groupId>org.codehaus.plexus</groupId>
                        <artifactId>plexus-utils</artifactId>
                        <version>4.0.3</version>
                    </dependency>
                </dependencies>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <version>3.2.0</version>
                <configuration>
                    <archive>
                        <manifestEntries>
                            <mode>development</mode>
                            <url>${project.url}</url>
                            <implementation-version>${project.version}</implementation-version>
                            <package>org.atmosphere</package>
                            <Automatic-Module-Name>${atmosphere.module.name}</Automatic-Module-Name>
                        </manifestEntries>
                    </archive>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-site-plugin</artifactId>
                <version>3.10.0</version>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-deploy-plugin</artifactId>
                <version>3.1.2</version>
                <configuration>
                    <skip>${maven.deploy.skip}</skip>
                </configuration>
                <dependencies>
                    <!-- Override vulnerable plexus-utils 4.0.1 (CVE GHSA-4gpf-vj5f-4c6h) -->
                    <dependency>
                        <groupId>org.codehaus.plexus</groupId>
                        <artifactId>plexus-utils</artifactId>
                        <version>4.0.3</version>
                    </dependency>
                </dependencies>
            </plugin>
            <plugin>
                <artifactId>maven-clean-plugin</artifactId>
                <version>3.1.0</version>
                <configuration>
                    <filesets>
                        <fileset>
                            <directory>${project.basedir}/work</directory>
                        </fileset>
                        <fileset>
                            <directory>${project.basedir}/overlays</directory>
                        </fileset>
                        <fileset>
                            <directory>${project.basedir}</directory>
                            <includes>
                                <include>*.log</include>
                                <include>dependency-reduced-pom.xml</include>
                            </includes>
                        </fileset>
                    </filesets>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-resources-plugin</artifactId>
                <version>3.5.0</version>
                <dependencies>
                    <!-- Override vulnerable plexus-utils 4.0.1 (CVE GHSA-4gpf-vj5f-4c6h) -->
                    <dependency>
                        <groupId>org.codehaus.plexus</groupId>
                        <artifactId>plexus-utils</artifactId>
                        <version>4.0.3</version>
                    </dependency>
                </dependencies>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.5.4</version>
                <configuration>
                    <forkCount>1</forkCount>
                    <reuseForks>false</reuseForks>
                    <forkedProcessTimeoutInSeconds>300</forkedProcessTimeoutInSeconds>
                    <argLine>-Djdk.attach.allowAttachSelf=true --add-opens java.base/java.util.concurrent.locks=ALL-UNNAMED --add-opens java.base/java.util.concurrent=ALL-UNNAMED</argLine>
                    <excludes>
                    </excludes>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>3.6.0</version>
                <dependencies>
                    <dependency>
                        <groupId>com.puppycrawl.tools</groupId>
                        <artifactId>checkstyle</artifactId>
                        <version>10.21.4</version>
                    </dependency>
                </dependencies>
                <configuration>
                    <includeResources>false</includeResources>
                </configuration>
                <executions>
                    <execution>
                        <id>validate</id>
                        <phase>validate</phase>
                        <configuration>
                            <configLocation>${maven.multiModuleProjectDirectory}/config/atmosphere-checkstyle.xml</configLocation>
                            <consoleOutput>true</consoleOutput>
                            <failsOnError>true</failsOnError>
                            <linkXRef>false</linkXRef>
                            <suppressionsLocation>${maven.multiModuleProjectDirectory}/config/atmosphere-checkstyle-suppressions.xml</suppressionsLocation>
                            <sourceDirectories>${basedir}/src</sourceDirectories>
                        </configuration>
                        <goals>
                            <goal>checkstyle</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <version>3.28.0</version>
                <configuration>
                    <rulesets>
                        <ruleset>${maven.multiModuleProjectDirectory}/config/atmosphere-pmd-ruleset.xml</ruleset>
                    </rulesets>
                    <targetJdk>21</targetJdk>
                    <linkXRef>false</linkXRef>
                    <includeTests>true</includeTests>
                    <verbose>true</verbose>
                </configuration>
                <executions>
                    <execution>
                        <id>validate</id>
                        <phase>validate</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-eclipse-plugin</artifactId>
                    <version>2.10</version>
                </plugin>
                <!--This plugin's configuration is used to store Eclipse/VS Code m2e settings only.
                    It has no influence on the Maven build itself. -->
                <plugin>
                    <groupId>org.eclipse.m2e</groupId>
                    <artifactId>lifecycle-mapping</artifactId>
                    <version>1.0.0</version>
                    <configuration>
                        <lifecycleMappingMetadata>
                            <pluginExecutions>
                                <pluginExecution>
                                    <pluginExecutionFilter>
                                        <groupId>org.apache.maven.plugins</groupId>
                                        <artifactId>maven-checkstyle-plugin</artifactId>
                                        <versionRange>[3.0,)</versionRange>
                                        <goals>
                                            <goal>checkstyle</goal>
                                        </goals>
                                    </pluginExecutionFilter>
                                    <action>
                                        <ignore />
                                    </action>
                                </pluginExecution>
                                <pluginExecution>
                                    <pluginExecutionFilter>
                                        <groupId>org.apache.maven.plugins</groupId>
                                        <artifactId>maven-pmd-plugin</artifactId>
                                        <versionRange>[3.0,)</versionRange>
                                        <goals>
                                            <goal>check</goal>
                                            <goal>pmd</goal>
                                        </goals>
                                    </pluginExecutionFilter>
                                    <action>
                                        <ignore />
                                    </action>
                                </pluginExecution>
                                <pluginExecution>
                                    <pluginExecutionFilter>
                                        <groupId>org.apache.maven.plugins</groupId>
                                        <artifactId>maven-dependency-plugin</artifactId>
                                        <versionRange>[2.0,)</versionRange>
                                        <goals>
                                            <goal>unpack</goal>
                                        </goals>
                                    </pluginExecutionFilter>
                                    <action>
                                        <ignore />
                                    </action>
                                </pluginExecution>
                            </pluginExecutions>
                        </lifecycleMappingMetadata>
                    </configuration>
                </plugin>
            </plugins>
        </pluginManagement>
    </build>
    <profiles>
        <profile>
            <!-- Default deploy mechanism: Sonatype's central-publishing-maven-plugin.
                 Active by default; deactivate with `-P!central-publishing` when using
                 JReleaser (which stages artifacts locally and uploads separately). -->
            <id>central-publishing</id>
            <activation>
                <activeByDefault>true</activeByDefault>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.sonatype.central</groupId>
                        <artifactId>central-publishing-maven-plugin</artifactId>
                        <version>0.9.0</version>
                        <extensions>true</extensions>
                        <configuration>
                            <publishingServerId>central</publishingServerId>
                            <autoPublish>true</autoPublish>
                            <skipPublishing>${skipCentralPublishing}</skipPublishing>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <!-- JReleaser deploy mode: deactivates central-publishing, stages
                 artifacts locally via altDeploymentRepository. JReleaser then
                 uploads from target/staging-deploy to Maven Central with
                 configurable POM validation (tolerates intermediate parents). -->
            <id>jreleaser</id>
            <properties>
                <maven.deploy.skip>false</maven.deploy.skip>
            </properties>
        </profile>
        <profile>
            <id>fastinstall</id>
            <properties>
                <maven.test.skip>true</maven.test.skip>
                <pmd.skip>true</pmd.skip>
                <checkstyle.skip>true</checkstyle.skip>
            </properties>
        </profile>
        <profile>
            <id>release-profile</id>
            <properties>
                <skipTests>true</skipTests>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <inherited>true</inherited>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-source-plugin</artifactId>
                        <version>3.2.1</version>
                        <executions>
                            <execution>
                                <id>attach-sources</id>
                                <goals>
                                    <goal>jar</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-javadoc-plugin</artifactId>
                        <version>3.3.1</version>
                        <configuration>
                            <aggregate>true</aggregate>
                            <source>21</source>
                            <encoding>UTF-8</encoding>
                            <maxmemory>1g</maxmemory>
                            <doclint>none</doclint>
                            <failOnError>false</failOnError>
                            <failOnWarnings>false</failOnWarnings>
                            <links>
                                <link>https://docs.oracle.com/en/java/javase/21/docs/api/</link>
                            </links>
                        </configuration>
                        <executions>
                            <execution>
                                <id>attach-javadocs</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>jar</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>build-helper-maven-plugin</artifactId>
                        <version>3.3.0</version>
                        <executions>
                            <execution>
                                <id>add-source</id>
                                <phase>prepare-package</phase>
                                <goals>
                                    <goal>add-source</goal>
                                </goals>
                                <configuration>
                                    <sources>
                                        <source>src/main/webapp</source>
                                    </sources>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>3.0.1</version>
                        <configuration>
                            <gpgArguments>
                                <arg>--pinentry-mode</arg>
                                <arg>loopback</arg>
                            </gpgArguments>
                        </configuration>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>release-sign-artifacts</id>
            <activation>
                <property>
                    <name>performRelease</name>
                    <value>true</value>
                </property>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>3.0.1</version>
                        <configuration>
                            <gpgArguments>
                                <arg>--pinentry-mode</arg>
                                <arg>loopback</arg>
                            </gpgArguments>
                        </configuration>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>deploy-source</id>
            <properties>
                <skipTests>true</skipTests>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <inherited>true</inherited>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-source-plugin</artifactId>
                        <version>3.2.1</version>
                        <executions>
                            <execution>
                                <id>attach-sources</id>
                                <goals>
                                    <goal>jar</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-javadoc-plugin</artifactId>
                        <version>3.3.1</version>
                        <configuration>
                            <aggregate>true</aggregate>
                            <source>21</source>
                            <encoding>UTF-8</encoding>
                            <maxmemory>1g</maxmemory>
                            <doclint>none</doclint>
                            <links>
                                <link>https://docs.oracle.com/en/java/javase/21/docs/api/</link>
                            </links>
                        </configuration>
                        <executions>
                            <execution>
                                <id>attach-javadocs</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>jar</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>deploy-snapshot</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-deploy-plugin</artifactId>
                        <version>3.1.2</version>
                        <configuration>
                            <skip>false</skip>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
    <repositories>
        <!-- Maven Central explicitly first. As soon as any <repositories>
             block exists, Central's implicit position is lost — Maven
             queries the listed repos in declaration order. embabel-releases
             below has 401-on-anonymous for non-embabel artifacts; without
             this, Maven asks Embabel before Central for every dep and
             fails when Embabel rejects the request (CI: Samples 170fa3f). -->
        <repository>
            <id>central</id>
            <url>https://repo.maven.apache.org/maven2</url>
            <releases><enabled>true</enabled></releases>
            <snapshots><enabled>false</enabled></snapshots>
        </repository>
        <repository>
            <id>embabel-releases</id>
            <url>https://repo.embabel.com/artifactory/libs-release</url>
            <releases><enabled>true</enabled></releases>
            <snapshots><enabled>false</enabled></snapshots>
        </repository>
        <repository>
            <id>spring-milestones</id>
            <url>https://repo.spring.io/milestone</url>
            <snapshots><enabled>false</enabled></snapshots>
        </repository>
    </repositories>
    <modules>
        <module>bom</module>
        <module>modules</module>
        <module>assembly</module>
        <module>samples/chat</module>
        <module>samples/embedded-jetty-websocket-chat</module>
        <module>samples/spring-boot-chat</module>
        <module>samples/quarkus-chat</module>
        <module>samples/quarkus-ai-chat</module>
        <module>samples/spring-boot-ai-chat</module>
        <module>samples/spring-boot-ai-classroom</module>
        <module>samples/spring-boot-ms-governance-chat</module>
        <module>samples/spring-boot-otel-chat</module>
        <module>samples/spring-boot-mcp-server</module>
        <module>samples/spring-boot-durable-sessions</module>
        <module>samples/spring-boot-reattach-harness</module>
        <module>samples/spring-boot-ai-tools</module>
        <module>samples/spring-boot-rag-chat</module>
        <module>samples/grpc-chat</module>
        <module>samples/spring-boot-a2a-agent</module>
        <module>samples/spring-boot-agui-chat</module>
        <module>samples/spring-boot-channels-chat</module>
        <module>samples/spring-boot-dentist-agent</module>
        <module>samples/spring-boot-multi-agent-startup-team</module>
        <module>samples/spring-boot-orchestration-demo</module>
        <module>samples/spring-boot-checkpoint-agent</module>
        <module>samples/spring-boot-personal-assistant</module>
        <module>samples/spring-boot-coding-agent</module>
        <module>samples/spring-boot-guarded-email-agent</module>
        <module>modules/integration-tests</module>
    </modules>
    <reporting>
        <outputDirectory>target/site</outputDirectory>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>3.3.1</version>
                <configuration>
                    <aggregate>true</aggregate>
                    <debug>true</debug>
                    <doclint>none</doclint>
                    <links>
                        <link>https://jakarta.ee/specifications/platform/9/apidocs/</link>
                        <link>https://docs.oracle.com/en/java/javase/21/docs/api/</link>
                    </links>
                    <excludePackageNames>cometedgwt:org.gwtcomet:com.sun:org.apache:weblogic:org.jboss
                    </excludePackageNames>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jxr-plugin</artifactId>
                <version>3.6.0</version>
                <configuration>
                    <aggregate>true</aggregate>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
                <version>3.1.2</version>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>project-team</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>
        </plugins>
    </reporting>
    <dependencyManagement>
        <dependencies>
            <!-- Atmosphere modules — centralized version management -->
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-runtime</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-ai</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-mcp</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-mcp-client</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-a2a</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-agui</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-spring-ai</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-langchain4j</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-embabel</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-adk</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-koog</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-agentscope</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-spring-ai-alibaba</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-quarkus-langchain4j</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-quarkus-langchain4j-deployment</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-semantic-kernel</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-rag</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-redis</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-kafka</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-grpc</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-durable-sessions</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-durable-sessions-sqlite</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-durable-sessions-redis</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-kotlin</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-spring-boot-starter</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-spring-boot3-starter</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-agent</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-coordinator</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-admin</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-checkpoint</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-channels</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-quarkus-extension</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-quarkus-extension-deployment</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-quarkus-admin-extension</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-quarkus-admin-extension-deployment</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-wasync</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-ai-test</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-protocol-common</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.atmosphere</groupId>
                <artifactId>atmosphere-skills</artifactId>
                <version>${project.version}</version>
            </dependency>

            <!-- Third-party -->
            <!-- Pin plexus-utils to patched version (CVE GHSA-4gpf-vj5f-4c6h, Dependabot #171).
                 Plugins like maven-enforcer-plugin, maven-compiler-plugin transitively bring
                 in 4.0.1/4.0.2 which have a directory traversal vulnerability in extractFile(). -->
            <dependency>
                <groupId>org.codehaus.plexus</groupId>
                <artifactId>plexus-utils</artifactId>
                <version>4.0.3</version>
            </dependency>
            <dependency>
                <groupId>org.apache.maven</groupId>
                <artifactId>maven-plugin-tools-api</artifactId>
                <version>3.6.4</version>
            </dependency>
            <dependency>
                <groupId>jakarta.websocket</groupId>
                <artifactId>jakarta.websocket-api</artifactId>
                <version>${jakarta-websocket-api.version}</version>
            </dependency>
            <dependency>
                <groupId>jakarta.inject</groupId>
                <artifactId>jakarta.inject-api</artifactId>
                <version>${jakarta-inject-api.version}</version>
            </dependency>
            <dependency>
                <groupId>io.opentelemetry</groupId>
                <artifactId>opentelemetry-api</artifactId>
                <version>${opentelemetry-api.version}</version>
            </dependency>
            <dependency>
                <groupId>jakarta.enterprise</groupId>
                <artifactId>jakarta.enterprise.cdi-api</artifactId>
                <version>${jakarta-enterprise-cdi-api.version}</version>
            </dependency>
            <!-- Pin Bouncy Castle over docker-java-core's transitive 1.82
                 (carries GHSA-t5c0-jh73-xrrh LDAP injection + GHSA-4xfg-p6qx-qm55
                 risky-crypto). Forces 1.84+ into the resolved dep tree. -->
            <dependency>
                <groupId>org.bouncycastle</groupId>
                <artifactId>bcprov-jdk18on</artifactId>
                <version>${bouncycastle.version}</version>
            </dependency>
            <dependency>
                <groupId>org.bouncycastle</groupId>
                <artifactId>bcpkix-jdk18on</artifactId>
                <version>${bouncycastle.version}</version>
            </dependency>
            <dependency>
                <groupId>org.bouncycastle</groupId>
                <artifactId>bcutil-jdk18on</artifactId>
                <version>${bouncycastle.version}</version>
            </dependency>
            <dependency>
                <groupId>io.micrometer</groupId>
                <artifactId>micrometer-core</artifactId>
                <version>${micrometer.version}</version>
            </dependency>
            <dependency>
                <groupId>io.micrometer</groupId>
                <artifactId>micrometer-commons</artifactId>
                <version>${micrometer.version}</version>
            </dependency>
            <dependency>
                <groupId>io.micrometer</groupId>
                <artifactId>micrometer-observation</artifactId>
                <version>${micrometer.version}</version>
            </dependency>
            <dependency>
                <groupId>io.micrometer</groupId>
                <artifactId>micrometer-jakarta9</artifactId>
                <version>${micrometer.version}</version>
            </dependency>
            <dependency>
                <groupId>org.mockito.kotlin</groupId>
                <artifactId>mockito-kotlin</artifactId>
                <version>${mockito-kotlin.version}</version>
            </dependency>
            <dependency>
                <groupId>org.testcontainers</groupId>
                <artifactId>testcontainers</artifactId>
                <version>${testcontainers.version}</version>
            </dependency>
            <dependency>
                <groupId>org.testcontainers</groupId>
                <artifactId>kafka</artifactId>
                <version>${testcontainers.version}</version>
            </dependency>
            <dependency>
                <groupId>org.awaitility</groupId>
                <artifactId>awaitility</artifactId>
                <version>${awaitility.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.tomcat</groupId>
                <artifactId>annotations-api</artifactId>
                <version>${tomcat-annotations-api.version}</version>
            </dependency>
            <dependency>
                <groupId>io.grpc</groupId>
                <artifactId>grpc-netty-shaded</artifactId>
                <version>${grpc.version}</version>
            </dependency>
            <dependency>
                <groupId>io.grpc</groupId>
                <artifactId>grpc-protobuf</artifactId>
                <version>${grpc.version}</version>
            </dependency>
            <dependency>
                <groupId>io.grpc</groupId>
                <artifactId>grpc-stub</artifactId>
                <version>${grpc.version}</version>
            </dependency>
            <dependency>
                <groupId>io.grpc</groupId>
                <artifactId>grpc-services</artifactId>
                <version>${grpc.version}</version>
            </dependency>
            <dependency>
                <groupId>io.grpc</groupId>
                <artifactId>grpc-inprocess</artifactId>
                <version>${grpc.version}</version>
            </dependency>
            <dependency>
                <groupId>io.grpc</groupId>
                <artifactId>grpc-testing</artifactId>
                <version>${grpc.version}</version>
            </dependency>
            <!-- Keep protobuf-java / protobuf-java-util aligned with the protoc
                 compiler (${protobuf.version}); otherwise the generated sources
                 target a newer API than the transitive runtime grpc-protobuf
                 pulls in, and the build fails with "cannot find symbol
                 com.google.protobuf.RuntimeVersion". -->
            <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protobuf-java</artifactId>
                <version>${protobuf.version}</version>
            </dependency>
            <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protobuf-java-util</artifactId>
                <version>${protobuf.version}</version>
            </dependency>
            <!-- Jackson 3.x needs jackson-annotations >= 2.21 for JsonSerializeAs;
                 override Spring Boot BOMs which may pin an older version -->
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-annotations</artifactId>
                <version>${jackson-annotations.version}</version>
            </dependency>
            <!-- Override MCP SDK transitive version to fix CVE-2026-35568 (DNS Rebinding) -->
            <dependency>
                <groupId>io.modelcontextprotocol.sdk</groupId>
                <artifactId>mcp-core</artifactId>
                <version>1.0.0</version>
            </dependency>
            <dependency>
                <groupId>io.modelcontextprotocol.sdk</groupId>
                <artifactId>mcp</artifactId>
                <version>1.1.1</version>
            </dependency>
            <!-- SnakeYAML — declared here so downstream consumers of
                 atmosphere-ai resolve the version through this BOM-style
                 management rather than the variable reference that's
                 unresolvable once atmosphere-ai's pom is installed. -->
            <dependency>
                <groupId>org.yaml</groupId>
                <artifactId>snakeyaml</artifactId>
                <version>${snakeyaml.version}</version>
            </dependency>

            <!-- CVE force-pins. These deps are pulled transitively through
                 Spring/Quarkus/AWS/Tomcat BOMs that occasionally trail their
                 own published patched versions. Pinning at the parent-POM
                 dependencyManagement level overrides the transitive choice
                 in every leaf module reactor-wide. -->
            <dependency>
                <!-- Tomcat 11.0.20 had GHSA-x4m4-345f-5h5g, GHSA-rv64-5gf8-9qq8,
                     GHSA-24j9-x2wg-9qv6 (info disclosure / log encoding /
                     escape). Fixed in 11.0.21. -->
                <groupId>org.apache.tomcat.embed</groupId>
                <artifactId>tomcat-embed-core</artifactId>
                <version>${tomcat-version}</version>
            </dependency>
            <dependency>
                <!-- commons-lang3 < 3.18.0: CVE-2025-48924 uncontrolled
                     recursion / DoS on long inputs. -->
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-lang3</artifactId>
                <version>${commons-lang3.version}</version>
            </dependency>
            <dependency>
                <!-- Jackson 2 (com.fasterxml.*) is transitive only; the project
                     itself uses Jackson 3 (tools.jackson.*). Force-pin so the
                     transitive Jackson 2 is at the patched version (2.21.1+
                     fixes GHSA-72hv-8253-57qq async-parser DoS). -->
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-core</artifactId>
                <version>${jackson2.version}</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
                <version>${jackson2.version}</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-annotations</artifactId>
                <version>${jackson2.version}</version>
            </dependency>
            <!-- NOTE: spring-webflux is intentionally NOT force-pinned here.
                 Globally pinning to 6.2.17 (the patched 6.x) drags Spring 6's
                 webflux into modules using Spring 7 (Spring Boot 4) and
                 fails with IncompatibleClassChangeError on HttpHeaders /
                 Map at startup, since Spring 7's HttpHeaders no longer
                 implements Map. The 6.2.x CVE alerts (CVE-2026-22735 /
                 -22737) only affect consumers actually on the 6.2.x branch;
                 the Spring Boot 4 BOM resolves 7.x webflux which is
                 unaffected. If a sample/test pulls in 6.2.x via a different
                 BOM, fix it by upgrading that BOM, not by force-pinning here. -->
        </dependencies>
    </dependencyManagement>
    <!-- All dependencies are available on Maven Central. Legacy repositories
         (Codehaus, maven.java.net, JBoss Nexus, Sonatype) removed during Java 21 upgrade. -->
    <dependencies>
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>${junit-jupiter.version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter-params</artifactId>
            <version>${junit-jupiter.version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>com.ning</groupId>
            <artifactId>async-http-client</artifactId>
            <version>${ahc.version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>${slf4j-version}</version>
        </dependency>

        <!-- Move to individual modules / plugins / samples as appropriate -->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>jul-to-slf4j</artifactId>
            <version>${slf4j-impl-version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>jcl-over-slf4j</artifactId>
            <version>${slf4j-impl-version}</version>
            <scope>test</scope>
        </dependency>

        <!-- runtime logging implementation, test only -->
        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-core</artifactId>
            <version>${logback-version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
            <version>${logback-version}</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <skipCentralPublishing>false</skipCentralPublishing>
        <maven.deploy.skip>true</maven.deploy.skip>
        <maven-plugin.version>1.0.0</maven-plugin.version>
        <servlet-version-range>6.0.0</servlet-version-range>
        <jetty-version>12.0.33</jetty-version>
        <tomcat-version>11.0.21</tomcat-version>
        <shade-version>1.2.1</shade-version>
        <bnd-maven-plugin.version>7.2.3</bnd-maven-plugin.version>
        <ahc.version>1.9.40</ahc.version>
        <jakarta-servlet-api.version>5.0.0</jakarta-servlet-api.version>
        <jakarta-websocket-api.version>2.0.0</jakarta-websocket-api.version>
        <jakarta-inject-api.version>2.0.1</jakarta-inject-api.version>
        <opentelemetry-api.version>1.46.0</opentelemetry-api.version>
        <slf4j-impl-version>2.0.17</slf4j-impl-version>
        <slf4j-version>2.0.17</slf4j-version>
        <logback-version>1.5.25</logback-version>
        <commons-pool2>2.12.0</commons-pool2>
        <junit-jupiter.version>5.11.4</junit-jupiter.version>
        <jackson.version>3.1.1</jackson.version>
        <!-- Jackson 2 force-pin (CVE force-pin block in dependencyManagement).
             Jackson 2 enters the dep tree transitively via Spring/Quarkus/AWS;
             we don't compile against it. 2.21.2 closes GHSA-72hv-8253-57qq. -->
        <jackson2.version>2.21.2</jackson2.version>
        <jackson-annotations.version>2.21</jackson-annotations.version>
        <commons-lang3.version>3.18.0</commons-lang3.version>
        <snakeyaml.version>2.3</snakeyaml.version>
        <mockito.version>5.23.0</mockito.version>
        <mockito-kotlin.version>5.4.0</mockito-kotlin.version>
        <!-- Pin Bouncy Castle >= 1.84 to override docker-java-core's transitive
             1.82, which carries an LDAP injection (GHSA) and a risky-crypto
             advisory. Provided-scope only (DockerSandboxProvider uses
             docker-java), but the advisory closes cleanly on 1.84+. -->
        <bouncycastle.version>1.84</bouncycastle.version>
        <micrometer.version>1.16.5</micrometer.version>
        <jakarta-enterprise-cdi-api.version>4.1.0</jakarta-enterprise-cdi-api.version>
        <testcontainers.version>1.20.6</testcontainers.version>
        <awaitility.version>4.2.2</awaitility.version>
        <grpc.version>1.80.0</grpc.version>
        <protobuf.version>4.34.1</protobuf.version>
        <tomcat-annotations-api.version>6.0.53</tomcat-annotations-api.version>
        <os-maven-plugin.version>1.7.1</os-maven-plugin.version>
        <protobuf-maven-plugin.version>0.6.1</protobuf-maven-plugin.version>
        <maven-shade-plugin.version>3.6.2</maven-shade-plugin.version>
        <maven-install-plugin.version>3.1.4</maven-install-plugin.version>
        <lettuce.version>6.5.5.RELEASE</lettuce.version>
        <spring-boot.version>4.0.6</spring-boot.version>
        <!-- Override Spring Boot 4.0.6's netty 4.2.12.Final pin to 4.2.13.Final
             which patches CVE-2025-58056 (netty-codec-http) and the linked
             4.2.x DoS family. spring-boot-dependencies reads ${netty.version}
             from caller properties, so this win precedence over the BOM pin
             without forcing a netty-bom import. -->
        <netty.version>4.2.13.Final</netty.version>
        <quarkus.version>3.35.2</quarkus.version>
        <atmosphere.module.name>org.atmosphere</atmosphere.module.name>
        <!-- AI framework versions (single source of truth) -->
        <spring-ai.version>2.0.0-M2</spring-ai.version>
        <embabel.version>0.3.5</embabel.version>
        <google-adk.version>1.2.0</google-adk.version>
        <koog.version>0.8.0</koog.version>
        <agentscope.version>1.0.12</agentscope.version>
        <spring-ai-alibaba.version>1.1.2.2</spring-ai-alibaba.version>
        <!-- Quarkus LangChain4j 1.9.2 ships LangChain4j 1.13.0 transitively;
             our parent already pins langchain4j 1.12.2 (compatible minor). -->
        <quarkus-langchain4j.version>1.9.2</quarkus-langchain4j.version>
        <!-- Spring AI Alibaba 1.1.2.0 is compiled against Spring AI 1.1.2 (the
             current stable line, distinct from the unreleased 2.0.0-Mx
             milestones we use elsewhere). The overlay pins the OpenAI starter
             to this matched version so spring-ai-alibaba-agent-framework's
             transitive RetryUtils.DEFAULT_RETRY_TEMPLATE binding resolves. -->
        <spring-ai-alibaba-spring-ai.version>1.1.2</spring-ai-alibaba-spring-ai.version>
        <langchain4j.version>1.14.0</langchain4j.version>
    </properties>
</project>
