From 7bcde5d43956acf119b16bd5ac9544eb58c479f6 Mon Sep 17 00:00:00 2001
From: Jeremy Long <jeremy.long@gmail.com>
Date: Mon, 27 Nov 2017 21:14:34 -0500
Subject: [PATCH] move non-test dependency version numbers to properties

---
 dependency-check-core/pom.xml  |   3 +-
 dependency-check-maven/pom.xml |  17 +++--
 pom.xml                        | 127 ++++++++++++++++++++++++---------
 3 files changed, 104 insertions(+), 43 deletions(-)

diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml
index be1c2cd6e..3df269715 100644
--- a/dependency-check-core/pom.xml
+++ b/dependency-check-core/pom.xml
@@ -248,7 +248,8 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
             <groupId>com.google.code.gson</groupId>
             <artifactId>gson</artifactId>
         </dependency>
-        <!-- The following dependencies are only used during testing -->
+        <!-- The following dependencies are only used during testing 
+             and must not be converted to a properties based version number -->
         <dependency>
             <groupId>org.apache.maven.scm</groupId>
             <artifactId>maven-scm-provider-cvsexe</artifactId>
diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml
index 0a238dcbb..05b423b25 100644
--- a/dependency-check-maven/pom.xml
+++ b/dependency-check-maven/pom.xml
@@ -184,7 +184,6 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
         <dependency>
             <groupId>org.apache.maven.shared</groupId>
             <artifactId>maven-artifact-transfer</artifactId>
-            <version>0.9.0</version>
         </dependency>
     </dependencies>
     <profiles>
@@ -200,14 +199,14 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-invoker-plugin</artifactId>
-                        <version>3.0.1</version>
-                        <dependencies>
-                            <dependency>
-                                <groupId>org.codehaus.groovy</groupId>
-                                <artifactId>groovy-all</artifactId>
-                                <version>2.4.11</version>
-                            </dependency>
-                        </dependencies>
+      <!--              <version>3.0.1</version>
+                    <dependencies>
+                        <dependency>
+                            <groupId>org.codehaus.groovy</groupId>
+                            <artifactId>groovy-all</artifactId>
+                            <version>2.4.11</version>
+                        </dependency>
+                    </dependencies>-->
                         <configuration>
                             <!--streamLogs>true</streamLogs-->
                             <parallelThreads>4</parallelThreads>
diff --git a/pom.xml b/pom.xml
index 86da3e0be..c6575e51e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -132,6 +132,50 @@ Copyright (c) 2012 - Jeremy Long
         <maven.api.version>3.0</maven.api.version>
         <reporting.checkstyle-plugin.version>2.17</reporting.checkstyle-plugin.version>
         <reporting.pmd-plugin.version>3.6</reporting.pmd-plugin.version>
+        <doxia-module-markdown.version>1.7</doxia-module-markdown.version>
+        <maven-antrun-plugin.version>1.8</maven-antrun-plugin.version>
+        <maven-dependency-plugin.version>2.10</maven-dependency-plugin.version>
+        <maven-javadoc-plugin.version>2.10.4</maven-javadoc-plugin.version>
+        <maven-jxr-plugin.version>2.5</maven-jxr-plugin.version>
+        <maven-project-info-reports-plugin.version>2.9</maven-project-info-reports-plugin.version>
+        <maven-surefire-report-plugin.version>2.19.1</maven-surefire-report-plugin.version>
+        <jacoco-maven-plugin.version>0.7.9</jacoco-maven-plugin.version>
+        <findbugs-maven-plugin.version>3.0.4</findbugs-maven-plugin.version>
+        <taglist-maven-plugin.version>2.4</taglist-maven-plugin.version>
+        <versions-maven-plugin.version>2.3</versions-maven-plugin.version>
+
+        <!-- analysis core (used by Jenkins) uses 1.6-->
+        <joda-time.version>1.6</joda-time.version>
+        <com.google.code.findbugs.annotations.version>3.0.1u2</com.google.code.findbugs.annotations.version>
+        <com.google.code.gson.version>2.4</com.google.code.gson.version>
+        <com.h2database.version>1.4.196</com.h2database.version>
+        <commons-cli.version>1.4</commons-cli.version>
+        <commons-io.version>2.5</commons-io.version>
+
+        <!--upgrading beyond lang3 3.4 may cause issues with the Jenkins plugin-->
+        <commons-lang3.version>3.4</commons-lang3.version>
+        <com.sun.mail.mailapi.version>1.5.6</com.sun.mail.mailapi.version>
+        <junit.version>4.12</junit.version>
+        <hamcrest-core.version>1.3</hamcrest-core.version>
+        <org.jmockit.version>1.27</org.jmockit.version>
+
+        <jsoup.version>1.10.2</jsoup.version>
+        <commons-compress.version>1.14</commons-compress.version>
+        <org.apache.maven.shared.file-management.version>3.0.0</org.apache.maven.shared.file-management.version>
+        <maven-plugin-testing-harness.version>3.3.0</maven-plugin-testing-harness.version>
+        <maven-plugin-annotations.version>3.5</maven-plugin-annotations.version>
+        <maven-reporting-api.version>3.0</maven-reporting-api.version>
+        <commons-collections.version>3.2.2</commons-collections.version>
+        <org.apache.velocity.version>1.7</org.apache.velocity.version>
+        <plexus-sec-dispatcher.version>1.4</plexus-sec-dispatcher.version>
+
+        <!-- upgrading beyond 2.2 requires reworking the dependency resolution -->
+        <maven-dependency-tree.version>2.2</maven-dependency-tree.version>
+
+        <org.glassfish.javax.json.version>1.0.4</org.glassfish.javax.json.version>
+        <maven-artifact-transfer.version>0.9.0</maven-artifact-transfer.version>
+
+        
         <surefireArgLine/>
     </properties>
     <distributionManagement>
@@ -255,6 +299,18 @@ Copyright (c) 2012 - Jeremy Long
                     <artifactId>maven-javadoc-plugin</artifactId>
                     <version>2.10.4</version>
                 </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-invoker-plugin</artifactId>
+                    <version>3.0.1</version>
+                    <dependencies>
+                        <dependency>
+                            <groupId>org.codehaus.groovy</groupId>
+                            <artifactId>groovy-all</artifactId>
+                            <version>2.4.11</version>
+                        </dependency>
+                    </dependencies>
+                </plugin>
             </plugins>
         </pluginManagement>
         <plugins>
@@ -460,7 +516,7 @@ Copyright (c) 2012 - Jeremy Long
                     <dependency>
                         <groupId>org.apache.maven.doxia</groupId>
                         <artifactId>doxia-module-markdown</artifactId>
-                        <version>1.7</version>
+                        <version>${doxia-module-markdown.version}</version>
                     </dependency>
                 </dependencies>
                 <configuration>
@@ -471,7 +527,7 @@ Copyright (c) 2012 - Jeremy Long
                 <inherited>false</inherited>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-antrun-plugin</artifactId>
-                <version>1.8</version>
+                <version>${maven-antrun-plugin.version}</version>
                 <executions>
                     <execution>
                         <id>copy-xsd</id>
@@ -498,12 +554,12 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-dependency-plugin</artifactId>
-                <version>2.10</version>
+                <version>${maven-dependency-plugin.version}</version>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-javadoc-plugin</artifactId>
-                <version>2.10.4</version>
+                <version>${maven-javadoc-plugin.version}</version>
                 <configuration>
                     <failOnError>false</failOnError>
                     <bottom>Copyright© 2012-17 Jeremy Long. All Rights Reserved.</bottom>
@@ -520,12 +576,12 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-jxr-plugin</artifactId>
-                <version>2.5</version>
+                <version>${maven-jxr-plugin.version}</version>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-project-info-reports-plugin</artifactId>
-                <version>2.9</version>
+                <version>${maven-project-info-reports-plugin.version}</version>
                 <reportSets>
                     <reportSet>
                         <reports>
@@ -552,7 +608,7 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-report-plugin</artifactId>
-                <version>2.19.1</version>
+                <version>${maven-surefire-report-plugin.version}</version>
                 <reportSets>
                     <reportSet>
                         <reports>
@@ -564,7 +620,7 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.7.9</version>
+                <version>${jacoco-maven-plugin.version}</version>
                 <configuration>
                     <dataFileIncludes>
                         <dataFileInclude>target/coverage-reports/jacoco-ut.exec</dataFileInclude>
@@ -582,12 +638,12 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>findbugs-maven-plugin</artifactId>
-                <version>3.0.4</version>
+                <version>${findbugs-maven-plugin.version}</version>
             </plugin>
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>taglist-maven-plugin</artifactId>
-                <version>2.4</version>
+                <version>${taglist-maven-plugin.version}</version>
                 <configuration>
                     <tagListOptions>
                         <tagClasses>
@@ -611,7 +667,7 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>versions-maven-plugin</artifactId>
-                <version>2.3</version>
+                <version>${versions-maven-plugin.version}</version>
                 <reportSets>
                     <reportSet>
                         <reports>
@@ -629,43 +685,43 @@ Copyright (c) 2012 - Jeremy Long
             <dependency>
                 <groupId>joda-time</groupId>
                 <artifactId>joda-time</artifactId>
-                <version>1.6</version>
+                <version>${joda-time.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.google.code.findbugs</groupId>
                 <artifactId>annotations</artifactId>
-                <version>3.0.1u2</version>
+                <version>${com.google.code.findbugs.annotations.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.google.code.gson</groupId>
                 <artifactId>gson</artifactId>
-                <version>2.4</version>
+                <version>${com.google.code.gson.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.h2database</groupId>
                 <artifactId>h2</artifactId>
-                <version>1.4.196</version>
+                <version>${com.h2database.version}</version>
             </dependency>
             <dependency>
                 <groupId>commons-cli</groupId>
                 <artifactId>commons-cli</artifactId>
-                <version>1.4</version>
+                <version>${commons-cli.version}</version>
             </dependency>
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
-                <version>2.5</version>
+                <version>${commons-io.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-lang3</artifactId>
                 <!--upgrading beyond this may cause issues with the Jenkins plugin-->
-                <version>3.4</version>
+                <version>${commons-lang3.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.sun.mail</groupId>
                 <artifactId>mailapi</artifactId>
-                <version>1.5.6</version>
+                <version>${com.sun.mail.mailapi.version}</version>
             </dependency>
             <dependency>
                 <groupId>ch.qos.logback</groupId>
@@ -680,13 +736,13 @@ Copyright (c) 2012 - Jeremy Long
             <dependency>
                 <groupId>junit</groupId>
                 <artifactId>junit</artifactId>
-                <version>4.12</version>
+                <version>${junit.version}</version>
                 <scope>test</scope>
             </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-compress</artifactId>
-                <version>1.14</version>
+                <version>${commons-compress.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.ant</groupId>
@@ -731,7 +787,7 @@ Copyright (c) 2012 - Jeremy Long
             <dependency>
                 <groupId>org.apache.maven.shared</groupId>
                 <artifactId>file-management</artifactId>
-                <version>3.0.0</version>
+                <version>${org.apache.maven.shared.file-management.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.maven</groupId>
@@ -741,61 +797,61 @@ Copyright (c) 2012 - Jeremy Long
             <dependency>
                 <groupId>org.apache.maven.plugin-testing</groupId>
                 <artifactId>maven-plugin-testing-harness</artifactId>
-                <version>3.3.0</version>
+                <version>${maven-plugin-testing-harness.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.maven.plugin-tools</groupId>
                 <artifactId>maven-plugin-annotations</artifactId>
-                <version>3.5</version>
+                <version>${maven-plugin-annotations.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.maven.reporting</groupId>
                 <artifactId>maven-reporting-api</artifactId>
-                <version>3.0</version>
+                <version>${maven-reporting-api.version}</version>
             </dependency>
             <!-- Upgrading transitive commons-collections-3.2.1 from velocity-1.7. -->
             <dependency>
                 <groupId>commons-collections</groupId>
                 <artifactId>commons-collections</artifactId>
-                <version>3.2.2</version>
+                <version>${commons-collections.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.velocity</groupId>
                 <artifactId>velocity</artifactId>
-                <version>1.7</version>
+                <version>${org.apache.velocity.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.sonatype.plexus</groupId>
                 <artifactId>plexus-sec-dispatcher</artifactId>
-                <version>1.4</version>
+                <version>${plexus-sec-dispatcher.version}</version>
             </dependency>
             <!-- upgrading beyond 2.2 requires reworking the dependency resolution -->
             <dependency>
                 <groupId>org.apache.maven.shared</groupId>
                 <artifactId>maven-dependency-tree</artifactId>
-                <version>2.2</version>
+                <version>${maven-dependency-tree.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.glassfish</groupId>
                 <artifactId>javax.json</artifactId>
-                <version>1.0.4</version>
+                <version>${org.glassfish.javax.json.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.hamcrest</groupId>
                 <artifactId>hamcrest-core</artifactId>
-                <version>1.3</version>
+                <version>${hamcrest-core.version}</version>
                 <scope>test</scope>
             </dependency>
             <dependency>
                 <groupId>org.jmockit</groupId>
                 <artifactId>jmockit</artifactId>
-                <version>1.27</version>
+                <version>${org.jmockit.version}</version>
                 <scope>test</scope>
             </dependency>
             <dependency>
                 <groupId>org.jsoup</groupId>
                 <artifactId>jsoup</artifactId>
-                <version>1.10.2</version>
+                <version>${jsoup.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.slf4j</groupId>
@@ -807,6 +863,11 @@ Copyright (c) 2012 - Jeremy Long
                 <artifactId>slf4j-simple</artifactId>
                 <version>${slf4j.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.maven.shared</groupId>
+                <artifactId>maven-artifact-transfer</artifactId>
+                <version>${maven-artifact-transfer.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <dependencies>