From 7bcde5d43956acf119b16bd5ac9544eb58c479f6 Mon Sep 17 00:00:00 2001
From: Jeremy Long <jeremy.long@gmail.com>
Date: Mon, 27 Nov 2017 21:14:34 -0500
Subject: [PATCH 1/7] move non-test dependency version numbers to properties

---
 dependency-check-core/pom.xml  |   3 +-
 dependency-check-maven/pom.xml |  17 +++--
 pom.xml                        | 127 ++++++++++++++++++++++++---------
 3 files changed, 104 insertions(+), 43 deletions(-)

diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml
index be1c2cd6e..3df269715 100644
--- a/dependency-check-core/pom.xml
+++ b/dependency-check-core/pom.xml
@@ -248,7 +248,8 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
             <groupId>com.google.code.gson</groupId>
             <artifactId>gson</artifactId>
         </dependency>
-        <!-- The following dependencies are only used during testing -->
+        <!-- The following dependencies are only used during testing 
+             and must not be converted to a properties based version number -->
         <dependency>
             <groupId>org.apache.maven.scm</groupId>
             <artifactId>maven-scm-provider-cvsexe</artifactId>
diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml
index 0a238dcbb..05b423b25 100644
--- a/dependency-check-maven/pom.xml
+++ b/dependency-check-maven/pom.xml
@@ -184,7 +184,6 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
         <dependency>
             <groupId>org.apache.maven.shared</groupId>
             <artifactId>maven-artifact-transfer</artifactId>
-            <version>0.9.0</version>
         </dependency>
     </dependencies>
     <profiles>
@@ -200,14 +199,14 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-invoker-plugin</artifactId>
-                        <version>3.0.1</version>
-                        <dependencies>
-                            <dependency>
-                                <groupId>org.codehaus.groovy</groupId>
-                                <artifactId>groovy-all</artifactId>
-                                <version>2.4.11</version>
-                            </dependency>
-                        </dependencies>
+      <!--              <version>3.0.1</version>
+                    <dependencies>
+                        <dependency>
+                            <groupId>org.codehaus.groovy</groupId>
+                            <artifactId>groovy-all</artifactId>
+                            <version>2.4.11</version>
+                        </dependency>
+                    </dependencies>-->
                         <configuration>
                             <!--streamLogs>true</streamLogs-->
                             <parallelThreads>4</parallelThreads>
diff --git a/pom.xml b/pom.xml
index 86da3e0be..c6575e51e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -132,6 +132,50 @@ Copyright (c) 2012 - Jeremy Long
         <maven.api.version>3.0</maven.api.version>
         <reporting.checkstyle-plugin.version>2.17</reporting.checkstyle-plugin.version>
         <reporting.pmd-plugin.version>3.6</reporting.pmd-plugin.version>
+        <doxia-module-markdown.version>1.7</doxia-module-markdown.version>
+        <maven-antrun-plugin.version>1.8</maven-antrun-plugin.version>
+        <maven-dependency-plugin.version>2.10</maven-dependency-plugin.version>
+        <maven-javadoc-plugin.version>2.10.4</maven-javadoc-plugin.version>
+        <maven-jxr-plugin.version>2.5</maven-jxr-plugin.version>
+        <maven-project-info-reports-plugin.version>2.9</maven-project-info-reports-plugin.version>
+        <maven-surefire-report-plugin.version>2.19.1</maven-surefire-report-plugin.version>
+        <jacoco-maven-plugin.version>0.7.9</jacoco-maven-plugin.version>
+        <findbugs-maven-plugin.version>3.0.4</findbugs-maven-plugin.version>
+        <taglist-maven-plugin.version>2.4</taglist-maven-plugin.version>
+        <versions-maven-plugin.version>2.3</versions-maven-plugin.version>
+
+        <!-- analysis core (used by Jenkins) uses 1.6-->
+        <joda-time.version>1.6</joda-time.version>
+        <com.google.code.findbugs.annotations.version>3.0.1u2</com.google.code.findbugs.annotations.version>
+        <com.google.code.gson.version>2.4</com.google.code.gson.version>
+        <com.h2database.version>1.4.196</com.h2database.version>
+        <commons-cli.version>1.4</commons-cli.version>
+        <commons-io.version>2.5</commons-io.version>
+
+        <!--upgrading beyond lang3 3.4 may cause issues with the Jenkins plugin-->
+        <commons-lang3.version>3.4</commons-lang3.version>
+        <com.sun.mail.mailapi.version>1.5.6</com.sun.mail.mailapi.version>
+        <junit.version>4.12</junit.version>
+        <hamcrest-core.version>1.3</hamcrest-core.version>
+        <org.jmockit.version>1.27</org.jmockit.version>
+
+        <jsoup.version>1.10.2</jsoup.version>
+        <commons-compress.version>1.14</commons-compress.version>
+        <org.apache.maven.shared.file-management.version>3.0.0</org.apache.maven.shared.file-management.version>
+        <maven-plugin-testing-harness.version>3.3.0</maven-plugin-testing-harness.version>
+        <maven-plugin-annotations.version>3.5</maven-plugin-annotations.version>
+        <maven-reporting-api.version>3.0</maven-reporting-api.version>
+        <commons-collections.version>3.2.2</commons-collections.version>
+        <org.apache.velocity.version>1.7</org.apache.velocity.version>
+        <plexus-sec-dispatcher.version>1.4</plexus-sec-dispatcher.version>
+
+        <!-- upgrading beyond 2.2 requires reworking the dependency resolution -->
+        <maven-dependency-tree.version>2.2</maven-dependency-tree.version>
+
+        <org.glassfish.javax.json.version>1.0.4</org.glassfish.javax.json.version>
+        <maven-artifact-transfer.version>0.9.0</maven-artifact-transfer.version>
+
+        
         <surefireArgLine/>
     </properties>
     <distributionManagement>
@@ -255,6 +299,18 @@ Copyright (c) 2012 - Jeremy Long
                     <artifactId>maven-javadoc-plugin</artifactId>
                     <version>2.10.4</version>
                 </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-invoker-plugin</artifactId>
+                    <version>3.0.1</version>
+                    <dependencies>
+                        <dependency>
+                            <groupId>org.codehaus.groovy</groupId>
+                            <artifactId>groovy-all</artifactId>
+                            <version>2.4.11</version>
+                        </dependency>
+                    </dependencies>
+                </plugin>
             </plugins>
         </pluginManagement>
         <plugins>
@@ -460,7 +516,7 @@ Copyright (c) 2012 - Jeremy Long
                     <dependency>
                         <groupId>org.apache.maven.doxia</groupId>
                         <artifactId>doxia-module-markdown</artifactId>
-                        <version>1.7</version>
+                        <version>${doxia-module-markdown.version}</version>
                     </dependency>
                 </dependencies>
                 <configuration>
@@ -471,7 +527,7 @@ Copyright (c) 2012 - Jeremy Long
                 <inherited>false</inherited>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-antrun-plugin</artifactId>
-                <version>1.8</version>
+                <version>${maven-antrun-plugin.version}</version>
                 <executions>
                     <execution>
                         <id>copy-xsd</id>
@@ -498,12 +554,12 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-dependency-plugin</artifactId>
-                <version>2.10</version>
+                <version>${maven-dependency-plugin.version}</version>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-javadoc-plugin</artifactId>
-                <version>2.10.4</version>
+                <version>${maven-javadoc-plugin.version}</version>
                 <configuration>
                     <failOnError>false</failOnError>
                     <bottom>Copyright© 2012-17 Jeremy Long. All Rights Reserved.</bottom>
@@ -520,12 +576,12 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-jxr-plugin</artifactId>
-                <version>2.5</version>
+                <version>${maven-jxr-plugin.version}</version>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-project-info-reports-plugin</artifactId>
-                <version>2.9</version>
+                <version>${maven-project-info-reports-plugin.version}</version>
                 <reportSets>
                     <reportSet>
                         <reports>
@@ -552,7 +608,7 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-report-plugin</artifactId>
-                <version>2.19.1</version>
+                <version>${maven-surefire-report-plugin.version}</version>
                 <reportSets>
                     <reportSet>
                         <reports>
@@ -564,7 +620,7 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.7.9</version>
+                <version>${jacoco-maven-plugin.version}</version>
                 <configuration>
                     <dataFileIncludes>
                         <dataFileInclude>target/coverage-reports/jacoco-ut.exec</dataFileInclude>
@@ -582,12 +638,12 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>findbugs-maven-plugin</artifactId>
-                <version>3.0.4</version>
+                <version>${findbugs-maven-plugin.version}</version>
             </plugin>
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>taglist-maven-plugin</artifactId>
-                <version>2.4</version>
+                <version>${taglist-maven-plugin.version}</version>
                 <configuration>
                     <tagListOptions>
                         <tagClasses>
@@ -611,7 +667,7 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>versions-maven-plugin</artifactId>
-                <version>2.3</version>
+                <version>${versions-maven-plugin.version}</version>
                 <reportSets>
                     <reportSet>
                         <reports>
@@ -629,43 +685,43 @@ Copyright (c) 2012 - Jeremy Long
             <dependency>
                 <groupId>joda-time</groupId>
                 <artifactId>joda-time</artifactId>
-                <version>1.6</version>
+                <version>${joda-time.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.google.code.findbugs</groupId>
                 <artifactId>annotations</artifactId>
-                <version>3.0.1u2</version>
+                <version>${com.google.code.findbugs.annotations.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.google.code.gson</groupId>
                 <artifactId>gson</artifactId>
-                <version>2.4</version>
+                <version>${com.google.code.gson.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.h2database</groupId>
                 <artifactId>h2</artifactId>
-                <version>1.4.196</version>
+                <version>${com.h2database.version}</version>
             </dependency>
             <dependency>
                 <groupId>commons-cli</groupId>
                 <artifactId>commons-cli</artifactId>
-                <version>1.4</version>
+                <version>${commons-cli.version}</version>
             </dependency>
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
-                <version>2.5</version>
+                <version>${commons-io.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-lang3</artifactId>
                 <!--upgrading beyond this may cause issues with the Jenkins plugin-->
-                <version>3.4</version>
+                <version>${commons-lang3.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.sun.mail</groupId>
                 <artifactId>mailapi</artifactId>
-                <version>1.5.6</version>
+                <version>${com.sun.mail.mailapi.version}</version>
             </dependency>
             <dependency>
                 <groupId>ch.qos.logback</groupId>
@@ -680,13 +736,13 @@ Copyright (c) 2012 - Jeremy Long
             <dependency>
                 <groupId>junit</groupId>
                 <artifactId>junit</artifactId>
-                <version>4.12</version>
+                <version>${junit.version}</version>
                 <scope>test</scope>
             </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-compress</artifactId>
-                <version>1.14</version>
+                <version>${commons-compress.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.ant</groupId>
@@ -731,7 +787,7 @@ Copyright (c) 2012 - Jeremy Long
             <dependency>
                 <groupId>org.apache.maven.shared</groupId>
                 <artifactId>file-management</artifactId>
-                <version>3.0.0</version>
+                <version>${org.apache.maven.shared.file-management.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.maven</groupId>
@@ -741,61 +797,61 @@ Copyright (c) 2012 - Jeremy Long
             <dependency>
                 <groupId>org.apache.maven.plugin-testing</groupId>
                 <artifactId>maven-plugin-testing-harness</artifactId>
-                <version>3.3.0</version>
+                <version>${maven-plugin-testing-harness.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.maven.plugin-tools</groupId>
                 <artifactId>maven-plugin-annotations</artifactId>
-                <version>3.5</version>
+                <version>${maven-plugin-annotations.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.maven.reporting</groupId>
                 <artifactId>maven-reporting-api</artifactId>
-                <version>3.0</version>
+                <version>${maven-reporting-api.version}</version>
             </dependency>
             <!-- Upgrading transitive commons-collections-3.2.1 from velocity-1.7. -->
             <dependency>
                 <groupId>commons-collections</groupId>
                 <artifactId>commons-collections</artifactId>
-                <version>3.2.2</version>
+                <version>${commons-collections.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.velocity</groupId>
                 <artifactId>velocity</artifactId>
-                <version>1.7</version>
+                <version>${org.apache.velocity.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.sonatype.plexus</groupId>
                 <artifactId>plexus-sec-dispatcher</artifactId>
-                <version>1.4</version>
+                <version>${plexus-sec-dispatcher.version}</version>
             </dependency>
             <!-- upgrading beyond 2.2 requires reworking the dependency resolution -->
             <dependency>
                 <groupId>org.apache.maven.shared</groupId>
                 <artifactId>maven-dependency-tree</artifactId>
-                <version>2.2</version>
+                <version>${maven-dependency-tree.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.glassfish</groupId>
                 <artifactId>javax.json</artifactId>
-                <version>1.0.4</version>
+                <version>${org.glassfish.javax.json.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.hamcrest</groupId>
                 <artifactId>hamcrest-core</artifactId>
-                <version>1.3</version>
+                <version>${hamcrest-core.version}</version>
                 <scope>test</scope>
             </dependency>
             <dependency>
                 <groupId>org.jmockit</groupId>
                 <artifactId>jmockit</artifactId>
-                <version>1.27</version>
+                <version>${org.jmockit.version}</version>
                 <scope>test</scope>
             </dependency>
             <dependency>
                 <groupId>org.jsoup</groupId>
                 <artifactId>jsoup</artifactId>
-                <version>1.10.2</version>
+                <version>${jsoup.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.slf4j</groupId>
@@ -807,6 +863,11 @@ Copyright (c) 2012 - Jeremy Long
                 <artifactId>slf4j-simple</artifactId>
                 <version>${slf4j.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.maven.shared</groupId>
+                <artifactId>maven-artifact-transfer</artifactId>
+                <version>${maven-artifact-transfer.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <dependencies>

From ae128c38ecbcc7f6b5ff5c63a44c7f8bd2366cc9 Mon Sep 17 00:00:00 2001
From: Jeremy Long <jeremy.long@gmail.com>
Date: Mon, 27 Nov 2017 22:29:25 -0500
Subject: [PATCH 2/7] configured version updates

---
 pom.xml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pom.xml b/pom.xml
index c6575e51e..6170a5c7e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -314,6 +314,27 @@ Copyright (c) 2012 - Jeremy Long
             </plugins>
         </pluginManagement>
         <plugins>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>versions-maven-plugin</artifactId>
+                <version>2.4</version>
+                <executions>
+                    <execution>
+                        <configuration>
+                            <allowSnapshots>false</allowSnapshots>
+                            <excludes>
+                                <exclude>org.apache.maven.shared:maven-dependency-tree</exclude>
+                                <exclude>joda-time:joda-time</exclude>
+                                <exclude>org.apache.commons:commons-lang3</exclude>
+                            </excludes>
+                        </configuration>
+                        <phase>post-clean</phase>
+                        <goals>
+                            <goal>update-properties</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>

From 19c223161d63b796c3212398dbf5a46e82711c6f Mon Sep 17 00:00:00 2001
From: Jeremy Long <jeremy.long@gmail.com>
Date: Mon, 27 Nov 2017 22:35:07 -0500
Subject: [PATCH 3/7] fix plugin configuration

---
 pom.xml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pom.xml b/pom.xml
index 6170a5c7e..2c9bc4a81 100644
--- a/pom.xml
+++ b/pom.xml
@@ -317,9 +317,13 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>versions-maven-plugin</artifactId>
-                <version>2.4</version>
+                <version>2.5</version>
                 <executions>
                     <execution>
+                        <phase>post-clean</phase>
+                        <goals>
+                            <goal>update-properties</goal>
+                        </goals>
                         <configuration>
                             <allowSnapshots>false</allowSnapshots>
                             <excludes>
@@ -328,10 +332,6 @@ Copyright (c) 2012 - Jeremy Long
                                 <exclude>org.apache.commons:commons-lang3</exclude>
                             </excludes>
                         </configuration>
-                        <phase>post-clean</phase>
-                        <goals>
-                            <goal>update-properties</goal>
-                        </goals>
                     </execution>
                 </executions>
             </plugin>

From a31dddf8ef5fbca1ebbd95fba29d470887531aa8 Mon Sep 17 00:00:00 2001
From: Jeremy Long <jeremy.long@gmail.com>
Date: Mon, 27 Nov 2017 22:45:56 -0500
Subject: [PATCH 4/7] updated config

---
 pom.xml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 2c9bc4a81..1a0420bf4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -320,7 +320,7 @@ Copyright (c) 2012 - Jeremy Long
                 <version>2.5</version>
                 <executions>
                     <execution>
-                        <phase>post-clean</phase>
+                        <phase>pre-clean</phase>
                         <goals>
                             <goal>update-properties</goal>
                         </goals>
@@ -330,6 +330,7 @@ Copyright (c) 2012 - Jeremy Long
                                 <exclude>org.apache.maven.shared:maven-dependency-tree</exclude>
                                 <exclude>joda-time:joda-time</exclude>
                                 <exclude>org.apache.commons:commons-lang3</exclude>
+                                <exclude>org.apache.lucene</exclude>
                             </excludes>
                         </configuration>
                     </execution>

From 0a2bfcaed2d2624b840d8be6c34e9684f1661856 Mon Sep 17 00:00:00 2001
From: Jeremy Long <jeremy.long@gmail.com>
Date: Mon, 27 Nov 2017 23:14:17 -0500
Subject: [PATCH 5/7] upgrades

---
 .../analyzer/CentralAnalyzerTest.java         |  4 +-
 pom.xml                                       | 38 +++++++++----------
 2 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CentralAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CentralAnalyzerTest.java
index f6a2f4fb9..2146d5cc8 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CentralAnalyzerTest.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CentralAnalyzerTest.java
@@ -61,7 +61,7 @@ public class CentralAnalyzerTest {
         new Expectations() {
             {
                 centralSearch.searchSha1(SHA1_SUM);
-                returns(expectedMavenArtifacts);
+                returns(expectedMavenArtifacts, expectedMavenArtifacts);
             }
         };
 
@@ -176,7 +176,7 @@ public class CentralAnalyzerTest {
         new Expectations() {
             {
                 dependency.getSha1sum();
-                returns(SHA1_SUM);
+                returns(SHA1_SUM, SHA1_SUM);
             }
         };
     }
diff --git a/pom.xml b/pom.xml
index 1a0420bf4..d7b804fd9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -125,55 +125,55 @@ Copyright (c) 2012 - Jeremy Long
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <github.global.server>github</github.global.server>
         <apache.lucene.version>4.7.2</apache.lucene.version>
-        <apache.ant.version>1.9.8</apache.ant.version>
-        <slf4j.version>1.7.24</slf4j.version>
-        <logback.version>1.2.0</logback.version>
+        <apache.ant.version>1.10.1</apache.ant.version>
+        <slf4j.version>1.8.0-beta0</slf4j.version>
+        <logback.version>1.2.3</logback.version>
         <!-- Note that Maven will use classes from the distro, ignoring declared dependencies for Maven core... -->
-        <maven.api.version>3.0</maven.api.version>
+        <maven.api.version>3.5.2</maven.api.version>
         <reporting.checkstyle-plugin.version>2.17</reporting.checkstyle-plugin.version>
         <reporting.pmd-plugin.version>3.6</reporting.pmd-plugin.version>
         <doxia-module-markdown.version>1.7</doxia-module-markdown.version>
         <maven-antrun-plugin.version>1.8</maven-antrun-plugin.version>
-        <maven-dependency-plugin.version>2.10</maven-dependency-plugin.version>
-        <maven-javadoc-plugin.version>2.10.4</maven-javadoc-plugin.version>
+        <maven-dependency-plugin.version>3.0.2</maven-dependency-plugin.version>
+        <maven-javadoc-plugin.version>3.0.0-M1</maven-javadoc-plugin.version>
         <maven-jxr-plugin.version>2.5</maven-jxr-plugin.version>
         <maven-project-info-reports-plugin.version>2.9</maven-project-info-reports-plugin.version>
-        <maven-surefire-report-plugin.version>2.19.1</maven-surefire-report-plugin.version>
+        <maven-surefire-report-plugin.version>2.20.1</maven-surefire-report-plugin.version>
         <jacoco-maven-plugin.version>0.7.9</jacoco-maven-plugin.version>
-        <findbugs-maven-plugin.version>3.0.4</findbugs-maven-plugin.version>
+        <findbugs-maven-plugin.version>3.0.5</findbugs-maven-plugin.version>
         <taglist-maven-plugin.version>2.4</taglist-maven-plugin.version>
-        <versions-maven-plugin.version>2.3</versions-maven-plugin.version>
+        <versions-maven-plugin.version>2.5</versions-maven-plugin.version>
 
         <!-- analysis core (used by Jenkins) uses 1.6-->
         <joda-time.version>1.6</joda-time.version>
         <com.google.code.findbugs.annotations.version>3.0.1u2</com.google.code.findbugs.annotations.version>
-        <com.google.code.gson.version>2.4</com.google.code.gson.version>
+        <com.google.code.gson.version>2.8.2</com.google.code.gson.version>
         <com.h2database.version>1.4.196</com.h2database.version>
         <commons-cli.version>1.4</commons-cli.version>
-        <commons-io.version>2.5</commons-io.version>
+        <commons-io.version>2.6</commons-io.version>
 
         <!--upgrading beyond lang3 3.4 may cause issues with the Jenkins plugin-->
         <commons-lang3.version>3.4</commons-lang3.version>
-        <com.sun.mail.mailapi.version>1.5.6</com.sun.mail.mailapi.version>
+        <com.sun.mail.mailapi.version>1.6.0</com.sun.mail.mailapi.version>
         <junit.version>4.12</junit.version>
         <hamcrest-core.version>1.3</hamcrest-core.version>
-        <org.jmockit.version>1.27</org.jmockit.version>
+        <org.jmockit.version>1.37</org.jmockit.version>
 
-        <jsoup.version>1.10.2</jsoup.version>
-        <commons-compress.version>1.14</commons-compress.version>
+        <jsoup.version>1.11.2</jsoup.version>
+        <commons-compress.version>1.15</commons-compress.version>
         <org.apache.maven.shared.file-management.version>3.0.0</org.apache.maven.shared.file-management.version>
         <maven-plugin-testing-harness.version>3.3.0</maven-plugin-testing-harness.version>
         <maven-plugin-annotations.version>3.5</maven-plugin-annotations.version>
         <maven-reporting-api.version>3.0</maven-reporting-api.version>
-        <commons-collections.version>3.2.2</commons-collections.version>
+        <commons-collections.version>20040616</commons-collections.version>
         <org.apache.velocity.version>1.7</org.apache.velocity.version>
         <plexus-sec-dispatcher.version>1.4</plexus-sec-dispatcher.version>
 
         <!-- upgrading beyond 2.2 requires reworking the dependency resolution -->
         <maven-dependency-tree.version>2.2</maven-dependency-tree.version>
 
-        <org.glassfish.javax.json.version>1.0.4</org.glassfish.javax.json.version>
-        <maven-artifact-transfer.version>0.9.0</maven-artifact-transfer.version>
+        <org.glassfish.javax.json.version>1.1.2</org.glassfish.javax.json.version>
+        <maven-artifact-transfer.version>0.9.1</maven-artifact-transfer.version>
 
         
         <surefireArgLine/>
@@ -237,7 +237,7 @@ Copyright (c) 2012 - Jeremy Long
                 <plugin>
                     <groupId>org.codehaus.mojo</groupId>
                     <artifactId>animal-sniffer-maven-plugin</artifactId>
-                    <version>1.15</version>
+                    <version>1.16</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>

From eddffaae3dbd7db41ff37f830bdf6ca574cdfb9b Mon Sep 17 00:00:00 2001
From: Jeremy Long <jeremy.long@gmail.com>
Date: Sat, 2 Dec 2017 06:54:40 -0500
Subject: [PATCH 6/7] updated versions and include new enforcer rule to
 validate class file formats of dependencies

---
 pom.xml | 48 ++++++++++++++++++++++++++++++++++--------------
 1 file changed, 34 insertions(+), 14 deletions(-)

diff --git a/pom.xml b/pom.xml
index d7b804fd9..32cfce1c5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -125,8 +125,9 @@ Copyright (c) 2012 - Jeremy Long
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <github.global.server>github</github.global.server>
         <apache.lucene.version>4.7.2</apache.lucene.version>
-        <apache.ant.version>1.10.1</apache.ant.version>
-        <slf4j.version>1.8.0-beta0</slf4j.version>
+        <apache.ant.version>1.9.9</apache.ant.version>
+        <!--upgrading to the 1.8 requires Java 8 compatability  - we are maintaining 7 atm-->
+        <slf4j.version>1.7.25</slf4j.version>
         <logback.version>1.2.3</logback.version>
         <!-- Note that Maven will use classes from the distro, ignoring declared dependencies for Maven core... -->
         <maven.api.version>3.5.2</maven.api.version>
@@ -165,14 +166,14 @@ Copyright (c) 2012 - Jeremy Long
         <maven-plugin-testing-harness.version>3.3.0</maven-plugin-testing-harness.version>
         <maven-plugin-annotations.version>3.5</maven-plugin-annotations.version>
         <maven-reporting-api.version>3.0</maven-reporting-api.version>
-        <commons-collections.version>20040616</commons-collections.version>
+        <commons-collections.version>3.2.2</commons-collections.version>
         <org.apache.velocity.version>1.7</org.apache.velocity.version>
         <plexus-sec-dispatcher.version>1.4</plexus-sec-dispatcher.version>
 
         <!-- upgrading beyond 2.2 requires reworking the dependency resolution -->
         <maven-dependency-tree.version>2.2</maven-dependency-tree.version>
 
-        <org.glassfish.javax.json.version>1.1.2</org.glassfish.javax.json.version>
+        <org.glassfish.javax.json.version>1.0.4</org.glassfish.javax.json.version>
         <maven-artifact-transfer.version>0.9.1</maven-artifact-transfer.version>
 
         
@@ -232,7 +233,7 @@ Copyright (c) 2012 - Jeremy Long
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-enforcer-plugin</artifactId>
-                    <version>1.4.1</version>
+                    <version>3.0.0-M1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.codehaus.mojo</groupId>
@@ -327,10 +328,15 @@ Copyright (c) 2012 - Jeremy Long
                         <configuration>
                             <allowSnapshots>false</allowSnapshots>
                             <excludes>
-                                <exclude>org.apache.maven.shared:maven-dependency-tree</exclude>
-                                <exclude>joda-time:joda-time</exclude>
+                                <exclude>org.apache.maven.shared:maven-dependency-tree</exclude>Ï
                                 <exclude>org.apache.commons:commons-lang3</exclude>
                                 <exclude>org.apache.lucene</exclude>
+                                <exclude>commons-collections:commons-collections</exclude>
+                                <exclude>joda-time:joda-time</exclude>
+                                <exclude>org.slf4j</exclude>
+                                <exclude>org.apache.ant</exclude>
+                                <!--TODO remove javax.json - use GSON instead-->
+                                <exclude>org.glassfish:javax.json</exclude>
                             </excludes>
                         </configuration>
                     </execution>
@@ -363,6 +369,14 @@ Copyright (c) 2012 - Jeremy Long
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-enforcer-plugin</artifactId>
+                <dependencies>
+                    <dependency>
+                        <groupId>org.owasp.maven.enforcer</groupId>
+                        <artifactId>class-file-format-rule</artifactId>
+                        <version>1.0.0</version>
+                    </dependency>
+                </dependencies>
+                <inherited>true</inherited>
                 <executions>
                     <execution>
                         <id>enforce-java</id>
@@ -377,13 +391,19 @@ Copyright (c) 2012 - Jeremy Long
                             </rules>
                         </configuration>
                     </execution>
-                </executions>
-            </plugin>
-            <plugin>
-                <inherited>true</inherited>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-enforcer-plugin</artifactId>
-                <executions>
+                    <execution>
+                        <id>enforce-classfileformat</id>
+                        <configuration>
+                            <rules>
+                                <byteCodeRule implementation="org.owasp.maven.enforcer.rule.ClassFileFormatRule">
+                                    <supportedClassFileFormat>51</supportedClassFileFormat>
+                                </byteCodeRule>
+                            </rules>
+                        </configuration>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                    </execution>
                     <execution>
                         <id>enforce-maven-3</id>
                         <goals>

From 872a524c444effd33e7fbb66ecacd7949243793c Mon Sep 17 00:00:00 2001
From: Jeremy Long <jeremy.long@gmail.com>
Date: Sun, 3 Dec 2017 11:40:42 -0500
Subject: [PATCH 7/7] updated to use wildcare

---
 pom.xml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pom.xml b/pom.xml
index 32cfce1c5..6bfac6c10 100644
--- a/pom.xml
+++ b/pom.xml
@@ -328,15 +328,15 @@ Copyright (c) 2012 - Jeremy Long
                         <configuration>
                             <allowSnapshots>false</allowSnapshots>
                             <excludes>
-                                <exclude>org.apache.maven.shared:maven-dependency-tree</exclude>Ï
-                                <exclude>org.apache.commons:commons-lang3</exclude>
-                                <exclude>org.apache.lucene</exclude>
-                                <exclude>commons-collections:commons-collections</exclude>
-                                <exclude>joda-time:joda-time</exclude>
-                                <exclude>org.slf4j</exclude>
-                                <exclude>org.apache.ant</exclude>
+                                <exclude>org.apache.maven.shared:maven-dependency-tree:*</exclude>Ï
+                                <exclude>org.apache.commons:commons-lang3:*</exclude>
+                                <exclude>org.apache.lucene:*:*</exclude>
+                                <exclude>commons-collections:commons-collections:*</exclude>
+                                <exclude>joda-time:joda-time:*</exclude>
+                                <exclude>org.slf4j:*:*</exclude>
+                                <exclude>org.apache.ant:*:*</exclude>
                                 <!--TODO remove javax.json - use GSON instead-->
-                                <exclude>org.glassfish:javax.json</exclude>
+                                <exclude>org.glassfish:javax.json:*</exclude>
                             </excludes>
                         </configuration>
                     </execution>