pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright 2018 Confluent Inc.
  ~
  ~ Licensed under the Confluent Community License (the "License"); you may not use
  ~ this file except in compliance with the License.  You may obtain a copy of the
  ~ License at
  ~
  ~ http://www.confluent.io/confluent-community-license
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  ~ WARRANTIES OF ANY KIND, either express or implied.  See the License for the
  ~ specific language governing permissions and limitations under the License.
  -->

<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <scm>
        <connection>scm:git:git://github.com/confluentinc/ksql.git</connection>
        <developerConnection>scm:git:git@github.com:confluentinc/ksql.git</developerConnection>
        <url>https://github.com/confluentinc/ksql</url>
        <tag>HEAD</tag>
    </scm>
  
    <parent>
        <groupId>io.confluent</groupId>
        <artifactId>common</artifactId>
        <version>[8.3.0-0, 8.3.1-0)</version>
    </parent>

    <groupId>io.confluent.ksql</groupId>
    <artifactId>ksqldb-parent</artifactId>
    <packaging>pom</packaging>
    <name>ksqldb-parent</name>
    <version>8.3.0-0</version>

    <licenses>
        <license>
            <name>Confluent Community License</name>
            <url>https://www.confluent.io/confluent-community-license</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <modules>
        <module>ksqldb-stream-lib</module>
        <module>ksqldb-udf</module>
        <module>ksqldb-common</module>
        <module>ksqldb-udf-quickstart</module>
        <module>ksqldb-serde</module>
        <module>ksqldb-metastore</module>
        <module>ksqldb-execution</module>
        <module>ksqldb-parser</module>
        <module>ksqldb-streams</module>
        <module>ksqldb-engine</module>
        <module>ksqldb-tools</module>
        <module>ksqldb-cli</module>
        <module>ksqldb-examples</module>
        <module>ksqldb-rest-model</module>
        <module>ksqldb-rest-client</module>
        <module>ksqldb-rest-app</module>
        <module>ksqldb-version-metrics-client</module>
        <module>ksqldb-console-scripts</module>
        <module>ksqldb-etc</module>
        <module>ksqldb-package</module>
        <module>ksqldb-test-util</module>
        <module>ksqldb-benchmark</module>
        <module>ksqldb-functional-tests</module>
        <module>ksqldb-rocksdb-config-setter</module>
        <module>ksqldb-docker</module>
        <module>ksqldb-api-reactive-streams-tck</module>
        <module>ksqldb-api-client</module>
        <module>ksqldb-engine-common</module>
        <module>ksqldb-testing-tool</module>
    </modules>

    <repositories>
        <repository>
            <id>confluent</id>
            <url>https://packages.confluent.io/maven/</url>
        </repository>
        <repository>
            <id>confluent-snapshots</id>
            <url>https://confluent-snapshots.public.confluent.io/</url>
        </repository>
    </repositories>

    <pluginRepositories>
        <pluginRepository>
            <id>confluent</id>
            <url>https://packages.confluent.io/maven/</url>
        </pluginRepository>
        <pluginRepository>
            <id>confluent-snapshots</id>
            <url>https://confluent-snapshots.public.confluent.io/</url>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
        </pluginRepository>
    </pluginRepositories>

    <properties>
        <java.version>17</java.version>
        <apache.directory.server.version>2.0.0-M22</apache.directory.server.version>
        <apache.directory.api.version>1.0.0-M33</apache.directory.api.version>
        <apache.httpcomponents.version>5.4.3</apache.httpcomponents.version>
        <confluent.maven.repo>https://packages.confluent.io/maven/</confluent.maven.repo>
        <exec-maven-plugin.version>1.2.1</exec-maven-plugin.version>
        <podam.version>6.0.2.RELEASE</podam.version>
        <airline.version>2.6.0</airline.version>
        <antlr.version>4.10.1</antlr.version>
        <commons-text.version>1.10.0</commons-text.version>
        <csv.version>1.4</csv.version>
        <commons.compress.version>1.26.0</commons.compress.version>
        <lang3.version>3.18.0</lang3.version>
        <retrying.version>2.0.0</retrying.version>
        <inject.version>1</inject.version>
        <janino.version>3.1.10</janino.version>
        <javax-validation.version>2.0.1.Final</javax-validation.version>
        <jline.version>3.25.0</jline.version>
        <jna.version>4.4.0</jna.version>
        <jsr305.version>3.0.2</jsr305.version>
        <maven.plugins.version>3.0.0-M1</maven.plugins.version>
        <really.executable.jar.version>1.5.0</really.executable.jar.version>
        <generext.version>1.0.2</generext.version>
        <avro.random.generator.version>0.2.2</avro.random.generator.version>
        <apache.curator.version>5.2.0</apache.curator.version>
        <wiremock.version>3.12.0</wiremock.version>
        <icu.version>67.1</icu.version>
        <vertx.version>4.5.24</vertx.version>
        <reactive-streams.version>1.0.3</reactive-streams.version>
        <skip.docker.build>true</skip.docker.build>
        <skip.docker.test>true</skip.docker.test>
        <protobuf.version>4.34.0</protobuf.version>
        <!-- Temporarily disabling this because it is causing failures in packaging but not CI builds. -->
        <!-- <compile.warnings-flag>-Werror</compile.warnings-flag> -->
        <git-commit-id-plugin.version>4.9.10</git-commit-id-plugin.version>
        <apache.io.version>2.11.0</apache.io.version>
        <io.confluent.ksql.version>8.3.0-0</io.confluent.ksql.version>
        <io.confluent.schema-registry.version>${confluent.version.range}</io.confluent.schema-registry.version>
        <netty-tcnative-fips-version>0.123.0</netty-tcnative-fips-version>
        <netty-tcnative-version>2.0.74.Final</netty-tcnative-version>
        <!-- We normally get this from common, but Vertx is built against this -->
        <!-- Note: `netty` depends on `tcnative` and if we bump `netty`
             we might need to bump `tcnative`, too.
             Please check top level `pom.xml` at https://github.com/netty/netty
             for the netty version we bump to (ie, corresponding git tag),
             to find the correct `tcnative` version. -->
        <netty.version>4.1.130.Final</netty.version>
        <netty-codec-http2-version>4.1.130.Final</netty-codec-http2-version>
        <jersey-common>3.1.10</jersey-common>
        <multi-threaded-testing.forkCount>3</multi-threaded-testing.forkCount>
        <kafka.version>${ce.kafka.version}</kafka.version>
    </properties>

    <dependencyManagement>
        <dependencies>
            <!-- Cross-submodule dependencies -->
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-core</artifactId>
                <version>${log4j2.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-api</artifactId>
                <version>${log4j2.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-1.2-api</artifactId>
                <version>${log4j2.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>kafka_${kafka.scala.version}</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-log4j12</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.confluent.networking</groupId>
                        <artifactId>cc-custom-dns-resolver-java18</artifactId>
                    </exclusion>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>kafka-streams</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>kafka-clients</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-log4j12</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.confluent.networking</groupId>
                        <artifactId>cc-custom-dns-resolver-java18</artifactId>
                    </exclusion>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>connect-api</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>connect-runtime</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>connect-transforms</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>connect-json</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>connect-file</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>kafka-streams-test-utils</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <!-- Kafka's SSL utilities are used in tests. -->
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>kafka_${kafka.scala.version}</artifactId>
                <version>${kafka.version}</version>
                <classifier>test</classifier>
                <scope>test</scope>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-log4j12</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.confluent.networking</groupId>
                        <artifactId>cc-custom-dns-resolver-java18</artifactId>
                    </exclusion>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>kafka-clients</artifactId>
                <version>${kafka.version}</version>
                <classifier>test</classifier>
                <scope>test</scope>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-log4j12</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.confluent.networking</groupId>
                        <artifactId>cc-custom-dns-resolver-java18</artifactId>
                    </exclusion>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>connect-test-plugins</artifactId>
                <version>${kafka.version}</version>
                <scope>test</scope>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>kafka-server-common</artifactId>
                <version>${kafka.version}</version>
                <classifier>test</classifier>
                <scope>compile</scope>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>ce-sbk_${kafka.scala.version}</artifactId>
                <version>${kafka.version}</version>
                <scope>compile</scope>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>kafka-test-common-internal-api</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>org.apache.kafka</groupId>
                <artifactId>kafka-test-common-runtime</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-common</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-engine-common</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-udf</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-serde</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-metastore</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-cli</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-engine</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-execution</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-parser</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-streams</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-examples</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-rest-model</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-rest-client</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-rest-app</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-functional-tests</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-version-metrics-client</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>package-ksql</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-api-reactive-streams-tck</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent.ksql</groupId>
                <artifactId>ksqldb-api-client</artifactId>
                <version>${io.confluent.ksql.version}</version>
            </dependency>
            <!-- End cross-submodule dependencies -->

            <!-- Confluent dependencies -->
            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>kafka-connect-avro-converter</artifactId>
                <version>${io.confluent.schema-registry.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>kafka-json-serializer</artifactId>
                <version>${io.confluent.schema-registry.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>kafka-avro-serializer</artifactId>
                <version>${io.confluent.schema-registry.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>kafka-schema-registry-client</artifactId>
                <version>${io.confluent.schema-registry.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <!-- FIPS Compliance: Exclude Conscrypt from gRPC ALTS (transitive dependency) -->
            <dependency>
                <groupId>io.grpc</groupId>
                <artifactId>grpc-alts</artifactId>
                <exclusions>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <!-- FIPS Compliance: Exclude non-FIPS libs from Google Cloud KMS (transitive dependency) -->
            <dependency>
                <groupId>com.google.cloud</groupId>
                <artifactId>google-cloud-kms</artifactId>
                <exclusions>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <!-- FIPS Compliance: Exclude non-FIPS libs from Google Cloud Storage (transitive dependency) -->
            <dependency>
                <groupId>com.google.cloud</groupId>
                <artifactId>google-cloud-storage</artifactId>
                <exclusions>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>common-utils</artifactId>
                <version>${io.confluent.common.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>common-docker</artifactId>
                <version>${io.confluent.common-docker.version}</version>
            </dependency>

            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>kafka-json-schema-provider</artifactId>
                <version>${io.confluent.schema-registry.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>kafka-protobuf-provider</artifactId>
                <version>${io.confluent.schema-registry.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>kafka-connect-json-schema-converter</artifactId>
                <version>${io.confluent.schema-registry.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>kafka-connect-protobuf-converter</artifactId>
                <version>${io.confluent.schema-registry.version}</version>
                <exclusions>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.netty</groupId>
                        <artifactId>netty-tcnative-boringssl-static</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>io.confluent</groupId>
                <artifactId>broker-plugins</artifactId>
                <version>${kafka.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>ch.qos.reload4j</groupId>
                        <artifactId>reload4j</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>io.confluent.networking</groupId>
                        <artifactId>cc-custom-dns-resolver-java18</artifactId>
                    </exclusion>
                    <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>com.google.crypto.tink</groupId>
                        <artifactId>tink-gcpkms</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.conscrypt</groupId>
                        <artifactId>conscrypt-openjdk-uber</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <!-- End Confluent dependencies -->

            <dependency>
                <groupId>com.github.rvesse</groupId>
                <artifactId>airline</artifactId>
                <version>${airline.version}</version>
            </dependency>

            <dependency>
                <groupId>com.google.code.findbugs</groupId>
                <artifactId>jsr305</artifactId>
                <version>${jsr305.version}</version>
            </dependency>

            <dependency>
                <groupId>com.google.guava</groupId>
                <artifactId>guava</artifactId>
                <version>${guava.version}</version>
            </dependency>

            <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protobuf-java</artifactId>
                <version>${protobuf.version}</version>
            </dependency>

            <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protobuf-java-util</artifactId>
                <version>${protobuf.version}</version>
            </dependency>

            <dependency>
                <groupId>com.github.rholder</groupId>
                <artifactId>guava-retrying</artifactId>
                <version>${retrying.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>com.google.guava</groupId>
                        <artifactId>guava</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>


            <dependency>
                <groupId>javax.inject</groupId>
                <artifactId>javax.inject</artifactId>
                <version>${inject.version}</version>
            </dependency>

            <dependency>
                <groupId>net.java.dev.jna</groupId>
                <artifactId>jna</artifactId>
                <version>${jna.version}</version>
            </dependency>

            <dependency>
                <groupId>org.antlr</groupId>
                <artifactId>antlr4-runtime</artifactId>
                <version>${antlr.version}</version>
            </dependency>

            <dependency>
                <groupId>org.apache.avro</groupId>
                <artifactId>avro</artifactId>
                <version>${avro.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>com.google.guava</groupId>
                        <artifactId>guava</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-csv</artifactId>
                <version>${csv.version}</version>
            </dependency>

            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-compress</artifactId>
                <version>${commons.compress.version}</version>
            </dependency>

            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-lang3</artifactId>
                <version>${lang3.version}</version>
            </dependency>

            <dependency>
                <groupId>commons-io</groupId>
                <artifactId>commons-io</artifactId>
                <version>${commons-io.version}</version>
            </dependency>

            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-text</artifactId>
                <version>${commons-text.version}</version>
            </dependency>

            <dependency>
                <groupId>org.codehaus.janino</groupId>
                <artifactId>janino</artifactId>
                <version>${janino.version}</version>
            </dependency>

            <dependency>
                <groupId>org.jline</groupId>
                <artifactId>jline</artifactId>
                <version>${jline.version}</version>
            </dependency>

            <dependency>
                <groupId>javax.validation</groupId>
                <artifactId>validation-api</artifactId>
                <version>${javax-validation.version}</version>
            </dependency>

            <dependency>
                <groupId>com.ibm.icu</groupId>
                <artifactId>icu4j</artifactId>
                <version>${icu.version}</version>
            </dependency>

            <!-- We need to fix our Scala versions as otherwise our depdendencies bring in
            different versions via different routes
            https://github.com/confluentinc/common/pull/260 -->
            <dependency>
                <groupId>org.scala-lang</groupId>
                <artifactId>scala-library</artifactId>
                <version>${scala.version}</version>
            </dependency>

            <dependency>
                <groupId>org.scala-lang</groupId>
                <artifactId>scala-reflect</artifactId>
                <version>${scala.version}</version>
            </dependency>

            <!-- Explicitly override all netty artifacts to get the version we want. Doing netty-all
             doesn't seem to correctly override its individual dependencies, so all are enumerated
             here -->
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-all</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-common</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-buffer</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-handler</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-handler-proxy</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec-socks</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec-http</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec-http2</artifactId>
                <version>${netty-codec-http2-version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-resolver</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-resolver-dns</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec-dns</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport-native-kqueue</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport-native-epoll</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport-native-unix-common</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <!-- FIPS Compliance: Block BoringSSL by setting scope to provided
                 This prevents non-FIPS BoringSSL from being included in runtime classpath.
                 TLS will use BC-FIPS/BC-JSSE instead. -->
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-tcnative-fips-boringssl-static</artifactId>
                <version>${netty-tcnative-fips-version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-tcnative-boringssl-static</artifactId>
                <version>${netty-tcnative-version}</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.glassfish.jersey.core</groupId>
                <artifactId>jersey-common</artifactId>
                <version>${jersey-common}</version>
            </dependency>
            <dependency>
                <groupId>org.glassfish.jersey.core</groupId>
                <artifactId>jersey-server</artifactId>
                <version>${jersey-common}</version>
            </dependency>

            <!-- Required for running tests -->
            <dependency>
                <groupId>junit</groupId>
                <artifactId>junit</artifactId>
                <version>${junit.version}</version>
                <scope>test</scope>
                <exclusions>
                    <exclusion>
                        <groupId>org.hamcrest</groupId>
                        <artifactId>hamcrest-core</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>com.google.guava</groupId>
                <artifactId>guava-testlib</artifactId>
                <version>${guava.version}</version>
                <scope>test</scope>
            </dependency>

            <dependency>
                <groupId>org.wiremock</groupId>
                <artifactId>wiremock-jetty12</artifactId>
                <version>${wiremock.version}</version>
                <scope>test</scope>
            </dependency>

            <!-- Override vulnerable json-smart 2.5.0/2.5.1 to fix CVE-2024-57699
                 TODO: Remove when all transitive deps use json-smart 2.5.2+ -->
            <dependency>
                <groupId>net.minidev</groupId>
                <artifactId>json-smart</artifactId>
                <version>2.5.2</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>${log4j2.version}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>${log4j2.version}</version>
        </dependency>

        <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-1.2-api</artifactId>
        <version>${log4j2.version}</version>
        </dependency>

        <dependency>
            <groupId>io.confluent</groupId>
            <artifactId>confluent-log4j2-extensions</artifactId>
            <version>${io.confluent.common.version}</version>
            <scope>compile</scope>
        </dependency>

        <dependency>
            <groupId>io.confluent</groupId>
            <artifactId>logredactor</artifactId>
        </dependency>
        <dependency>
            <groupId>io.confluent</groupId>
            <artifactId>broker-plugins</artifactId>
            <exclusions>
                <exclusion>
                    <groupId>ch.qos.reload4j</groupId>
                    <artifactId>reload4j</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>io.confluent.networking</groupId>
                    <artifactId>cc-custom-dns-resolver-java18</artifactId>
                </exclusion>
                <!-- FIPS Compliance: Exclude non-FIPS cryptographic libraries -->
                <exclusion>
                    <groupId>com.google.crypto.tink</groupId>
                    <artifactId>tink</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.google.crypto.tink</groupId>
                    <artifactId>tink-gcpkms</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.conscrypt</groupId>
                    <artifactId>conscrypt-openjdk-uber</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.junit.vintage</groupId>
            <artifactId>junit-vintage-engine</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <artifactId>maven-assembly-plugin</artifactId>
                    <configuration>
                        <tarLongFileMode>posix</tarLongFileMode>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>exec-maven-plugin</artifactId>
                    <version>${exec-maven-plugin.version}</version>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <!-- FIPS Compliance: Enforce banned non-FIPS cryptographic dependencies -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.4.1</version>
                <executions>
                    <execution>
                        <id>ban-non-fips-crypto-libs</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <bannedDependencies>
                                    <excludes>
                                        <!-- Google Tink: Has its own non-FIPS crypto implementations -->
                                        <exclude>com.google.crypto.tink:tink</exclude>
                                        <exclude>com.google.crypto.tink:tink-gcpkms</exclude>
                                        <!-- Conscrypt: Uses BoringSSL which is not FIPS validated -->
                                        <exclude>org.conscrypt:conscrypt-openjdk-uber</exclude>
                                        <!--
                                            NOTE: Both netty-tcnative variants are allowed at build time:
                                            - netty-tcnative-boringssl-static (non-FIPS, for standard mode)
                                            - netty-tcnative-fips-boringssl-static (FIPS compliant)
                                            Runtime selection is handled by ksql-run-class script based on FIPS_ENABLED env var
                                        -->
                                    </excludes>
                                    <message>
                                        FIPS-140-3 Compliance Error: Non-FIPS cryptographic libraries detected!
                                        These libraries must be excluded to ensure FIPS compliance.
                                        Use Bouncy Castle FIPS (bc-fips, bctls-fips, bcpkix-fips) instead.
                                        Note: netty-tcnative variants are controlled at runtime via FIPS_ENABLED env var.
                                    </message>
                                </bannedDependencies>
                            </rules>
                            <fail>true</fail>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <showWarnings>true</showWarnings>
                    <showDeprecation>true</showDeprecation>
                    <compilerVersion>1.8</compilerVersion>
                    <source>1.8</source>
                    <target>1.8</target>
                    <compilerArgs>
                        <arg>-Xlint:all,-serial,-options,-path</arg>
                        <arg>-parameters</arg>
                        <arg>${compile.warnings-flag}</arg>
                    </compilerArgs>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <configuration>
                    <propertiesLocation>checkstyle/checkstyle.properties</propertiesLocation>
                    <suppressionsLocation>checkstyle/suppressions.xml</suppressionsLocation>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <configuration>
                    <rerunFailingTestsCount>3</rerunFailingTestsCount>
                    <systemPropertyVariables>
                        <log4j2.configurationFile>file:${project.basedir}/../ksqldb-test-util/src/main/resources/log4j2.yaml</log4j2.configurationFile>
                        <junit.platform.execution.listeners.deactivate>org.apache.kafka.test.ThreadLeakListener</junit.platform.execution.listeners.deactivate>
                    </systemPropertyVariables>
                    <argLine>-verbose:gc -Xloggc:"${project.build.directory}/gc.log"</argLine>
                    <argLine>-Duser.timezone=UTC -Xmx1g -Xms1g</argLine>
                    <excludedGroups>io.confluent.common.utils.IntegrationTest, IntegrationTest</excludedGroups>
                </configuration>
                <version>3.2.5</version>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
                <configuration>
                    <!-- we haven't yet fully migrated to JDK9 Jigsaw, but when compiling
                    with JDKs that are >9 failsafe fails with many NoClassDefFoundErrors
                    unless we disable this flag.

                    You can also see (https://issues.apache.org/jira/browse/SUREFIRE-1809)
                    for more details -->
                    <useModulePath>false</useModulePath>
                    <groups>io.confluent.common.utils.IntegrationTest, IntegrationTest</groups>
                    <systemPropertyVariables>
                        <junit.platform.execution.listeners.deactivate>org.apache.kafka.test.ThreadLeakListener</junit.platform.execution.listeners.deactivate>
                    </systemPropertyVariables>
                </configuration>
                <executions>
                    <execution>
                        <id>integration-test</id>
                        <configuration>
                            <excludes>
                                <exclude>**/RestQueryTranslationTest*.java</exclude>
                                <exclude>**/io/confluent/ksql/rest/integration/**/*.java</exclude>
                            </excludes>
                        </configuration>
                    </execution>
                    <execution>
                        <id>multi-threaded-testing</id>
                        <phase>integration-test</phase>
                        <goals>
                            <goal>integration-test</goal>
                        </goals>
                        <configuration>
                            <includes>
                                <include>**/RestQueryTranslationTest*.java</include>
                                <include>**/io/confluent/ksql/rest/integration/**/*.java</include>
                            </includes>
                            <forkCount>${multi-threaded-testing.forkCount}</forkCount>
                            <reuseForks>false</reuseForks>
                            <parallel>classes</parallel>
                            <useUnlimitedThreads>true</useUnlimitedThreads>
                            <forkedProcessTimeoutInSeconds>3600</forkedProcessTimeoutInSeconds>
                            <forkedProcessExitTimeoutInSeconds>180</forkedProcessExitTimeoutInSeconds>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>exec-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <goals>
                            <goal>java</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>${spotbugs.maven.plugin.version}</version>
                <configuration>
                    <xmlOutput>true</xmlOutput>
                    <excludeFilterFile>${project.basedir}/../findbugs/findbugs-exclude.xml</excludeFilterFile>
                    <effort>Max</effort>
                    <threshold>Max</threshold>
                    <failOnError>true</failOnError>
<!--                    <includeTests>true</includeTests>-->
                </configuration>
                <executions>
                    <!--
                    Ensures that FindBugs inspects source code when project is compiled.
                -->
                    <execution>
                        <id>analyze-compile</id>
                        <phase>compile</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>pl.project13.maven</groupId>
                <artifactId>git-commit-id-plugin</artifactId>
                <version>${git-commit-id-plugin.version}</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>revision</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <dotGitDirectory>${project.basedir}/.git</dotGitDirectory>
                    <generateGitPropertiesFile>true</generateGitPropertiesFile>
                    <generateGitPropertiesFilename>${project.build.outputDirectory}/git.properties</generateGitPropertiesFilename>
                    <includeOnlyProperties>
                        <includeOnlyProperty>git.commit.id</includeOnlyProperty>
                    </includeOnlyProperties>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.pitest</groupId>
                <artifactId>pitest-maven</artifactId>
                <version>1.6.4</version>
                <configuration>
                    <threads>8</threads>
                    <targetClasses>
                        <param>io.confluent.ksql.*</param>
                    </targetClasses>
                    <excludedClasses>
                        <param>io.confluent.ksql.engine.StubInsertValuesExecutor</param>
                        <param>io.confluent.ksql.test.*</param>
                    </excludedClasses>
                    <excludedTestClasses>
                        <param>io.confluent.ksql.rest.app.ImmutabilityTest</param>
                        <param>io.confluent.ksql.rest.integration.*</param>
                        <param>io.confluent.ksql.rest.server.resources.*ResourceTest</param>
                        <param>io.confluent.ksql.*.Immutability*</param>
                        <param>io.confluent.ksql.*.ImmutableTester*</param>
                        <param>io.confluent.ksql.schema.ksql.types.SqlTypesTest</param>
                        <param>io.confluent.ksql.schema.ksql.PhysicalSchemaTest</param>
                        <param>io.confluent.ksql.rest.entity.KsqlRequestTest</param>
                        <param>io.confluent.ksql.execution.plan.ExecutionStepTest</param>
                        <param>io.confluent.ksql.metastore.model.MetaStoreModelTest</param>
                        <param>io.confluent.ksql.test.*</param>
                        <param>io.confluent.ksql.rocksdb.KsqlBoundedMemoryRocksDBConfigSetterTest</param>
                    </excludedTestClasses>
                </configuration>
            </plugin>
        </plugins>
    </build>
    <reporting>
        <plugins>

        </plugins>
    </reporting>

    <profiles>
        <!-- Profile for detailed deprecation analysis -->
        <profile>
            <id>deprecation-check</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-compiler-plugin</artifactId>
                        <configuration>
                            <showWarnings>true</showWarnings>
                            <showDeprecation>true</showDeprecation>
                            <compilerArgs>
                                <arg>-Xlint:deprecation</arg>
                                <arg>-Xlint:unchecked</arg>
                                <arg>-parameters</arg>
                            </compilerArgs>
                            <!-- Force recompilation to show all warnings -->
                            <useIncrementalCompilation>false</useIncrementalCompilation>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!-- Profile for strict deprecation checking (fails build on deprecation) -->
        <profile>
            <id>deprecation-strict</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-compiler-plugin</artifactId>
                        <configuration>
                            <showWarnings>true</showWarnings>
                            <showDeprecation>true</showDeprecation>
                            <failOnWarning>true</failOnWarning>
                            <compilerArgs>
                                <arg>-Xlint:deprecation</arg>
                                <arg>-Werror</arg>
                                <arg>-parameters</arg>
                            </compilerArgs>
                            <useIncrementalCompilation>false</useIncrementalCompilation>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
    <!-- ===========================================================================
         FIPS Compliance Notes
         ===========================================================================
         By default, BOTH netty-tcnative variants are included in the build:
         - netty-tcnative-boringssl-static (standard, CVE-free)
         - netty-tcnative-fips-boringssl-static (FIPS 140-3 compliant)

         Runtime selection is controlled by FIPS_ENABLED environment variable
         in the ksql-run-class startup script.

         Usage:
           Standard mode: bin/ksql-server-start config/ksql-server.properties
           FIPS mode:     FIPS_ENABLED=true bin/ksql-server-start config/ksql-server.properties
         =========================================================================== -->
</project>