build.gradle

import org.apache.tools.ant.filters.ReplaceTokens
import org.gradle.api.artifacts.DependencySubstitutions


buildscript {
  ext.jdkVersionDefault = 25
  ext.javaClassVersionDefault = 25

  def springModules = ['mae-consumer', 'mce-consumer', 'pe-consumer']

  ext.jdkVersion = { p ->
    return p.hasProperty('jdkVersionDefault')
      ? Integer.valueOf((String) p.getProperty('jdkVersionDefault'))
      : ext.jdkVersionDefault
  }

  // Main bytecode version selector.
  // A per-module ext.javaClassVersionOverride takes precedence over the global default: it lets the
  // modules bundled into the acryl-spark-lineage agent shadow jar pin Java 17 bytecode so the agent
  // runs on managed Spark whose default JVM is Java 17 (Amazon EMR 7.x, Databricks Runtime 16-17),
  // while the rest of the repo targets 25. (javaClassVersionDefault is always present via
  // gradle.properties, so the override must be checked first.)
  ext.javaClassVersion = { p ->
    if (p.hasProperty('javaClassVersionOverride')) {
      return Integer.valueOf(String.valueOf(p.getProperty('javaClassVersionOverride')))
    }
    return p.hasProperty('javaClassVersionDefault')
      ? Integer.valueOf((String) p.getProperty('javaClassVersionDefault'))
      : ext.javaClassVersionDefault
  }

  ext.junitJupiterVersion = '5.12.2'
  // Releases: https://github.com/linkedin/rest.li/blob/master/CHANGELOG.md
  ext.pegasusVersion = '29.74.2'
  ext.mavenVersion = '3.9.15'
  ext.versionGradle = '9.5.0'
  // CVE-2026-41842, CVE-2026-41845 (spring-webmvc), CVE-2026-41850 (spring-expression): fixed in 7.0.8+ / 6.2.19+
  ext.springVersion = '7.0.8'
  // CVE-2026-40976 / GHSA (spring-boot 4.0.6+); BOM manages spring-security at 7.0.5
  ext.springBootVersion = '4.0.6'
  // CVE-2026-22748 (oauth2-jose), CVE-2026-22751: fixed in 7.0.5+; explicit pins were 7.0.4 — use latest 7.0.x patch
  ext.springSecurityVersion = '7.0.6'
  // CVE-2026-41731 (spring-kafka header deserialization): fixed in 4.0.6+ / 3.3.16+
  ext.springKafkaVersion = '4.0.6'
  // CVE-2023-50572 (GroovyEngine OOM); GHSA-2r2c-cx56-8933 (remote-telnet NAWS DoS): fixed in 4.2.1+
  ext.jlineVersion = '4.2.1'
  // CVE-2026-45292 (W3C Baggage unbounded memory): fixed in opentelemetry-api / trace-propagators 1.62.0+
  ext.openTelemetryVersion = '1.62.0'
  ext.neo4jVersion = '5.20.0'
  ext.neo4jApocVersion = '5.20.0'
  ext.testContainersVersion = '1.21.4'
  ext.elasticsearchVersion = '2.19.4' // ES 7.10, Opensearch 1.x, 2.x
  ext.elasticsearch8Version = '8.17.4' // ES 8.x Java client
  // CVE-2026-5795 (JASPIAuthenticator ThreadLocal): fixed in 12.0.34+
  // CVE-2026-10050 (Digest Auth bypass via ISO-8859-1 encoding): fixed in 12.1.10+
  ext.jettyVersion = '12.1.10'
  // see also datahub-frontend/play.gradle (Play 3 + Apache Pekko)
  ext.playVersion = '3.0.10'
  ext.playScalaVersion = '2.13'
  ext.playGradlePluginVersion = '3.1.0-M9'
  ext.pekkoVersion = '1.0.3' // aligned with org.playframework:play_2.13 bom
  ext.aircompressorVersion = '2.0.3' // CVE-2025-67721: Snappy/LZ4 buffer reuse info leak
  ext.commonsCompressVersion = '1.27.1' // CVE-2024-25710, CVE-2024-26308; min safe 1.26.0
  ext.hiveLlapCommonVersion = '4.0.0' // LlapSignerImpl signature comparison; upgrade from 2.3.x
  // CVE-2026-34477: Ssl verifyHostName ignored for SMTP/Socket/Syslog appenders; fixed in 2.25.4+
  // CVE-2026-49844: MapMessage.asJson() emits invalid JSON for NaN/Infinity; fixed in 2.25.5+
  ext.log4jVersion = '2.25.5'
  ext.minaCoreVersion = '2.2.4' // CVE-2024-52046, ObjectSerializationDecoder deserialization/RCE
  ext.rhinoVersion = '1.7.15.1' // CVE-2025-66453 (NativeNumber.toFixed / DToA DoS); also 1.8.1, 1.7.14.1
  // Spark-lineage only (acryl-spark-lineage) – CVE-pinned versions for Spark/Hadoop stack
  ext.sparkLineageDnsjavaVersion = '3.6.0'           // CVE-2024-25638
  ext.sparkLineageJettisonVersion = '1.5.2'          // CVE-2022-40150, CVE-2022-45685, CVE-2022-45693, CVE-2023-1436, CVE-2022-40149
  ext.sparkLineageNimbusJoseJwtVersion = '10.0.2'    // CVE-2023-52428; min 9.37.2, use 10.x to avoid downgrading
  // Spark-lineage only; Jetty 9.4 EOL. CVE-2026-5795 fixed in 9.4.61+; latest on Maven Central when pinned was 9.4.58.
  ext.sparkLineageJetty94Version = '9.4.58.v20250814'
  ext.commonsConfiguration2Version = '2.15.1' // CVE-2024-29131, CVE-2024-29133; CVE-2026-45205 (fixed in 2.15.0+)
  ext.slf4jVersion = '1.7.36'
  // CVE-2026-1225 / GHSA-qqpg-mvqg-649v: logback-core fixed in 1.5.25+
  // CVE-2026-9828 (HardenedObjectInputStream java.lang/java.util allowlist bypass): fixed in 1.5.33+
  // CVE-2026-10532 (HardenedObjectInputStream Proxy deserialization): fixed in 1.5.38
  ext.logbackClassic = '1.5.38'
  // Janino evaluates the <if> conditionals in logback.xml (e.g. gating the optional log-shipping appender).
  ext.janinoVersion = '3.0.12'
  // Loki4j appender for optional log shipping. Pinned to 1.x: 2.x changes the XML config format.
  ext.lokiLogbackAppenderVersion = '1.6.0'
  ext.hadoop3Version = '3.4.1' // Hadoop >=3.4.0 for CVE-2024-23454 (RunJar temp-dir permissions per HADOOP-19031); >3.3.4 for CVE-2021-37404, command injection, path traversal, deserialization RCE
  // CVE-2017-3162 (DataNode servlet, Hadoop before 2.7.0) is fixed by any 3.x client; pin thirdparty jar so scanners do not flag Hadoop 2.x-era metadata on 1.3.0.
  ext.hadoopShadedProtobuf_3_25_Version = '1.5.0'
  // CVE-2024-23454 (RunJar temp dir permissions) is fixed in hadoop-common 3.4.0+; pin thirdparty jar beyond Hadoop’s transitive 1.3.0 for scanner hygiene.
  ext.hadoopShadedGuavaVersion = '1.5.0'
  // kafka-clients + broker images: CP 8.2 / Kafka 4.2 (share groups production-ready).
  // Confluent Avro SerDe / schema-registry-client stay on 8.1 — 8.2+ needs Avro 1.12
  // (NameValidator), which breaks LinkedIn avro-util / Pegasus (Avro 1.4–1.11 only).
  ext.kafkaVersion = '8.2.2'
  ext.confluentSerdeVersion = '8.1.0'
  // at.yawk.lz4 fork (CVE-2025-12183, CVE-2026-59949); single version for externalDependency.lz4Java + resolutionStrategy
  ext.lz4JavaVersion = '1.11.1'
  // Hazelcast shades Jackson 2.x/3.x inside hazelcast-*.jar (v5.7.0: jackson-databind 2.21.2, 3.1.2).
  // CVE-2026-54512/54513 require jackson-databind 2.21.4+ / 3.1.4+; ext.jacksonVersion does not replace
  // shaded copies — bump when Hazelcast publishes a fix (https://github.com/hazelcast/hazelcast/issues/26597).
  ext.hazelcastVersion = '5.7.0'
  ext.bucket4jVersion = '8.14.0'
  // 16.1.0 upgraded the enhancer's shaded ASM to 9.8 (Java 25 / class-file major 69). Earlier
  // versions cap at V24 and fail entity enhancement on Java 25 bytecode with BeanNotEnhancedException.
  ext.ebeanVersion = '16.2.0'
  ext.googleJavaFormatVersion = '1.28.0'  // 1.28.0 = first google-java-format supporting JDK 25 javac (Log.getDiagnostics Queue->List)
  // Mockito inline mocks need byte-buddy + byte-buddy-agent matched and >= 1.17.5 (ASM 9.8) to
  // instrument Java 25 runtime classes; forced in the resolutionStrategy block below.
  ext.byteBuddyVersion = '1.18.11'
  ext.openLineageVersion = '1.50.0'
  ext.awsSdk2Version = '2.30.33'
  ext.micrometerVersion = '1.16.6'
  // CVE-2026-1002; CVE-2026-6860 / GHSA-3g76-f9xq-8vp6 (SNI cache growth); fabric8 kubernetes-httpclient-vertx
  ext.vertxVersion = '4.5.27'
  // CVE-2026-41417 (netty-codec-http): 4.1.133+ or 4.2.13+; CVE-2026-42577 (netty-transport-native-epoll): 4.2.13+
  // CVE-2026-47691 (netty-resolver-dns): 4.1.135+ or 4.2.15+; CVE-2026-48059/50560 fixed in 4.2.15+
  // CVE-2026-55831/55833/56745 (netty-codec-http); CVE-2026-55851 (netty-codec-haproxy);
  // CVE-2026-56816 (netty-codec-http3); CVE-2026-56817 (netty-codec-xml);
  // CVE-2026-56820/56821/56822 (netty-handler-ssl-ocsp); CVE-2026-59901 (netty-codec-compression):
  // all fixed in 4.2.16+
  // CVE-2026-59902 (netty-transport-sctp): 4.2.17+
  ext.nettyVersion = '4.2.17.Final' // align all io.netty modules (excl. netty-tcnative line)
  // CVE-2026-45799: wire-runtime skipGroup() negative-length crash (fixed in 6.3.0+);
  // transitive via schema-registry-serde → wire-compiler → wire-runtime-jvm
  ext.wireVersion = '6.3.0'
  // CVE-2026-40542 / GHSA: SCRAM-SHA-256 authentication verification (httpclient5 5.6 → 5.6.1+)
  ext.httpClient5Version = '5.6.1'
  // Align org.bouncycastle *-jdk18on (bcpkix, bcprov, bcutil); CVE-2026-0636 (bcprov fixed in 1.84+)
  ext.bouncyCastleJdk18onVersion = '1.84'
  // gRPC protobuf/stub line from Pegasus/Rest.li transitives (not gRPC transport — grpc-netty-shaded is excluded repo-wide).
  ext.grpcVersion = '1.81.0'
  // Align with Spring Boot 4.0.6 / reactor-bom 2025.0.5; io.netty transitives aligned via eachDependency + nettyVersion.
  ext.reactorNettyVersion = '1.3.6'

  ext.nodeVersion = '22.16.0'
  ext.yarnVersion = '1.22.22'

  ext.docker_registry = project.getProperties().getOrDefault("dockerRegistry", 'acryldata')

  apply from: './repositories.gradle'
  buildscript.repositories.addAll(project.repositories)

  // Supply-chain guard: the vendor/rest-li-fork jars are Gradle plugins that run at configuration
  // time with full project access. Verify their SHA-256 BEFORE they are placed on the buildscript
  // classpath below. When intentionally rebuilding a fork jar, update the hash here AND in
  // vendor/rest-li-fork/README.md. (Also exposed as the `verifyVendorJars` task for explicit CI.)
  def vendorJarSha256 = [
    ("vendor/rest-li-fork/gradle-plugins-${pegasusVersion}-gradle9.jar".toString()):
      'a6f48cbb9f4889d274f725ea85db4e818b975d720f03daa80737f7531a5b15f8',
    ('vendor/rest-li-fork/gradle-swagger-generator-plugin-2.19.2-gradle9.jar'):
      'aa732dc7363f69bcd15c026cee697e5527ac8e1db80e7181e734d859b891ff0a',
  ]
  vendorJarSha256.each { rel, expected ->
    def f = new File(rootDir, rel)
    if (!f.exists()) {
      throw new GradleException("Vendor jar missing (supply-chain check): ${rel}")
    }
    def actual = java.security.MessageDigest.getInstance('SHA-256').digest(f.bytes).encodeHex().toString()
    if (actual != expected) {
      throw new GradleException(
        "Vendor jar SHA-256 mismatch (supply-chain check) for ${rel}:\n" +
        "  expected ${expected}\n  actual   ${actual}\n" +
        "If you intentionally rebuilt the fork jar, update the hash in build.gradle (ext.vendorJarSha256) and vendor/rest-li-fork/README.md.")
    }
  }

  dependencies {
    classpath files("vendor/rest-li-fork/gradle-plugins-${pegasusVersion}-gradle9.jar")  // in-repo fork jar (no publishing)
    classpath 'com.github.node-gradle:gradle-node-plugin:7.0.2'
    classpath 'io.acryl.gradle.plugin:gradle-avro-plugin:0.2.0'
    classpath 'org.springframework.boot:spring-boot-gradle-plugin:' + springBootVersion
    classpath "io.codearte.gradle.nexus:gradle-nexus-staging-plugin:0.30.0"
    classpath "com.palantir.gradle.gitversion:gradle-git-version:3.0.0"
    classpath "org.gradle.playframework:gradle-playframework:0.14"
    classpath files("vendor/rest-li-fork/gradle-swagger-generator-plugin-2.19.2-gradle9.jar")  // in-repo fork jar (no publishing)
  }
}

plugins {
  id 'com.gorylenko.gradle-git-properties' version '2.5.3'
  id 'com.gradleup.shadow' version '9.3.0' apply false
  id 'com.palantir.docker' version '0.35.0' apply false
  id 'com.avast.gradle.docker-compose' version '0.17.21'
  id "com.diffplug.spotless" version "7.0.4"
  id 'com.adarshr.test-logger' version '4.0.0'
  // https://blog.ltgt.net/javax-jakarta-mess-and-gradle-solution/
  // TODO id "org.gradlex.java-ecosystem-capabilities" version "1.0"
}

apply from: "gradle/docker/docker-utils.gradle"

// Jackson BOM patch version — bump here and in buildSrc/build.gradle (buildSrc classpath).
ext.jacksonVersion = '2.21.5'
// Parquet stack: parquet-jackson shades Jackson under shaded/parquet/.
// 1.18.0+ bundles jackson-databind 2.22.1 (CVE-2026-54512/54513 and related jackson-databind CVEs
// fixed in 2.21.4+; https://github.com/apache/parquet-java/pull/3594).
// App-classpath jackson-databind remains ext.jacksonVersion (2.21.5); that pin does not replace the shade.
ext.parquetVersion = '1.18.0'
// Minor-only annotation line matches jackson-bom (e.g. 2.21 for jackson 2.21.x patch releases).
ext.jacksonMinorRelease = jacksonVersion.contains('.')
    ? jacksonVersion.substring(0, jacksonVersion.lastIndexOf('.'))
    : jacksonVersion

project.ext.spec = [
    'product' : [
        'pegasus' : [
            'd2' : 'com.linkedin.pegasus:d2:' + pegasusVersion,
            'data' : 'com.linkedin.pegasus:data:' + pegasusVersion,
            'dataAvro': 'com.linkedin.pegasus:data-avro:' + pegasusVersion,
            'generator': 'com.linkedin.pegasus:generator:' + pegasusVersion,
            'restliCommon' : 'com.linkedin.pegasus:restli-common:' + pegasusVersion,
            'restliClient' : 'com.linkedin.pegasus:restli-client:' + pegasusVersion,
            'restliDocgen' : 'com.linkedin.pegasus:restli-docgen:' + pegasusVersion,
            'restliServer' : 'com.linkedin.pegasus:restli-server:' + pegasusVersion,
            'restliSpringBridge': 'com.linkedin.pegasus:restli-spring-bridge:' + pegasusVersion,
            'restliTestUtils' : 'com.linkedin.pegasus:restli-client-testutils:' + pegasusVersion,
        ]
    ]
]

project.ext.externalDependency = [
    'pekkoActor': "org.apache.pekko:pekko-actor_$playScalaVersion:$pekkoVersion",
    'pekkoStream': "org.apache.pekko:pekko-stream_$playScalaVersion:$pekkoVersion",
    'pekkoActorTyped': "org.apache.pekko:pekko-actor-typed_$playScalaVersion:$pekkoVersion",
    'pekkoSlf4j': "org.apache.pekko:pekko-slf4j_$playScalaVersion:$pekkoVersion",
    'pekkoJackson': "org.apache.pekko:pekko-serialization-jackson_$playScalaVersion:$pekkoVersion",
    'antlr4Runtime': 'org.antlr:antlr4-runtime:4.9.3',
    'antlr4': 'org.antlr:antlr4:4.9.3',
    'archunit': 'com.tngtech.archunit:archunit:1.4.2',
    'assertJ': 'org.assertj:assertj-core:3.11.1',
    'awaitility': 'org.awaitility:awaitility:4.2.0',
    'avro': 'org.apache.avro:avro:1.11.5',
    'avroCompiler': 'org.apache.avro:avro-compiler:1.11.5',
    'awsGlueSchemaRegistrySerde': 'software.amazon.glue:schema-registry-serde:1.1.25',
    'awsMskIamAuth': 'software.amazon.msk:aws-msk-iam-auth:2.3.2',
    'awsSdk2Bom': 'software.amazon.awssdk:bom:2.30.33',
    'awsS3': "software.amazon.awssdk:s3:$awsSdk2Version",
    'awsSecretsManagerJdbc': 'com.amazonaws.secretsmanager:aws-secretsmanager-jdbc:2.0.4',
    'awsPostgresIamAuth': 'software.amazon.jdbc:aws-advanced-jdbc-wrapper:2.6.5',
    'awsRds':"software.amazon.awssdk:rds:$awsSdk2Version",
    'azureIdentityExtensions': 'com.azure:azure-identity-extensions:1.2.6',
    'azureIdentity': 'com.azure:azure-identity:1.18.1',
    'cacheApi': 'javax.cache:cache-api:1.1.0',
    'commonsCli': 'commons-cli:commons-cli:1.5.0',
    'commonsIo': 'commons-io:commons-io:2.17.0',
    'commonsText': 'org.apache.commons:commons-text:1.14.0',
    'bucket4jCore': "com.bucket4j:bucket4j_jdk17-core:$bucket4jVersion",
    'bucket4jHazelcast': "com.bucket4j:bucket4j_jdk17-hazelcast:$bucket4jVersion",
    'concurrencyLimitsCore': 'com.netflix.concurrency-limits:concurrency-limits-core:0.5.3',
    'commonsLang3': 'org.apache.commons:commons-lang3:3.18.0',  // CVE-2025-48924
    'rhino': "org.mozilla:rhino:$rhinoVersion",  // CVE-2025-66453
    'caffeine': 'com.github.ben-manes.caffeine:caffeine:3.1.8',
    'datastaxOssNativeProtocol': 'com.datastax.oss:native-protocol:1.5.1',
    'datastaxOssCore': 'org.apache.cassandra:java-driver-core:4.19.0',
    'datastaxOssQueryBuilder': 'org.apache.cassandra:java-driver-query-builder:4.19.0',
    'micrometerPrometheus': "io.micrometer:micrometer-registry-prometheus:$micrometerVersion",
    'micrometerJmx': "io.micrometer:micrometer-registry-jmx:$micrometerVersion",
    'micrometerObserve': "io.micrometer:micrometer-observation:$micrometerVersion",
    'micrometerOtelBridge': "io.micrometer:micrometer-tracing-bridge-otel:1.6.4",
    'ebean': 'io.ebean:ebean:' + ebeanVersion,
    'ebeanTest': 'io.ebean:ebean-test:' + ebeanVersion,
    'ebeanAgent': 'io.ebean:ebean-agent:' + ebeanVersion,
    'ebeanDdl': 'io.ebean:ebean-ddl-generator:' + ebeanVersion,
    'ebeanQueryBean': 'io.ebean:querybean-generator:' + ebeanVersion,
    'elasticSearchRest': 'org.opensearch.client:opensearch-rest-high-level-client:' + elasticsearchVersion,
    // Multi-client shim dependencies
    'elasticsearch8Client': 'co.elastic.clients:elasticsearch-java:' + elasticsearch8Version,
    'findbugsAnnotations': 'com.google.code.findbugs:annotations:3.0.1',
    'graphqlJava': 'com.graphql-java:graphql-java:22.3',
    'graphqlJavaScalars': 'com.graphql-java:graphql-java-extended-scalars:22.0',
    'graphqlJavaOtel': 'io.opentelemetry.instrumentation:opentelemetry-graphql-java-20.0:2.27.0-alpha',
    'gson': 'com.google.code.gson:gson:2.12.0',
    'guice': 'com.google.inject:guice:7.0.0',
    'guicePlay': 'com.google.inject:guice:5.0.1', // Used for frontend while still on old Play version
    'guava': 'com.google.guava:guava:33.6.0-jre',
    'h2': 'com.h2database:h2:2.2.224',
    'hadoopCommon':'org.apache.hadoop:hadoop-common:2.7.2',
    'hadoopMapreduceClient':'org.apache.hadoop:hadoop-mapreduce-client-core:2.7.2',
    "hadoopClient": "org.apache.hadoop:hadoop-client:$hadoop3Version",
    "hadoopCommon3":"org.apache.hadoop:hadoop-common:$hadoop3Version",
    'hazelcast':"com.hazelcast:hazelcast:$hazelcastVersion",
    'hazelcastSpring':"com.hazelcast:hazelcast-spring:$hazelcastVersion",
    'hazelcastTest':"com.hazelcast:hazelcast:$hazelcastVersion:tests",
    'hibernateCore': 'org.hibernate:hibernate-core:5.2.16.Final',
    // CVE-2025-35036 / GHSA-7v6m-28jr-rg84 (EL in constraint violation messages); Play java-forms pulls 6.1.x otherwise
    'hibernateValidator': 'org.hibernate.validator:hibernate-validator:6.2.5.Final',
    'httpClient': 'org.apache.httpcomponents.client5:httpclient5:' + httpClient5Version,
    'iStackCommons': 'com.sun.istack:istack-commons-runtime:4.0.1',
    // The jacksonBom controls the version of other jackson modules; pin the version once.
    // implementation enforcedPlatform(externalDependency.jacksonBom)
    'jacksonBom': "com.fasterxml.jackson:jackson-bom:${jacksonVersion}",
    'jacksonJDK8': 'com.fasterxml.jackson.datatype:jackson-datatype-jdk8',
    'jacksonDataPropertyFormat': 'com.fasterxml.jackson.dataformat:jackson-dataformat-properties',
    'jacksonCore': 'com.fasterxml.jackson.core:jackson-core',
    'jacksonDataBind': 'com.fasterxml.jackson.core:jackson-databind',
    'jacksonJsr310': 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310',
    'jacksonDataFormatYaml': 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml',
    'woodstoxCore': 'com.fasterxml.woodstox:woodstox-core:6.4.0',
    'xercesImpl': 'xerces:xercesImpl:2.12.0',
    'javatuples': 'org.javatuples:javatuples:1.2',
    'javaxInject' : 'jakarta.inject:jakarta.inject-api:2.0.1',
    'javaxValidation' : 'javax.validation:validation-api:2.0.1.Final',
    'jakartaValidation': 'jakarta.validation:jakarta.validation-api:3.1.0-M2',
    'jerseyCore': 'org.glassfish.jersey.core:jersey-client:2.46',
    'jerseyGuava': 'org.glassfish.jersey.bundles.repackaged:jersey-guava:2.25.1',
    'jettySecurity': "org.eclipse.jetty:jetty-security:$jettyVersion",
    'jettyClient': "org.eclipse.jetty:jetty-client:$jettyVersion",
    'jettyJmx': "org.eclipse.jetty:jetty-jmx:$jettyVersion",
    'jettison': 'org.codehaus.jettison:jettison:1.5.4',
    'jgrapht': 'org.jgrapht:jgrapht-core:1.5.3',
    'jna': 'net.java.dev.jna:jna:5.12.1',
    'jsonPatch': 'jakarta.json:jakarta.json-api:2.1.3',
    'jsonPathImpl': 'org.eclipse.parsson:parsson:1.1.6',
    'jsonSimple': 'com.googlecode.json-simple:json-simple:1.1.1',
    'jsonSmart': 'net.minidev:json-smart:2.5.2',
    'json': 'org.json:json:20231013',
    'jsonSchemaValidator': 'com.github.java-json-tools:json-schema-validator:2.2.14',
    'junit': 'junit:junit:4.13.2',
    'junitJupiterApi': "org.junit.jupiter:junit-jupiter-api:$junitJupiterVersion",
    'junitJupiterParams': "org.junit.jupiter:junit-jupiter-params:$junitJupiterVersion",
    'junitJupiterEngine': "org.junit.jupiter:junit-jupiter-engine:$junitJupiterVersion",
    // Avro SerDe / SR client: pin separately from kafka-clients (see confluentSerdeVersion).
    'kafkaAvroSerde': "io.confluent:kafka-streams-avro-serde:$confluentSerdeVersion",
    'kafkaAvroSerializer': "io.confluent:kafka-avro-serializer:$confluentSerdeVersion",
    'kafkaClients': "org.apache.kafka:kafka-clients:$kafkaVersion-ccs",
    // kafka-clients OAUTHBEARER JWT validation is compileOnly upstream (KAFKA-20184).
    // 0.9.6 is latest on Maven Central, Kafka-aligned, and patches CVE-2024-29371.
    'jose4j': 'org.bitbucket.b_c:jose4j:0.9.6',
    'snappy': 'org.xerial.snappy:snappy-java:1.1.10.7',
    'janino': "org.codehaus.janino:janino:$janinoVersion",
    'lokiLogbackAppender': "com.github.loki4j:loki-logback-appender:$lokiLogbackAppenderVersion",
    'logbackClassic': "ch.qos.logback:logback-classic:$logbackClassic",
    'slf4jApi': "org.slf4j:slf4j-api:$slf4jVersion",
    'log4jCore': "org.apache.logging.log4j:log4j-core:$log4jVersion",
    'log4jApi': "org.apache.logging.log4j:log4j-api:$log4jVersion",
    'log4j12Api': "org.slf4j:log4j-over-slf4j:$slf4jVersion",
    'log4j2Api': "org.apache.logging.log4j:log4j-to-slf4j:$log4jVersion",
    'lombok': 'org.projectlombok:lombok:1.18.42',
    // Fork with maintained JNI natives; root resolutionStrategy maps org.lz4:lz4-java here too
    'lz4Java': 'at.yawk.lz4:lz4-java:' + lz4JavaVersion,
    'mavenArtifact': "org.apache.maven:maven-artifact:$mavenVersion",
    'mixpanel': 'com.mixpanel:mixpanel-java:1.4.4',
    'mockito': 'org.mockito:mockito-core:5.20.0',
    'mockServer': 'org.mock-server:mockserver-netty:5.15.0',
    'mockServerClient': 'org.mock-server:mockserver-client-java:5.15.0',
    'mysqlConnector': 'com.mysql:mysql-connector-j:9.4.0',
    'mariadbConnector': 'org.mariadb.jdbc:mariadb-java-client:2.7.12',
    'gcpCloudSqlConnector': 'com.google.cloud.sql:mysql-socket-factory-connector-j-8:1.25.3',
    'testContainersNeo4j': 'org.testcontainers:neo4j:' + testContainersVersion,
    'neo4jJavaDriver': 'org.neo4j.driver:neo4j-java-driver:' + neo4jVersion,
    'nettyReactor': "io.projectreactor.netty:reactor-netty-http:${reactorNettyVersion}",
    'nettyCore': "io.projectreactor.netty:reactor-netty-core:${reactorNettyVersion}",
    'neo4jApocCore': 'org.neo4j.procedure:apoc-core:' + neo4jApocVersion,
    'neo4jApocCommon': 'org.neo4j.procedure:apoc-common:' + neo4jApocVersion,
    'opentelemetryApi': 'io.opentelemetry:opentelemetry-api:' + openTelemetryVersion,
    'opentelemetrySdk': 'io.opentelemetry:opentelemetry-sdk:' + openTelemetryVersion,
    'opentelemetrySdkTrace': 'io.opentelemetry:opentelemetry-sdk-trace:' + openTelemetryVersion,
    'opentelemetrySdkMetrics': 'io.opentelemetry:opentelemetry-sdk-metrics:' + openTelemetryVersion,
    'opentelemetryAutoConfig': 'io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:' + openTelemetryVersion,
    'opentelemetryExporter': 'io.opentelemetry:opentelemetry-exporter-otlp:' + openTelemetryVersion,
    'openTelemetryExporterLogging': 'io.opentelemetry:opentelemetry-exporter-logging:' + openTelemetryVersion,
    'openTelemetryExporterCommon': 'io.opentelemetry:opentelemetry-exporter-otlp-common:' + openTelemetryVersion,
    'opentelemetryAnnotations': 'io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations:2.27.0',
    'opentelemetrySdkTesting': 'io.opentelemetry:opentelemetry-sdk-testing:' + openTelemetryVersion,
    'opentracingJdbc':'io.opentracing.contrib:opentracing-jdbc:0.2.15',
    // Parquet stack aligned (parquet-jackson shades Jackson; see ext.parquetVersion).
    'parquet': "org.apache.parquet:parquet-avro:${parquetVersion}",
    'parquetHadoop': "org.apache.parquet:parquet-hadoop:${parquetVersion}",
    'parquetJackson': "org.apache.parquet:parquet-jackson:${parquetVersion}",
    'picocli': 'info.picocli:picocli:4.5.0',
    // org.playframework JARs: no version here — datahub-frontend uses platform(play-bom) and $playVersion on that BOM only.
    'playCache': "org.playframework:play-cache_$playScalaVersion",
    'playCaffeineCache': "org.playframework:play-caffeine-cache_$playScalaVersion",
    'playWs': "org.playframework:play-ahc-ws_$playScalaVersion",
    // Explicit version so dependency locking / isolated resolves still resolve when BOM order differs.
    'playDocs': "org.playframework:play-docs_$playScalaVersion:$playVersion",
    'playGuice': "org.playframework:play-guice_$playScalaVersion",
    // Required at runtime for play.data.validation.Constraints (e.g. sign-up email validation);
    // compile-only transitives do not land in the staged Play distribution lib/.
    'playJavaForms': "org.playframework:play-java-forms_$playScalaVersion",
    'playPekkoHttpServer': "org.playframework:play-pekko-http-server_$playScalaVersion",
    'playServer': "org.playframework:play-server_$playScalaVersion",
    'playTest': "org.playframework:play-test_$playScalaVersion",
    'playFilters': "org.playframework:play-filters-helpers_$playScalaVersion",
    'pac4j': 'org.pac4j:pac4j-oidc:6.4.2',
    'playPac4j': "org.pac4j:play-pac4j_$playScalaVersion:13.0.2-PLAY3.0",
    // CVE-2026-54291: channel-binding auth downgrade fixed in 42.7.12+
    'postgresql': 'org.postgresql:postgresql:42.7.12',
    'protobuf': 'com.google.protobuf:protobuf-java:4.32.0',
    'grpcProtobuf': "io.grpc:grpc-protobuf:$grpcVersion",
    'rangerCommons': 'org.apache.ranger:ranger-plugins-common:2.3.0',
    'reflections': 'org.reflections:reflections:0.9.12',
    'resilience4j': 'io.github.resilience4j:resilience4j-retry:1.7.1',
    'rythmEngine': 'org.rythmengine:rythm-engine:1.3.0',
    'servletApi': 'jakarta.servlet:jakarta.servlet-api:6.1.0',
    // CVE-2026-23903 / CVE-2026-23901: fixed in Shiro 2.1.0+; CVE-2026-49268 (DefaultLdapRealm LDAP DN injection): 2.2.1+
    'shiroCore': 'org.apache.shiro:shiro-core:2.2.1',
    'snakeYaml': 'org.yaml:snakeyaml:2.0',
    'sparkSql' : 'org.apache.spark:spark-sql_2.12:3.5.0',
    'sparkHive' : 'org.apache.spark:spark-hive_2.12:3.5.0',
    'springBeans': "org.springframework:spring-beans:$springVersion",
    'springContext': "org.springframework:spring-context:$springVersion",
    'springCore': "org.springframework:spring-core:$springVersion",
    'springDocUI': 'org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.2',
    'springJdbc': "org.springframework:spring-jdbc:$springVersion",
    'springWeb': "org.springframework:spring-web:$springVersion",
    'springWebMVC': "org.springframework:spring-webmvc:$springVersion",
    'springBootTest': "org.springframework.boot:spring-boot-starter-test:$springBootVersion",
    'springBoot': "org.springframework.boot:spring-boot:$springBootVersion",
    'springBootAutoconfigure': "org.springframework.boot:spring-boot-autoconfigure:$springBootVersion",
    // Bridge for Jackson 2 (com.fasterxml) until full migration to Jackson 3 (tools.jackson)
    'springBootJackson2': "org.springframework.boot:spring-boot-jackson2:$springBootVersion",
    'springBootStarterWeb': "org.springframework.boot:spring-boot-starter-web:$springBootVersion",
    'springBootStarterJetty': "org.springframework.boot:spring-boot-starter-jetty:$springBootVersion",
    'springBootStarterCache': "org.springframework.boot:spring-boot-starter-cache:$springBootVersion",
    'springBootStarterValidation': "org.springframework.boot:spring-boot-starter-validation:$springBootVersion",
    'springAuthorizationServer': "org.springframework.security:spring-security-oauth2-authorization-server:${springSecurityVersion}",
    'springSecurityTest': "org.springframework.security:spring-security-test:${springSecurityVersion}",
    'springKafka': "org.springframework.kafka:spring-kafka:$springKafkaVersion",
    'springActuator': "org.springframework.boot:spring-boot-starter-actuator:$springBootVersion",
    // Spring Boot 4.0: Kafka and Micrometer auto-configs moved to separate modules
    'springBootKafka': "org.springframework.boot:spring-boot-kafka:$springBootVersion",
    'springBootMicrometerMetrics': "org.springframework.boot:spring-boot-micrometer-metrics:$springBootVersion",
    // Spring Boot 4.0: Jetty, Cassandra, Elasticsearch auto-configs moved to separate modules
    'springBootJetty': "org.springframework.boot:spring-boot-jetty:$springBootVersion",
    'springBootCassandra': "org.springframework.boot:spring-boot-cassandra:$springBootVersion",
    'springBootElasticsearch': "org.springframework.boot:spring-boot-elasticsearch:$springBootVersion",
    // Spring Boot 4.0: WebMvc test slice moved to separate module
    'springBootWebMvcTest': "org.springframework.boot:spring-boot-webmvc-test:$springBootVersion",
    'springRetry': "org.springframework.retry:spring-retry:2.0.12",
    'swaggerAnnotations': 'io.swagger.core.v3:swagger-annotations:2.2.30',
    'swaggerCli': 'io.swagger.codegen.v3:swagger-codegen-cli:3.0.46',
    'swaggerCore': 'io.swagger.core.v3:swagger-core:2.2.30',
    'swaggerParser': 'io.swagger.parser.v3:swagger-parser:2.1.27',
    'springBootAutoconfigureJdk11': 'org.springframework.boot:spring-boot-autoconfigure:2.7.18',
    'testng': 'org.testng:testng:7.8.0',
    'testContainers': 'org.testcontainers:testcontainers:' + testContainersVersion,
    'testContainersJunit': 'org.testcontainers:junit-jupiter:' + testContainersVersion,
    'testContainersPostgresql':'org.testcontainers:postgresql:' + testContainersVersion,
    'testContainersMysql': 'org.testcontainers:mysql:' + testContainersVersion,
    'testContainersElasticsearch': 'org.testcontainers:elasticsearch:' + testContainersVersion,
    'testContainersCassandra': 'org.testcontainers:cassandra:' + testContainersVersion,
    'testContainersKafka': 'org.testcontainers:kafka:' + testContainersVersion,
    'testContainersOpenSearch': 'org.opensearch:opensearch-testcontainers:2.1.3',
    'fabric8KubernetesClient': 'io.fabric8:kubernetes-client:7.4.0',
    'typesafeConfig':'com.typesafe:config:1.4.1',
    'wiremock':'com.github.tomakehurst:wiremock:2.10.0',
    'zookeeper': 'org.apache.zookeeper:zookeeper:3.8.6',
    'wire': "com.squareup.wire:wire-compiler:${wireVersion}",
    'charle':  'com.charleskorn.kaml:kaml:0.53.0',
    'jline':'jline:jline:1.4.1',
    'jetbrains':' org.jetbrains.kotlin:kotlin-stdlib:1.6.0',
    'annotationApi': 'jakarta.annotation:jakarta.annotation-api:3.0.0',
    'jakartaAnnotationApi': 'jakarta.annotation:jakarta.annotation-api:3.0.0',
    'classGraph': 'io.github.classgraph:classgraph:4.8.172',
    'mustache': 'com.github.spullara.mustache.java:compiler:0.9.14',
    'javaxMail': 'com.sun.mail:jakarta.mail:2.0.2',
    // Standard compatibility artifact to satisfy legacy javax.mail references while keeping jakarta.mail upgraded.
    'javaxMailCompat': 'com.sun.mail:javax.mail:1.6.2'
]

allprojects {
  // Gradle 9 removed Project.exec/javaexec; route build-script exec/javaexec through the injected
  // ExecOperations service exposed here as `execOps` (see buildSrc InjectedExecOps).
  ext.execOps = objects.newInstance(io.datahubproject.InjectedExecOps).execOperations

  apply plugin: 'idea'
  apply plugin: 'eclipse'
  // apply plugin: 'org.gradlex.java-ecosystem-capabilities'

  // Apply test-logger plugin for better test output
  apply plugin: 'com.adarshr.test-logger'

  testlogger {
    theme = 'mocha' // Clean, modern output
    showExceptions = true
    showStackTraces = true
    showFullStackTraces = false
    showCauses = true
    showSummary = true
    showPassed = false // Only show failures for cleaner output
    showSkipped = true
    showFailed = true
    showStandardStreams = false
    showPassedStandardStreams = false
    showSkippedStandardStreams = false
    showFailedStandardStreams = true
  }

  tasks.withType(Test).configureEach { task ->
    environment "DATAHUB_SYSTEM_CLIENT_SECRET", "TestOnlyNotASecret"
    // Gradle 9 flips failOnNoDiscoveredTests to true: a test task with sources but zero discovered
    // tests now fails (Gradle 8 passed silently). Some modules legitimately have only helper/support
    // test sources, so restore the Gradle-8 behaviour globally.
    failOnNoDiscoveredTests = false
    if (task.project.name != "metadata-io") {
      // https://docs.gradle.org/current/userguide/performance.html
      maxParallelForks = Runtime.runtime.availableProcessors().intdiv(2) ?: 1

      if (project.configurations.getByName("testImplementation").getDependencies()
              .any { it.getName().contains("testng") }) {
        useTestNG()
        // Configure TestNG to work better with test-logger
        testLogging {
          events "failed", "skipped"
          exceptionFormat "full"
          showStandardStreams = false
        }
      }
    }
  }

  /**
   * If making changes to this section also see the sections for pegasus below
   * which use project.plugins.hasPlugin('pegasus')
   **/
  if (!project.plugins.hasPlugin('pegasus') && (project.plugins.hasPlugin('java')
          || project.plugins.hasPlugin('java-library')
          || project.plugins.hasPlugin('application'))) {

    java {
      toolchain {
        languageVersion = JavaLanguageVersion.of(jdkVersion(project))
      }
    }

    compileJava {
      options.release = javaClassVersion(project)
    }

    tasks.withType(JavaCompile).configureEach {
      javaCompiler = javaToolchains.compilerFor {
        languageVersion = JavaLanguageVersion.of(jdkVersion(project))
      }
      // Puts parameter names into compiled class files, necessary for Spring 6
      options.compilerArgs.add("-parameters")
    }

    tasks.withType(JavaExec).configureEach {
      javaLauncher = javaToolchains.launcherFor {
        languageVersion = JavaLanguageVersion.of(jdkVersion(project))
      }
    }
  }

  // not duplicated, need to set this outside and inside afterEvaluate
  afterEvaluate {
    /**
     * If making changes to this section also see the sections for pegasus below
     * which use project.plugins.hasPlugin('pegasus')
     **/
    if (!project.plugins.hasPlugin('pegasus') && (project.plugins.hasPlugin('java')
            || project.plugins.hasPlugin('java-library')
            || project.plugins.hasPlugin('application'))) {

      compileJava {
        options.release = javaClassVersion(project)
      }

      tasks.withType(JavaExec).configureEach {
        javaLauncher = javaToolchains.launcherFor {
          languageVersion = JavaLanguageVersion.of(jdkVersion(project))
        }
      }
    }
  }
}

configure(subprojects.findAll {! it.name.startsWith('spark-lineage')}) {

  configurations.all {
    // Replace LinkedIn’s helper-all 0.2.138 (vulnerable embedded commons-lang3) with the in-repo
    // fat JAR in :vendor:avroutil1-helper-all-fork. See that module’s build.gradle and dependency locks.
    resolutionStrategy.dependencySubstitution { DependencySubstitutions s ->
      // "project(...)" unqualified is Project#project here, not DependencySubstitutions#project; use s.project(...).
      s.substitute(s.module("com.linkedin.avroutil1:helper-all:0.2.138"))
        .using(s.project(":vendor:avroutil1-helper-all-fork"))
        .because("CVE-patched avro-util helper-all (see vendor/avroutil1-helper-all-fork)")
    }

    exclude group: "io.netty", module: "netty"
    exclude group: "log4j", module: "log4j"
    exclude group: "org.springframework.boot", module: "spring-boot-starter-logging"
    exclude group: "com.vaadin.external.google", module: "android-json"
    exclude group: "org.slf4j", module: "slf4j-reload4j"
    exclude group: "org.slf4j", module: "slf4j-log4j12"
    exclude group: "org.slf4j", module: "slf4j-nop"
    exclude group: "org.slf4j", module: "slf4j-ext"
    exclude group: "org.codehaus.jackson", module: "jackson-mapper-asl"
    exclude group: "javax.mail", module: "mail"
    exclude group: 'org.glassfish', module: 'javax.json'
    exclude group: 'org.glassfish', module: 'jakarta.json'
    exclude group: 'com.typesafe.play', module: 'shaded-asynchttpclient'
    exclude group: "com.typesafe.akka", module: "akka-protobuf-v3_$playScalaVersion"
    exclude group: "org.apache.pekko", module: "pekko-protobuf-v3_$playScalaVersion"
    exclude group: 'com.typesafe.play', module: 'shaded-oauth'
    exclude group: 'commons-httpclient', module: 'commons-httpclient'
    exclude group: 'commons-collections', module: 'commons-collections'
    exclude group: 'commons-lang', module: 'commons-lang'
    // DataHub does not use gRPC transport; Pegasus/Rest.li pull grpc-netty-shaded transitively.
    // Excluded to drop the shaded Netty copy (CVE-2026-42579, CVE-2026-42581, CVE-2026-42584; fixed in Netty 4.1.133+ / 4.2.13+ on the app classpath via nettyVersion).
    exclude group: 'io.grpc', module: 'grpc-netty-shaded'

    // Tomcat excluded for jetty
    exclude group: 'org.apache.tomcat.embed', module: 'tomcat-embed-el'
    exclude group: 'org.springframework.boot', module: 'spring-boot-starter-tomcat'

    // Pin the datasource impl to the version ebean-core 16.2.0 is built/tested against
    // (ebean-parent-16.2.0 sets ebean-datasource.version=10.2). ebean-core pulls
    // ebean-datasource-api:10.2 at compile scope, so leaving the old 9.1 impl force in place
    // split api(10.2)/impl(9.1) across a major bump -> AbstractMethodError/NoSuchMethodError risk.
    resolutionStrategy.force 'io.ebean:ebean-datasource:10.2'
    resolutionStrategy.force externalDependency.antlr4Runtime
    resolutionStrategy.force externalDependency.antlr4
    resolutionStrategy.force externalDependency.gson // Gson before 2.8.9: deserialization DoS; single version across all configs
    resolutionStrategy.force externalDependency.rhino
    resolutionStrategy.force 'commons-beanutils:commons-beanutils:1.11.0'
    resolutionStrategy.force 'org.apache.commons:commons-collections4:4.5.0'
    resolutionStrategy.force externalDependency.commonsLang3
    resolutionStrategy.force "io.vertx:vertx-core:${rootProject.ext.vertxVersion}"
    resolutionStrategy.force "io.vertx:vertx-auth-common:${rootProject.ext.vertxVersion}"
    resolutionStrategy.force "io.vertx:vertx-web-client:${rootProject.ext.vertxVersion}"
    // Mockito's inline mock maker needs byte-buddy and byte-buddy-agent at the SAME version, and
    // >= 1.17.5 (ASM 9.8) to instrument Java 25 (class-file major 69) runtime classes such as
    // java.lang.Object. Transitive resolution otherwise skews them (core 1.18.3 vs agent 1.17.7),
    // producing "Byte Buddy could not instrument all classes" on JDK 25 (e.g. scim-api tests). Pin both, matched.
    resolutionStrategy.force "net.bytebuddy:byte-buddy:${rootProject.ext.byteBuddyVersion}"
    resolutionStrategy.force "net.bytebuddy:byte-buddy-agent:${rootProject.ext.byteBuddyVersion}"
    resolutionStrategy.force "io.vertx:vertx-web-common:${rootProject.ext.vertxVersion}"
    resolutionStrategy.force "org.apache.commons:commons-compress:${rootProject.ext.commonsCompressVersion}"
    resolutionStrategy.force "org.apache.hive:hive-llap-common:${rootProject.ext.hiveLlapCommonVersion}"
    resolutionStrategy.force "org.apache.hadoop:hadoop-common:${rootProject.ext.hadoop3Version}"
    resolutionStrategy.force "org.apache.hadoop:hadoop-client:${rootProject.ext.hadoop3Version}"
    resolutionStrategy.force "org.bouncycastle:bcpkix-jdk18on:${rootProject.ext.bouncyCastleJdk18onVersion}"
    resolutionStrategy.force "org.bouncycastle:bcprov-jdk18on:${rootProject.ext.bouncyCastleJdk18onVersion}"
    resolutionStrategy.force "org.bouncycastle:bcutil-jdk18on:${rootProject.ext.bouncyCastleJdk18onVersion}"
    resolutionStrategy.force "org.springframework.kafka:spring-kafka:${rootProject.ext.springKafkaVersion}"
    // Keep Confluent Avro SerDe / SR client on 8.1 while kafka-clients is 8.2 (see confluentSerdeVersion).
    // Force kafka-clients up so SerDe 8.1 cannot downgrade it via its transitive 8.1.0-ccs dep.
    resolutionStrategy.force "org.apache.kafka:kafka-clients:${rootProject.ext.kafkaVersion}-ccs"
    resolutionStrategy.force "io.confluent:kafka-avro-serializer:${rootProject.ext.confluentSerdeVersion}"
    resolutionStrategy.force "io.confluent:kafka-streams-avro-serde:${rootProject.ext.confluentSerdeVersion}"
    resolutionStrategy.force "io.confluent:kafka-schema-registry-client:${rootProject.ext.confluentSerdeVersion}"
    resolutionStrategy.force "io.confluent:kafka-schema-serializer:${rootProject.ext.confluentSerdeVersion}"
    resolutionStrategy.force "io.confluent:kafka-avro-types:${rootProject.ext.confluentSerdeVersion}"
    resolutionStrategy.force "io.confluent:kafka-schema-types:${rootProject.ext.confluentSerdeVersion}"
    resolutionStrategy.force "org.jline:jline:${rootProject.ext.jlineVersion}"
    resolutionStrategy.force "io.airlift:aircompressor:${rootProject.ext.aircompressorVersion}"
    resolutionStrategy.force externalDependency.zookeeper  // CVE-2023-44981; overrides d2's 3.6.3
    resolutionStrategy.force 'org.apache.thrift:libthrift:0.23.0' // CVE-2026-43869; transitive via jena-arq
    // eachDependency: upgrade vulnerable versions only (do not downgrade newer safe versions)
    resolutionStrategy.eachDependency { details ->
      if (details.requested.group == 'org.lz4' && details.requested.name == 'lz4-java') {
        details.useTarget(rootProject.ext.externalDependency.lz4Java)
        details.because("CVE-2025-12183, CVE-2026-59949; align org.lz4:lz4-java to at.yawk fork (${rootProject.ext.lz4JavaVersion})")
      }
      if (details.requested.group == 'org.apache.mina' && details.requested.name == 'mina-core') {
        details.useTarget("org.apache.mina:mina-core:${rootProject.ext.minaCoreVersion}")
        details.because("CVE-2024-52046, ObjectSerializationDecoder deserialization/RCE")
      }
      if (details.requested.group == 'org.apache.hadoop.thirdparty' && details.requested.name == 'hadoop-shaded-protobuf_3_25') {
        details.useVersion(rootProject.ext.hadoopShadedProtobuf_3_25_Version)
        details.because("hadoop-shaded-protobuf_3_25 ${rootProject.ext.hadoopShadedProtobuf_3_25_Version}; CVE-2017-3162 is in hadoop-hdfs DataNode (fixed 2.7.0+, we use hadoop-client ${rootProject.ext.hadoop3Version})")
      }
      if (details.requested.group == 'org.apache.hadoop.thirdparty' && details.requested.name == 'hadoop-shaded-guava') {
        details.useVersion(rootProject.ext.hadoopShadedGuavaVersion)
        details.because("hadoop-shaded-guava ${rootProject.ext.hadoopShadedGuavaVersion}; CVE-2024-23454 is RunJar in hadoop-common (fixed 3.4.0+, we use hadoop-client ${rootProject.ext.hadoop3Version})")
      }
      // Align all Jackson modules to jacksonVersion (e.g. Play pegasusPlugin classpath ~2.10.x).
      // jackson-annotations uses the minor-only line in Jackson 2.21+ (see jackson-bom).
      if (details.requested.group == 'com.fasterxml.jackson.core' || details.requested.group == 'com.fasterxml.jackson.dataformat' || details.requested.group == 'com.fasterxml.jackson.datatype' || details.requested.group == 'com.fasterxml.jackson.module') {
        def v = rootProject.ext.jacksonVersion
        if (details.requested.group == 'com.fasterxml.jackson.core' && details.requested.name == 'jackson-annotations') {
          v = rootProject.ext.jacksonMinorRelease
        }
        details.useTarget("${details.requested.group}:${details.requested.name}:${v}")
        details.because("Jackson aligned to ${v}")
      }
      // Align all Netty modules to nettyVersion (e.g. from awssdk netty-nio-client).
      // Exclude netty-tcnative-*: they use a separate 2.x version line and have no 4.1.x release.
      if (details.requested.group == 'io.netty' && !details.requested.name.startsWith('netty-tcnative')) {
        details.useVersion(rootProject.ext.nettyVersion)
        details.because("Netty aligned to ${rootProject.ext.nettyVersion} for CVE fixes")
      }
      if (details.requested.group == 'com.squareup.wire') {
        details.useVersion(rootProject.ext.wireVersion)
        details.because("CVE-2026-45799; wire-runtime skipGroup() negative-length crash (fixed ${rootProject.ext.wireVersion}+)")
      }
      if (details.requested.group == 'io.grpc') {
        details.useVersion(rootProject.ext.grpcVersion)
        details.because("gRPC stack aligned to ${rootProject.ext.grpcVersion} (grpc-netty-shaded excluded — no gRPC transport)")
      }
      if (details.requested.group == 'io.projectreactor.netty') {
        details.useVersion(rootProject.ext.reactorNettyVersion)
        details.because("reactor-netty aligned to ${rootProject.ext.reactorNettyVersion} for CVE fixes")
      }
      if (details.requested.group == 'org.jline') {
        details.useVersion(rootProject.ext.jlineVersion)
        details.because("JLine aligned to ${rootProject.ext.jlineVersion} for CVE/GHSA fixes")
      }
      // Exclude opentelemetry-semconv (legacy alpha line; semconv lives under io.opentelemetry.semconv)
      // and opentelemetry-api-incubator (separate -alpha release line; not published at the stable version).
      if (details.requested.group == 'io.opentelemetry'
          && details.requested.name != 'opentelemetry-semconv'
          && details.requested.name != 'opentelemetry-api-incubator') {
        details.useVersion(rootProject.ext.openTelemetryVersion)
        details.because("OpenTelemetry aligned to ${rootProject.ext.openTelemetryVersion} for CVE-2026-45292")
      }
      if (details.requested.group == 'org.apache.parquet') {
        details.useVersion(rootProject.ext.parquetVersion)
        details.because("Parquet stack aligned to ${rootProject.ext.parquetVersion}")
      }
    }
    resolutionStrategy.force rootProject.ext.externalDependency.get('guava')
    resolutionStrategy.force rootProject.ext.externalDependency.lz4Java
    resolutionStrategy.force "com.fasterxml.jackson.core:jackson-core:${rootProject.ext.jacksonVersion}"  // GHSA-72hv-8253-57qq (e.g. from hazelcast); Pegasus plugin classpath (CVE-2025-52999)
    resolutionStrategy.force "com.fasterxml.jackson.core:jackson-annotations:${rootProject.ext.jacksonMinorRelease}"
    resolutionStrategy.force "com.fasterxml.jackson.core:jackson-databind:${rootProject.ext.jacksonVersion}"  // CVE-2026-54512/54513/54514/54516/54517/54518/59888 (2.21.4); CVE-2026-54515/59889, GHSA-mhm7-754m-9p8w (2.21.5)
    resolutionStrategy.force "org.springframework.security:spring-security-oauth2-jose:${rootProject.ext.springSecurityVersion}"  // CVE-2026-22748
    resolutionStrategy.force "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:${rootProject.ext.jacksonVersion}"
    resolutionStrategy.force rootProject.ext.externalDependency.get('parquetJackson')
    resolutionStrategy.capabilitiesResolution.withCapability('org.lz4:lz4-java') {
      select(candidates.find { it.id.group == 'at.yawk.lz4' } ?: candidates.first())
    }
    resolutionStrategy.force 'org.junit.platform:junit-platform-engine:1.12.2'
    resolutionStrategy.force 'org.junit.platform:junit-platform-launcher:1.12.2'
    resolutionStrategy.force "org.junit.jupiter:junit-jupiter-api:${rootProject.ext.junitJupiterVersion}"
    resolutionStrategy.force "org.junit.jupiter:junit-jupiter-engine:${rootProject.ext.junitJupiterVersion}"
    resolutionStrategy.force "org.junit.jupiter:junit-jupiter-params:${rootProject.ext.junitJupiterVersion}"
    resolutionStrategy.force "org.junit:junit-bom:${rootProject.ext.junitJupiterVersion}"
    // Force all Jetty 12 modules to same version (overrides BOM and dependency lock). Single list used for
    // both force() and allprojects eachDependency so 12.0.x and 12.1.x are never mixed (API incompatible).
    def jv = project.rootProject.ext.jettyVersion
    [
      'org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jakarta-client',
      'org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jakarta-common',
      'org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jakarta-server',
      'org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server',
      'org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-servlet',
      'org.eclipse.jetty.ee10:jetty-ee10-annotations',
      'org.eclipse.jetty.ee10:jetty-ee10-plus',
      'org.eclipse.jetty.ee10:jetty-ee10-servlet',
      'org.eclipse.jetty.ee10:jetty-ee10-servlets',
      'org.eclipse.jetty.ee10:jetty-ee10-webapp',
      'org.eclipse.jetty.websocket:jetty-websocket-core-client',
      'org.eclipse.jetty.websocket:jetty-websocket-core-common',
      'org.eclipse.jetty.websocket:jetty-websocket-core-server',
      'org.eclipse.jetty.websocket:jetty-websocket-jetty-api',
      'org.eclipse.jetty.websocket:jetty-websocket-jetty-common',
      'org.eclipse.jetty:jetty-alpn-client',
      'org.eclipse.jetty:jetty-client',
      'org.eclipse.jetty:jetty-ee',
      'org.eclipse.jetty:jetty-http',
      'org.eclipse.jetty:jetty-io',
      'org.eclipse.jetty:jetty-plus',
      'org.eclipse.jetty:jetty-security',
      'org.eclipse.jetty:jetty-server',
      'org.eclipse.jetty:jetty-session',
      'org.eclipse.jetty:jetty-xml',
    ].each { resolutionStrategy.force "${it}:${jv}" }
  }
}

// Spark-lineage only: force CVE-pinned versions (not applied to rest of repo).
configure(subprojects.findAll { it.name == 'acryl-spark-lineage' }) {
  configurations.all {
    resolutionStrategy.force rootProject.ext.externalDependency.get('parquetJackson')
    resolutionStrategy.force "io.airlift:aircompressor:${rootProject.ext.aircompressorVersion}"
    resolutionStrategy.force "dnsjava:dnsjava:${rootProject.ext.sparkLineageDnsjavaVersion}"
    resolutionStrategy.force "org.codehaus.jettison:jettison:${rootProject.ext.sparkLineageJettisonVersion}"
    resolutionStrategy.force "com.nimbusds:nimbus-jose-jwt:${rootProject.ext.sparkLineageNimbusJoseJwtVersion}"
    resolutionStrategy.force "org.apache.commons:commons-configuration2:${rootProject.ext.commonsConfiguration2Version}"
    resolutionStrategy.force "org.eclipse.jetty:jetty-servlet:${rootProject.ext.sparkLineageJetty94Version}"
    resolutionStrategy.force "org.eclipse.jetty:jetty-util-ajax:${rootProject.ext.sparkLineageJetty94Version}"
    resolutionStrategy.force "org.eclipse.jetty:jetty-webapp:${rootProject.ext.sparkLineageJetty94Version}"
  }
}

// Also align any other Jetty 12 modules (e.g. future BOM additions). Exclude legacy Jetty 9.x websocket
// artifacts (websocket-api, websocket-client, websocket-common) used by Hadoop etc.; no 12.x for those.
allprojects {
  if (project == rootProject || project.name == 'acryl-spark-lineage') return
  configurations.all {
    resolutionStrategy.eachDependency { details ->
      if (details.requested.group.startsWith('org.eclipse.jetty') &&
          !(details.requested.name in ['websocket-api', 'websocket-client', 'websocket-common'])) {
        details.useVersion(rootProject.ext.jettyVersion)
        details.because("Align all Jetty modules to ${rootProject.ext.jettyVersion}")
      }
    }
  }
}

apply plugin: 'com.gorylenko.gradle-git-properties'
gitProperties {
  keys = ['git.commit.id','git.commit.id.describe','git.commit.time']
  // using any tags (not limited to annotated tags) for "git.commit.id.describe" property
  // see http://ajoberstar.org/grgit/grgit-describe.html for more info about the describe method and available parameters
  // 'it' is an instance of org.ajoberstar.grgit.Grgit
  customProperty 'git.commit.id.describe', { it.describe(tags: true) }
  gitPropertiesResourceDir = rootProject.buildDir
  failOnNoGitDirectory = false
}

def gitPropertiesGenerated = false

apply from: 'gradle/versioning/versioning-global.gradle'

tasks.register("generateGitPropertiesGlobal", com.gorylenko.GenerateGitPropertiesTask) {
  doFirst {
    if (!gitPropertiesGenerated) {
      println "Generating git.properties"
      gitPropertiesGenerated = true
    } else {
      // Skip actual execution if already run
      onlyIf { false }
    }
  }
}

subprojects {

  apply plugin: 'maven-publish'
  apply plugin: 'com.diffplug.spotless'

  // Enable dependency locking for all configurations
  dependencyLocking {
    lockAllConfigurations()
    // Root build.gradle substitutes com.linkedin.avroutil1:helper-all:0.2.138 with
    // :vendor:avroutil1-helper-all-fork. The external module is never resolved from a repo,
    // so strict lock validation would fail on existing lockfile lines for helper-all.
    ignoredDependencies.add("com.linkedin.avroutil1:helper-all")
  }

  def gitPropertiesTask = tasks.register("copyGitProperties", Copy) {
    dependsOn rootProject.tasks.named("generateGitPropertiesGlobal")
    def sourceFile = file("${rootProject.buildDir}/git.properties")
    from sourceFile
    into "$project.buildDir/resources/main"
  }

  plugins.withType(JavaPlugin).configureEach {
    if (project.name == 'avroutil1-helper-all-fork') {
      return
    }
    project.tasks.named(JavaPlugin.CLASSES_TASK_NAME).configure{
      dependsOn gitPropertiesTask
    }
    if (project.name == 'datahub-web-react') {
      return
    }
    /* TODO: evaluate ignoring jar timestamps for increased caching (compares checksum instead)
    jar {
      preserveFileTimestamps = false
    }*/

    // Exclude unwanted transitive dependencies from log4j (fixed in logging-parent 12.0.0)
    // See: https://github.com/apache/logging-log4j2/issues/3066
    // Note: jspecify exclusion was removed because Spring Framework 7.0 requires it at runtime
    // Exclude Jackson 3 (tools.jackson) — we use spring-boot-jackson2 bridge to stay on Jackson 2.
    // Spring Kafka 4.0 has Jackson 3 support but falls back to Jackson 2 when tools.jackson is absent.
    configurations.all {
      exclude group: 'biz.aQute.bnd', module: 'biz.aQute.bnd.annotation'
      exclude group: 'tools.jackson.core'
      exclude group: 'tools.jackson'
    }

    dependencies {
      implementation externalDependency.annotationApi
      constraints {
        implementation("com.google.googlejavaformat:google-java-format:$googleJavaFormatVersion")
        implementation("io.netty:netty-all:${rootProject.ext.nettyVersion}")
        implementation("io.netty:netty-codec:${rootProject.ext.nettyVersion}") // CVE-2025-58057
        implementation("io.netty:netty-handler:${rootProject.ext.nettyVersion}")
        implementation("io.netty:netty-resolver-dns-native-macos:${rootProject.ext.nettyVersion}")
        implementation("io.netty:netty-transport-native-epoll:${rootProject.ext.nettyVersion}")
        implementation("io.netty:netty-transport-native-kqueue:${rootProject.ext.nettyVersion}")
        implementation("io.netty:netty-transport-native-unix-common:${rootProject.ext.nettyVersion}")
        implementation("io.projectreactor.netty:reactor-netty-core:${rootProject.ext.reactorNettyVersion}")
        implementation("io.projectreactor.netty:reactor-netty-http:${rootProject.ext.reactorNettyVersion}")
        implementation("org.springframework.kafka:spring-kafka:${rootProject.ext.springKafkaVersion}") // CVE-2026-41731
        implementation("org.apache.logging.log4j:log4j-core:$log4jVersion") // GHSA-vc5p-v9hr-52mj
        implementation("org.apache.logging.log4j:log4j-jul:$log4jVersion")
        implementation("org.jline:jline:${rootProject.ext.jlineVersion}") // CVE-2023-50572; GHSA-2r2c-cx56-8933
        implementation("org.apache.commons:commons-configuration2:${commonsConfiguration2Version}") // CVE-2026-45205; GHSA-xjp4-hw94-mvp5
        implementation("org.springframework.security:spring-security-oauth2-jose:${springSecurityVersion}") // CVE-2026-22748
        implementation("org.apache.commons:commons-compress:${rootProject.ext.commonsCompressVersion}")
        implementation('org.apache.velocity:velocity-engine-core:2.4')
        implementation("com.fasterxml.jackson.core:jackson-databind:$jacksonVersion")
        implementation("com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:$jacksonVersion")
        implementation('com.squareup.okhttp3:okhttp:4.12.0')
        implementation("org.apache.httpcomponents.client5:httpclient5:${rootProject.ext.httpClient5Version}") // CVE-2026-40542
        implementation('org.apache.httpcomponents.core5:httpcore5:5.4.3') // CVE-2026-54399
        implementation('org.apache.httpcomponents.core5:httpcore5-h2:5.4.3') // CVE-2026-54399
        implementation("ch.qos.logback:logback-classic:${rootProject.ext.logbackClassic}") // CVE-2026-9828, CVE-2026-10532
        implementation("ch.qos.logback:logback-core:${rootProject.ext.logbackClassic}") // CVE-2026-9828, CVE-2026-10532
        implementation('org.playframework.netty:netty-reactive-streams:3.0.9')
        implementation('org.playframework.netty:netty-reactive-streams-http:3.0.9')
        implementation(externalDependency.commonsIo)
        implementation(externalDependency.protobuf)
        implementation(externalDependency.xercesImpl) // Xerces CVEs (2 high, 1 medium)
        implementation(externalDependency.gson) // Gson before 2.8.9: deserialization DoS (writeReplace)
      }
    }

    spotless {
      // Format checks run in lint-jobs.yml (spotless-check) and ./gradlew lintCheck,
      // not as part of check/build.
      enforceCheck false
      java {
        googleJavaFormat(googleJavaFormatVersion)
        target project.fileTree(project.projectDir) {
          include 'src/**/*.java'
          include 'app/**/*.java'
          include 'test/**/*.java'
          exclude 'src/**/resources/'
          exclude 'src/**/generated/'
          exclude 'src/**/mainGeneratedDataTemplate/'
          exclude 'src/**/mainGeneratedAvroSchema/'
          exclude 'src/**/mainGeneratedGraphQL/'
          exclude 'src/**/generatedJsonSchema/'
          exclude 'src/**/mainGeneratedRest/'
          exclude 'src/renamed/avro/'
          exclude 'src/test/sample-test-plugins/'
        }
      }
    }

    if (project.plugins.hasPlugin('pegasus')) {
      dependencies {
        dataTemplateCompile spec.product.pegasus.data
        dataTemplateCompile externalDependency.annotationApi // support > jdk8
        restClientCompile spec.product.pegasus.restliClient
      }

      java {
        toolchain {
          languageVersion = JavaLanguageVersion.of(jdkVersion(project))
        }
      }

      compileJava {
        options.release = javaClassVersion(project)
      }

      tasks.withType(JavaCompile).configureEach {
        javaCompiler = javaToolchains.compilerFor {
          languageVersion = JavaLanguageVersion.of(jdkVersion(project))
        }
        // Puts parameter names into compiled class files, necessary for Spring 6
        options.compilerArgs.add("-parameters")
      }

      tasks.withType(JavaExec).configureEach {
        javaLauncher = javaToolchains.launcherFor {
          languageVersion = JavaLanguageVersion.of(jdkVersion(project))
        }
      }
    }
  }

  afterEvaluate {
    if (project.plugins.hasPlugin('pegasus')) {
      dependencies {
        dataTemplateCompile spec.product.pegasus.data
        dataTemplateCompile externalDependency.annotationApi // support > jdk8
        restClientCompile spec.product.pegasus.restliClient
      }

      compileJava {
        options.release = javaClassVersion(project)
      }

      tasks.withType(JavaExec).configureEach {
        javaLauncher = javaToolchains.launcherFor {
          languageVersion = JavaLanguageVersion.of(jdkVersion(project))
        }
      }
    }
  }
}

wrapper {
  gradleVersion = project.versionGradle
  distributionType = Wrapper.DistributionType.ALL
  distributionSha256Sum = 'a3c4ba4aca8f0075688b9c5b18939fd28e8cb4357c227da5c1d9f38343791439'
}

def spotlessApplyTasks = subprojects.collect { "${it.path}:spotlessApply" }
def spotlessCheckTasks = subprojects.collect { "${it.path}:spotlessCheck" }

tasks.register('format') {
  dependsOn(':datahub-web-react:graphqlPrettierWrite')
  dependsOn(':datahub-web-react:githubActionsPrettierWrite')
  dependsOn(':datahub-web-react:mdPrettierWrite')
  dependsOn(spotlessApplyTasks)
  dependsOn(':scripts:dev:lintFix')
}

tasks.register('formatChanged') {
  dependsOn(':datahub-web-react:graphqlPrettierWriteChanged')
  dependsOn(':datahub-web-react:githubActionsPrettierWriteChanged')
  dependsOn(':datahub-web-react:mdPrettierWriteChanged')
  dependsOn(spotlessApplyTasks)
  dependsOn(':scripts:dev:lintFix')
}

tasks.register('lintCheck') {
  group = 'verification'
  description = 'Run all lint checks (Python, JS, GraphQL, markdown, Java)'
  dependsOn(':metadata-ingestion:lint')
  dependsOn(':datahub-actions:lint')
  dependsOn(':datahub-agent-context:lint')
  dependsOn(':metadata-ingestion-modules:airflow-plugin:lint')
  dependsOn(':metadata-ingestion-modules:gx-plugin:lint')
  dependsOn(':metadata-ingestion-modules:dagster-plugin:lint')
  dependsOn(':metadata-ingestion-modules:prefect-plugin:lint')
  dependsOn(':smoke-test:lint')
  dependsOn(':scripts:dev:lint')
  dependsOn(':datahub-web-react:lint')
  dependsOn(':datahub-web-react:graphqlPrettierCheck')
  dependsOn(':datahub-web-react:mdPrettierCheck')
  dependsOn(':datahub-web-react:githubActionsPrettierCheck')
  dependsOn(':datahub-web-react:docusaurusMarkdownLint')
  dependsOn(':docs-website:yarnLint')
  dependsOn(spotlessCheckTasks)
}

tasks.register('lintFix') {
  group = 'formatting'
  description = 'Auto-fix all lint issues'
  dependsOn('format')
  dependsOn(':metadata-ingestion:lintFix')
  dependsOn(':datahub-actions:lintFix')
  dependsOn(':datahub-agent-context:lintFix')
  dependsOn(':metadata-ingestion-modules:airflow-plugin:lintFix')
  dependsOn(':metadata-ingestion-modules:gx-plugin:lintFix')
  dependsOn(':metadata-ingestion-modules:dagster-plugin:lintFix')
  dependsOn(':metadata-ingestion-modules:prefect-plugin:lintFix')
  dependsOn(':datahub-web-react:lintFix')
  dependsOn(':docs-website:yarnLintFix')
  dependsOn(':smoke-test:lintFix')
  dependsOn(':e2e-test:ui:playwright:lintFix')
  dependsOn(':e2e-test:ui:playwright:prettierWrite')
  dependsOn(':metadata-service:iceberg-catalog:lintFix')
}

// Gradle 9 forbids resolving one project's configurations from another project's task
// (a root doLast looping over allprojects throws "attempted without an exclusive lock").
// Register a per-project resolver instead: each runs inside its OWN project's context, which
// holds that project's state lock, so resolving its configurations is legal. The aggregate
// task just fans out to them. Run with --write-locks to (re)generate every gradle.lockfile.
def perProjectLockResolvers = allprojects.collect { proj ->
  proj.tasks.register('resolveAndLockAllForProject') {
    description = "Resolves ${proj.path}'s configurations so --write-locks can persist them"
    group = 'dependency locking'
    notCompatibleWithConfigurationCache('Resolves configurations at execution time')
    doLast {
      proj.configurations.findAll { config ->
        config.canBeResolved && !config.name.toLowerCase().contains('detached')
      }.each { config ->
        try {
          config.resolve()
        } catch (Exception e) {
          logger.warn("Could not resolve configuration ${proj.path}:${config.name}: ${e.message}")
        }
      }
    }
  }
}

tasks.register('resolveAndLockAll') {
  description = 'Resolves all configurations across all projects to generate complete dependency lock files'
  group = 'dependency locking'
  dependsOn perProjectLockResolvers
}

// Explicit, CI-runnable SHA-256 check for the committed vendor build-plugin jars (they run at
// configuration time with full project access). The buildscript block above already verifies these
// on every build BEFORE loading them; this task exists so CI/devs can assert integrity on demand
// (./gradlew verifyVendorJars). Keep the hashes in sync with vendor/rest-li-fork/README.md.
tasks.register('verifyVendorJars') {
  description = 'Verify SHA-256 integrity of committed vendor build-plugin jars (supply-chain guard).'
  group = 'verification'
  def expected = [
    ("vendor/rest-li-fork/gradle-plugins-${pegasusVersion}-gradle9.jar".toString()):
      'a6f48cbb9f4889d274f725ea85db4e818b975d720f03daa80737f7531a5b15f8',
    ('vendor/rest-li-fork/gradle-swagger-generator-plugin-2.19.2-gradle9.jar'):
      'aa732dc7363f69bcd15c026cee697e5527ac8e1db80e7181e734d859b891ff0a',
  ]
  doLast {
    expected.each { rel, want ->
      def f = rootProject.file(rel)
      if (!f.exists()) throw new GradleException("Vendor jar missing: ${rel}")
      def got = java.security.MessageDigest.getInstance('SHA-256').digest(f.bytes).encodeHex().toString()
      if (got != want) {
        throw new GradleException("Vendor jar SHA-256 mismatch for ${rel}:\n  expected ${want}\n  actual   ${got}")
      }
    }
    logger.lifecycle("Vendor JAR integrity OK (${expected.size()} jars).")
  }
}

// Spring 7 JDK-25 Class-File-reader OOM workaround (gradle/spring-jdk25-shim). Spring 7's
// multi-release jar selects a JDK-Class-File-API metadata reader on JDK 24+ whose annotation
// delegate retains the parsed class model -> jdk.internal.classfile heap flood -> OOM during
// classpath scanning (spring-projects/spring-framework#37111). The shim shadows spring-core's
// versions/24 MetadataReaderFactoryDelegate to force the lean ASM SimpleMetadataReaderFactory.
// Centralized here so it isn't repeated per module. It must land in each Spring runtime app's OWN
// classes (BOOT-INF/classes / WEB-INF/classes, ahead of spring-core.jar), so it goes on src/main
// for the runtime apps and src/test for the Spring-Boot-test modules that OOM.
// TEMP: fix merged upstream (PR #37112) for Spring 7.0.9 — delete this block + gradle/spring-jdk25-shim
// once on spring-framework >= 7.0.9.
// Auto-applied so new Spring modules are covered without editing a list:
//  - TEST source set of ANY module that declares a Spring dependency (that's where the OOM bites),
//  - MAIN source set of deployable Spring runtime apps (Boot plugin apps auto-detected; plus the
//    non-Boot war deployables listed below) so the shim lands in their own BOOT-INF/classes /
//    WEB-INF/classes ahead of spring-core.jar.
// Obsolescence guard: the shim is only needed until the upstream fix ships (Spring 7.0.9). Fail the
// build the moment we bump Spring >= 7.0.9 so the workaround gets deleted instead of lingering.
def springVerMatcher = (springVersion =~ /(\d+)\.(\d+)\.(\d+)/)
if (springVerMatcher.find()) {
  def cur = [springVerMatcher.group(1), springVerMatcher.group(2), springVerMatcher.group(3)]*.toInteger()
  def min = [7, 0, 9]
  int cmp = 0
  for (int i = 0; i < 3 && cmp == 0; i++) { cmp = cur[i] <=> min[i] }
  if (cmp >= 0) {
    throw new GradleException(
      "spring-framework ${springVersion} >= 7.0.9: the ClassFile-reader fix (spring-projects/spring-framework#37112) " +
      "is released. Delete the gradle/spring-jdk25-shim/ directory and this whole shim block in build.gradle.")
  }
}
def springJdk25ShimDir = "$rootDir/gradle/spring-jdk25-shim"
// Non-Boot Spring runtime deployables that still package their own classes first (war/GMS).
def springRuntimeWarApps = [':metadata-service:war']
// Only configs that reach the TEST compile classpath — so we never add the shim to a module where
// spring-core isn't compilable there (e.g. Spring declared only in main compileOnly/runtimeOnly).
def springTestCompileCfgs = ['api', 'implementation', 'testImplementation', 'testCompileOnly']
subprojects { sp ->
  plugins.withType(JavaPlugin) {
    afterEvaluate {
      boolean springOnTestCompile = springTestCompileCfgs.any { n ->
        sp.configurations.findByName(n)?.allDependencies?.any { it.group?.startsWith('org.springframework') }
      }
      if (springOnTestCompile && sp.sourceSets.findByName('test')) {
        sp.sourceSets.test.java.srcDir(springJdk25ShimDir)
      }
      if (sp.plugins.hasPlugin('org.springframework.boot') || sp.path in springRuntimeWarApps) {
        sp.sourceSets.main.java.srcDir(springJdk25ShimDir)
      }
    }
  }
}

// Cross-module aggregated JaCoCo report (recovers coverage of a class produced by tests in
// another module). See gradle/coverage/java-coverage-aggregation.gradle for details.
apply from: 'gradle/coverage/java-coverage-aggregation.gradle'