pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>4.0.5</version>
    <relativePath/>
  </parent>
  <groupId>com.st4r4x</groupId>
  <artifactId>quickstart-app</artifactId>
  <packaging>jar</packaging>
  <version>1.0.0</version>
  <name>quickstart-app</name>
  <properties>
    <java.version>25</java.version>
    <maven.compiler.source>25</maven.compiler.source>
    <maven.compiler.target>25</maven.compiler.target>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <!-- Override Byte Buddy from Spring Boot BOM — 1.16.x adds Java 25 support -->
    <byte-buddy.version>1.16.0</byte-buddy.version>
    <!-- Default empty argLine — overridden by JaCoCo when present.
         Required so @{argLine} in Surefire/Failsafe resolves to empty string instead
         of crashing the forked JVM with an unresolved property literal. -->
    <argLine/>
    <!-- Fallback used when .git is absent (e.g. Docker build context) -->
    <git.commit.id.abbrev>unknown</git.commit.id.abbrev>
  </properties>
  <dependencies>
    <!-- Spring Boot Web Starter -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <!-- Thymeleaf Template Engine -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>

    <!-- MongoDB Driver (included by Spring Boot 2.6.x) -->
    <dependency>
      <groupId>org.mongodb</groupId>
      <artifactId>mongodb-driver-sync</artifactId>
    </dependency>

    <!-- PostgreSQL + JPA -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
    <dependency>
      <groupId>org.postgresql</groupId>
      <artifactId>postgresql</artifactId>
      <scope>runtime</scope>
    </dependency>

    <!-- Environment Configuration -->
    <dependency>
      <groupId>io.github.cdimascio</groupId>
      <artifactId>dotenv-java</artifactId>
      <version>3.0.0</version>
    </dependency>

    <!-- Redis (Phase 2) -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-data-redis</artifactId>
    </dependency>

    <!-- API Documentation -->
    <!-- SpringDoc OpenAPI v2 — required for Spring Boot 3+/4+ compatibility -->
    <dependency>
      <groupId>org.springdoc</groupId>
      <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
      <version>2.8.6</version>
    </dependency>

    <!-- Security -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <!-- Bean Validation implementation — spring-boot-starter-web in SB4 only brings
         jakarta.validation-api (interface); hibernate-validator (implementation) is required
         for @NotBlank/@Email to enforce constraints at runtime. Without this, @Valid is silently ignored. -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-validation</artifactId>
    </dependency>

    <!-- Actuator + Prometheus metrics -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
    <dependency>
      <groupId>io.micrometer</groupId>
      <artifactId>micrometer-registry-prometheus</artifactId>
    </dependency>

    <!-- JWT -->
    <dependency>
      <groupId>io.jsonwebtoken</groupId>
      <artifactId>jjwt-api</artifactId>
      <version>0.11.5</version>
    </dependency>
    <dependency>
      <groupId>io.jsonwebtoken</groupId>
      <artifactId>jjwt-impl</artifactId>
      <version>0.11.5</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>io.jsonwebtoken</groupId>
      <artifactId>jjwt-jackson</artifactId>
      <version>0.11.5</version>
      <scope>runtime</scope>
    </dependency>

    <!-- Logging -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-logging</artifactId>
    </dependency>
    <!-- Structured JSON logging — 8.x targets Logback 1.5.x (Spring Boot 3+/4+ ships 1.5.x) -->
    <dependency>
      <groupId>net.logstash.logback</groupId>
      <artifactId>logstash-logback-encoder</artifactId>
      <version>8.1</version>
    </dependency>

    <!-- Rate limiting — Bucket4j 7.x required for Java 11; do NOT use 8.x (requires Java 17) -->
    <dependency>
      <groupId>com.bucket4j</groupId>
      <artifactId>bucket4j-core</artifactId>
      <version>7.6.1</version>
    </dependency>

    <!-- Elasticsearch Java API Client -->
    <dependency>
      <groupId>co.elastic.clients</groupId>
      <artifactId>elasticsearch-java</artifactId>
      <version>8.13.4</version>
    </dependency>

    <!-- Testing -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-test</artifactId>
      <scope>test</scope>
    </dependency>
    <!-- Spring Security Test: SecurityMockMvcRequestPostProcessors.authentication() etc. -->
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-test</artifactId>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.mockito</groupId>
      <artifactId>mockito-core</artifactId>
      <!-- 5.x required for Java 21+ Byte Buddy instrumentation support -->
      <version>5.17.0</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.mockito</groupId>
      <artifactId>mockito-junit-jupiter</artifactId>
      <version>5.17.0</version>
      <scope>test</scope>
    </dependency>
    <!-- mockito-inline removed: Mockito 5.x merged inline mocking into mockito-core.
         Having both on the classpath causes MockMaker conflicts on Java 21+. -->

    <!-- Testcontainers — 1.20.1 uses docker-java 3.4.0 which supports Docker API >=1.40.
         1.19.8 used docker-java 3.3.6 (hardcoded API 1.32) incompatible with Docker Engine 29.x.
         Still 1.x — Testcontainers 2.x changed the API; 1.20.1 is stable and compatible with JUnit 5 @BeforeAll static containers. -->
    <dependency>
      <groupId>org.testcontainers</groupId>
      <artifactId>testcontainers</artifactId>
      <version>1.20.1</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.testcontainers</groupId>
      <artifactId>mongodb</artifactId>
      <version>1.20.1</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.testcontainers</groupId>
      <artifactId>postgresql</artifactId>
      <version>1.20.1</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
  <build>
    <resources>
      <resource>
        <directory>src/main/resources</directory>
        <filtering>true</filtering>
      </resource>
    </resources>
    <plugins>
      <!-- Spring Boot Maven Plugin -->
      <plugin>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-maven-plugin</artifactId>
        <configuration>
          <mainClass>com.st4r4x.Application</mainClass>
        </configuration>
      </plugin>

      <!-- Java Compiler Plugin -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>3.13.0</version>
        <configuration>
          <source>25</source>
          <target>25</target>
          <encoding>UTF-8</encoding>
          <!-- forceJavacCompilerUse: avoids plexus-compiler-javac NullPointerException
               (UnsharedNameTable.hashes == null) that occurs when compiling Java 25 sources
               in-process on maven-compiler-plugin 3.13+. Forces javac to run as an
               external process instead of the in-process javax.tools API. -->
          <forceJavacCompilerUse>true</forceJavacCompilerUse>
        </configuration>
      </plugin>

      <!-- Surefire Plugin: allow Mockito's byte-buddy-agent to attach dynamically on Java 21+.
           Without -XX:+EnableDynamicAgentLoading, Mockito self-attachment on Java 25 causes
           a StackOverflowError in @WebMvcTest slice tests. -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <configuration>
          <argLine>@{argLine} -XX:+EnableDynamicAgentLoading</argLine>
        </configuration>
      </plugin>

      <!-- Failsafe: runs *IT.java in integration-test phase, separate from Surefire unit tests -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-failsafe-plugin</artifactId>
        <configuration>
          <argLine>@{argLine} -XX:+EnableDynamicAgentLoading</argLine>
          <!-- api.version=1.45 overrides the shaded docker-java-core default of 1.32.
               Testcontainers' shaded DockerClientProviderStrategy reads System.getProperty("api.version")
               via overrideDockerPropertiesWithSystemProperties() and uses it instead of VERSION_1_32.
               Required for Docker Engine 29.x which dropped support for API < 1.40. -->
          <systemPropertyVariables>
            <api.version>1.45</api.version>
          </systemPropertyVariables>
          <includes>
            <include>**/*IT.java</include>
          </includes>
        </configuration>
        <executions>
          <execution>
            <id>integration-tests</id>
            <goals>
              <goal>integration-test</goal>
              <goal>verify</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

      <!-- Git commit ID plugin — writes git.properties at build time so app.version
           in application.properties can be filtered with the short SHA -->
      <plugin>
        <groupId>io.github.git-commit-id</groupId>
        <artifactId>git-commit-id-maven-plugin</artifactId>
        <version>9.0.1</version>
        <executions>
          <execution>
            <goals><goal>revision</goal></goals>
          </execution>
        </executions>
        <configuration>
          <generateGitPropertiesFile>false</generateGitPropertiesFile>
          <failOnNoGitDirectory>false</failOnNoGitDirectory>
          <includeOnlyProperties>
            <includeOnlyProperty>git.commit.id.abbrev</includeOnlyProperty>
          </includeOnlyProperties>
        </configuration>
      </plugin>

      <!-- JaCoCo Maven Plugin — generates coverage report consumed by CI-08 (madraphos/jacoco-report)
           Version must be explicit — Spring Boot 2.6.15 BOM does not manage jacoco-maven-plugin
           0.8.14: first release with official Java 25 support (class file major version 69) -->
      <plugin>
        <groupId>org.jacoco</groupId>
        <artifactId>jacoco-maven-plugin</artifactId>
        <version>0.8.14</version>
        <executions>
          <execution>
            <id>jacoco-prepare-agent</id>
            <phase>initialize</phase>
            <goals><goal>prepare-agent</goal></goals>
          </execution>
          <execution>
            <id>jacoco-report</id>
            <phase>test</phase>
            <goals><goal>report</goal></goals>
            <configuration>
              <!-- Exclude low-coverage POJOs/DTOs/entities from coverage threshold calculation -->
              <excludes>
                <exclude>com/st4r4x/dto/**</exclude>
                <exclude>com/st4r4x/entity/**</exclude>
                <exclude>com/st4r4x/aggregation/**</exclude>
                <exclude>com/st4r4x/domain/**</exclude>
              </excludes>
            </configuration>
          </execution>
          <execution>
            <id>jacoco-check</id>
            <phase>test</phase>
            <goals><goal>check</goal></goals>
            <configuration>
              <!-- Exclude low-coverage POJOs/DTOs/entities from coverage threshold calculation -->
              <excludes>
                <exclude>com/st4r4x/dto/**</exclude>
                <exclude>com/st4r4x/entity/**</exclude>
                <exclude>com/st4r4x/aggregation/**</exclude>
                <exclude>com/st4r4x/domain/**</exclude>
              </excludes>
              <rules>
                <rule>
                  <element>BUNDLE</element>
                  <limits>
                    <limit>
                      <!-- Measured baseline from Phase 12 on prior branch: 43%
                           Threshold set at 38% (baseline minus 5%) to tolerate minor drift -->
                      <counter>INSTRUCTION</counter>
                      <value>COVEREDRATIO</value>
                      <minimum>0.38</minimum>
                    </limit>
                  </limits>
                </rule>
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>
</project>