pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.oscarehr</groupId>
    <artifactId>oscar</artifactId>
    <packaging>war</packaging>
    <version>0-SNAPSHOT</version>
    <name>OpenO</name>
    <description>OpenOSP EMR is a web-based electronic medical record (EMR) system.</description>
    <inceptionYear>2018</inceptionYear>
    <licenses>
        <license>
            <name>GPLv2</name>
            <url>https://www.gnu.org/licenses/gpl-2.0.txt</url>
        </license>
    </licenses>
    <url>https://www.openosp.ca</url>
    <scm>
        <url>https://bitbucket.org/openoscar/oscar/wiki/Home</url>
        <connection>scm:git:https://bitbucket.org/openoscar/oscar/branch/master</connection>
        <developerConnection>scm:git:ssh:git@bitbucket.org:openoscar/oscar.git</developerConnection>
        <tag>master</tag>
    </scm>
    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <!-- SonarCloud -->
        <sonar.organization>openo-beta1</sonar.organization>
        <!-- Log4j Version -->
        <log4j2.version>2.25.3</log4j2.version>
        <!-- Slf4j Version -->
        <slf4j.version>2.0.17</slf4j.version>
        <!-- Hapi Fhir Version -->
        <hapifhir.version>6.10.5</hapifhir.version>
        <!-- HL7 FHIR Core Version (org.hl7.fhir.core transitive overrides for CVE fix) -->
        <hl7.fhir.core.version>6.4.0</hl7.fhir.core.version>
        <!-- Apache CXF Version -->
        <cxf.version>3.6.9</cxf.version>
        <!-- Netty Version (for transitive dependency security fixes) -->
        <netty.version>4.1.129.Final</netty.version>
        <!-- Jackson Version -->
        <jackson.version>2.21.1</jackson.version>
        <struts.devMode>false</struts.devMode>
        <!-- Test properties -->
        <skipModernTests>false</skipModernTests>
        <skipLegacyTests>false</skipLegacyTests>
        <!-- Control test execution phases - set to 'none' to skip -->
        <modern.tests.phase>test</modern.tests.phase>
        <legacy.tests.phase>test</legacy.tests.phase>
        <!-- Dependency lock file name - can be overridden via -Ddependency.lock.filename -->
        <dependency.lock.filename>dependencies-lock.json</dependency.lock.filename>
    </properties>

    <repositories>
        <!-- local folder including manually installed dependencies -->
        <repository>
            <id>local_repo</id>
            <url>file://${basedir}/local_repo</url>
        </repository>

        <!-- for the com.github.openosp htmltopdf dependency only. Upgrades
        from this dependency are welcome -->
        <repository>
            <id>jitpack.io</id>
            <url>https://jitpack.io</url>
        </repository>
        <repository>
            <id>central</id>
            <url>https://repo.maven.apache.org/maven2</url>
        </repository>
    </repositories>

    <pluginRepositories>
        <!-- local folder including manually installed dependencies -->
        <pluginRepository>
            <id>local_repo</id>
            <url>file://${basedir}/local_repo</url>
        </pluginRepository>
    </pluginRepositories>

    <dependencyManagement>
        <dependencies>
            <!-- JAXB dependencies for Java 21 compatibility -->
            <dependency>
                <groupId>javax.xml.bind</groupId>
                <artifactId>jaxb-api</artifactId>
                <version>2.3.1</version>
            </dependency>
            <dependency>
                <groupId>org.glassfish.jaxb</groupId>
                <artifactId>jaxb-runtime</artifactId>
                <version>2.3.9</version>
            </dependency>
            <dependency>
                <groupId>org.glassfish.jaxb</groupId>
                <artifactId>jaxb-core</artifactId>
                <version>2.3.0.1</version>
            </dependency>
            <!-- Override transitive xercesImpl to fix CVE-2022-23437 and CVE-2020-14338 -->
            <dependency>
                <groupId>xerces</groupId>
                <artifactId>xercesImpl</artifactId>
                <version>2.12.2</version>
            </dependency>
            <!-- https://mvnrepository.com/artifact/org.springframework/spring-framework-bom -->
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-framework-bom</artifactId>
                <version>5.3.39</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- Force Gson version to prevent any transitive 2.8.0 -->
            <dependency>
                <groupId>com.google.code.gson</groupId>
                <artifactId>gson</artifactId>
                <version>2.10.1</version>
            </dependency>
            <!-- Force secure version of mina-core to fix CVE -->
            <dependency>
                <groupId>org.apache.mina</groupId>
                <artifactId>mina-core</artifactId>
                <version>2.1.10</version>
            </dependency>
            <!-- Force secure versions of org.hl7.fhir.core libs to fix XXE vulnerability in XSLT parsing -->
            <!-- Transitive from hapi-fhir-structures-dstu3, need 6.4.0+ to fix CVE -->
            <dependency>
                <groupId>ca.uhn.hapi.fhir</groupId>
                <artifactId>org.hl7.fhir.utilities</artifactId>
                <version>${hl7.fhir.core.version}</version>
            </dependency>
            <dependency>
                <groupId>ca.uhn.hapi.fhir</groupId>
                <artifactId>org.hl7.fhir.dstu3</artifactId>
                <version>${hl7.fhir.core.version}</version>
            </dependency>
            <!-- Force secure versions of ALL Netty modules to fix multiple CVEs:
                 - HTTP/2 DDoS (MadeYouReset) in netty-codec-http2
                 - DoS via zip bomb in netty-codec
                 - CRLF Injection and request smuggling in netty-codec-http
                 Transitive from apache-cxf and webdrivermanager -->
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-bom</artifactId>
                <version>${netty.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
          
            <!-- Force secure version of MIME4J to fix header injection CVE -->
            <!-- Transitive from axis2-transport-http (used for OLIS) -->
            <dependency>
                <groupId>org.apache.james</groupId>
                <artifactId>apache-mime4j-core</artifactId>
                <version>0.8.10</version>
             </dependency>

            <!-- Transitive Hibernate/JPA dependencies -->
            <!-- Hibernate core -->
            <dependency>
                <groupId>org.hibernate</groupId>
                <artifactId>hibernate-core</artifactId>
                <version>5.6.15.Final</version>
            </dependency>
            <!-- Hibernate commons annotations - transitive from hibernate-core -->
            <dependency>
                <groupId>org.hibernate.common</groupId>
                <artifactId>hibernate-commons-annotations</artifactId>
                <version>5.1.2.Final</version>
            </dependency>
            <!-- JPA API (javax namespace) - transitive from Hibernate 5.x -->
            <dependency>
                <groupId>javax.persistence</groupId>
                <artifactId>javax.persistence-api</artifactId>
                <version>2.2</version>
            </dependency>
            <!-- JPA API (jakarta namespace) - transitive from jaxws-ri -->
            <dependency>
                <groupId>jakarta.persistence</groupId>
                <artifactId>jakarta.persistence-api</artifactId>
                <version>2.2.3</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <reporting>
        <!-- Used for site.xml reports -->
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
                <version>3.9.0</version>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jxr-plugin</artifactId>
                <version>3.6.0</version>
            </plugin>
        </plugins>
    </reporting>

    <dependencies>
        <!-- https://mvnrepository.com/artifact/net.bull.javamelody/javamelody-core -->
        <!-- Updated to latest javax.servlet compatible version -->
        <dependency>
            <groupId>net.bull.javamelody</groupId>
            <artifactId>javamelody-core</artifactId>
            <version>1.99.4</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>jcl-over-slf4j</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>log4j</groupId>
                    <artifactId>log4j</artifactId>
                </exclusion>
                <!-- <exclusion>
                    <groupId>org.apache.logging.log4j</groupId>
                    <artifactId>log4j-core</artifactId>
                </exclusion> -->
            </exclusions>
        </dependency>

        <!-- LOGGING -->
        <dependency>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
            <version>1.2</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-text</artifactId>
            <version>1.13.1</version>
        </dependency>

        <!--Log4j-2 libraries-->
        <!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core -->
        <!-- throws a 404 error when removed/uncommented -->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>${log4j2.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>${log4j2.version}</version>
        </dependency>
        <!--Enables log4j-2 binding from libraries that still use older Log4j-1 -->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-1.2-api</artifactId>
            <version>${log4j2.version}</version>
        </dependency>

        <!-- SLF4J -->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>${slf4j.version}</version>
        </dependency>

        <!-- commons -->
        <!-- https://mvnrepository.com/artifact/commons-validator/commons-validator -->
        <dependency>
            <groupId>commons-validator</groupId>
            <artifactId>commons-validator</artifactId>
            <version>1.9.0</version>
            <exclusions>
                <!-- Excluded this low version to avoid triggering security issue -->
                <exclusion>
                    <groupId>commons-beanutils</groupId>
                    <artifactId>commons-beanutils</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
            <version>2.18.0</version>
        </dependency>
        <dependency>
            <groupId>commons-fileupload</groupId>
            <artifactId>commons-fileupload</artifactId>
            <version>1.6.0</version>
        </dependency>
        <dependency>
            <groupId>commons-collections</groupId>
            <artifactId>commons-collections</artifactId>
            <version>3.2.2</version>
        </dependency>
        <!-- Commons Digester3 Library -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-digester3</artifactId>
            <version>3.2</version>
            <exclusions>
                <exclusion>
                    <groupId>commons-beanutils</groupId>
                    <artifactId>commons-beanutils</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <!-- apache commons codec -->
        <dependency>
            <groupId>commons-codec</groupId>
            <artifactId>commons-codec</artifactId>
           <version>1.18.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-compress</artifactId>
            <version>1.26.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.18.0</version>
        </dependency>
        <!-- commons-beanutils removed: migrated to Spring BeanUtils (Phase 1 of issue #2202) -->
        <!-- Added higher version to avoid security issue, suggested by GitHub Dependabot -->
        <!-- https://mvnrepository.com/artifact/commons-net/commons-net -->
        <dependency>
            <groupId>commons-net</groupId>
            <artifactId>commons-net</artifactId>
            <version>3.11.1</version>
        </dependency>
        
        <!-- Added higher version to avoid security issue, suggested by GitHub Dependabot -->
        <!-- https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient -->
        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
            <artifactId>httpclient</artifactId>
            <version>4.5.14</version>
        </dependency>
        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
            <artifactId>httpmime</artifactId>
            <version>4.5.14</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/com.google.code.gson/gson -->
        <dependency>
            <groupId>com.google.code.gson</groupId>
            <artifactId>gson</artifactId>
            <version>2.10.1</version>
        </dependency>

        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.13.2</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>javax.servlet-api</artifactId>
            <version>4.0.1</version>
            <scope>provided</scope>
        </dependency>

        <!-- hapi/HL7 -->
        <dependency>
            <groupId>ca.uhn.hapi</groupId>
            <artifactId>hapi-base</artifactId>
            <version>1.0.1</version>
            <exclusions>
                <!-- Not being used, excluded to avoid triggering security issue -->
                <exclusion>
                    <groupId>xalan</groupId>
                    <artifactId>xalan</artifactId>
                </exclusion>
                <!-- Excluded this low version to avoid triggering security issue -->
                <exclusion>
                    <groupId>org.jdom</groupId>
                    <artifactId>jdom</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>commons-lang</groupId>
                    <artifactId>commons-lang</artifactId>
                </exclusion>
                <!-- Exclude vulnerable log4j v1.2.x - default to using log4j 2.x instead (see version of log4j-1.2-api) -->
                <exclusion>
                    <groupId>log4j</groupId>
                    <artifactId>log4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>ca.uhn.hapi</groupId>
            <artifactId>hapi-structures-v25</artifactId>
            <version>1.0.1</version>
        </dependency>
        <dependency>
            <groupId>ca.uhn.hapi</groupId>
            <artifactId>hapi-structures-v231</artifactId>
            <version>1.0.1</version>
        </dependency>
        <dependency>
            <groupId>ca.uhn.hapi</groupId>
            <artifactId>hapi-structures-v21</artifactId>
            <version>1.0.1</version>
        </dependency>
        <dependency>
            <groupId>ca.uhn.hapi</groupId>
            <artifactId>hapi-structures-v22</artifactId>
            <version>1.0.1</version>
        </dependency>
        <dependency>
            <groupId>ca.uhn.hapi</groupId>
            <artifactId>hapi-structures-v23</artifactId>
            <version>1.0.1</version>
        </dependency>
        <dependency>
            <groupId>ca.uhn.hapi</groupId>
            <artifactId>hapi-structures-v24</artifactId>
            <version>1.0.1</version>
        </dependency>
        <dependency>
            <groupId>ca.uhn.hapi</groupId>
            <artifactId>hapi-structures-v26</artifactId>
            <version>1.0.1</version>
        </dependency>

        <!-- Added higher version to avoid security issue, suggested by GitHub Dependabot -->
        <!-- https://mvnrepository.com/artifact/org.jdom/jdom2 -->
        <dependency>
            <groupId>org.jdom</groupId>
            <artifactId>jdom2</artifactId>
            <version>2.0.6.1</version>
        </dependency>

        <!-- spring -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>5.3.39</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-tx</artifactId>
            <version>5.3.39</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-orm</artifactId>
            <version>5.3.39</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
            <version>5.3.39</version>
        </dependency>
        <!-- throws an compilation error when removed/commented -->
        <dependency>
            <groupId>org.springframework.integration</groupId>
            <artifactId>spring-integration-ftp</artifactId>
            <version>5.5.20</version>
            <exclusions>
                <!-- Excluded this low version to avoid triggering security issue -->
                <exclusion>
                    <groupId>commons-net</groupId>
                    <artifactId>commons-net</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.springframework.integration</groupId>
            <artifactId>spring-integration-sftp</artifactId>
            <version>5.5.20</version>
            <exclusions>
                <exclusion>
                    <!-- Exclude old jcraft JSch in favor of maintained mwiede fork -->
                    <groupId>com.jcraft</groupId>
                    <artifactId>jsch</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <!-- throws 10 compilation errors when removed/commented -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-aspects</artifactId>
            <version>5.3.39</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-test</artifactId>
            <version>5.3.39</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-aop</artifactId>
            <version>5.3.39</version>
            <exclusions>
                <exclusion>
                    <groupId>cglib</groupId>
                    <artifactId>cglib</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <!-- cglib-nodep to replace old cglib 2.2.2 and eliminate ASM conflicts -->
        <dependency>
            <groupId>cglib</groupId>
            <artifactId>cglib-nodep</artifactId>
            <version>3.3.0</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-crypto -->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-crypto</artifactId>
            <version>6.3.9</version>
        </dependency>

        <!-- Spring Cache Support with EhCache 2.x -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context-support</artifactId>
            <version>5.3.39</version>
        </dependency>

        <!-- EhCache 2.x for Spring Cache -->
        <dependency>
            <groupId>net.sf.ehcache</groupId>
            <artifactId>ehcache</artifactId>
            <version>2.10.9.2</version>
        </dependency>

        <dependency>
            <groupId>com.onelogin</groupId>
            <artifactId>java-saml</artifactId>
            <version>2.9.0</version>
            <exclusions>
                <exclusion>
                    <groupId>org.codehaus.woodstox</groupId>
                    <artifactId>woodstox-core</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.santuario</groupId>
                    <artifactId>xmlsec</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!-- hibernate / sql -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-dbcp2</artifactId>
            <version>2.14.0</version>
        </dependency>
        <!-- throws a 404 error when removed/uncommented -->
        <!-- https://mvnrepository.com/artifact/com.mysql/mysql-connector-j -->
        <dependency>
            <groupId>com.mysql</groupId>
            <artifactId>mysql-connector-j</artifactId>
            <version>9.3.0</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/org.hibernate/hibernate-core -->
        <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-core</artifactId>
            <version>5.6.15.Final</version>
        </dependency>

        <!--  pdfbox -->
        <dependency>
            <groupId>org.apache.pdfbox</groupId>
            <artifactId>pdfbox</artifactId>
            <version>2.0.35</version>
        </dependency>
        <dependency>
            <groupId>com.twelvemonkeys.common</groupId>
            <artifactId>common-lang</artifactId>
            <version>3.12.0</version>
        </dependency>

        <!-- Glassfish JSTL 1.2.5 implementation (javax namespace for Servlet 4.0 compatibility) -->
        <dependency>
            <groupId>org.glassfish.web</groupId>
            <artifactId>javax.servlet.jsp.jstl</artifactId>
            <version>1.2.5</version>
        </dependency>

        <!-- XMLBeans for AR2005 and CKD - using existing 3.1.0 version below -->

        <!-- itext -->
        <dependency>
            <groupId>com.itextpdf</groupId>
            <artifactId>itextpdf</artifactId>
            <version>5.5.13.5</version>
        </dependency>
        <dependency>
            <groupId>com.itextpdf.tool</groupId>
            <artifactId>xmlworker</artifactId>
            <version>5.5.13.5</version>
        </dependency>

        <dependency>
            <groupId>com.github.openosp</groupId>
            <artifactId>ultrabuk-htmltopdf-java</artifactId>
            <version>1.0.11</version>
        </dependency>

        <!-- Modern RTF support via OpenRTF (actively maintained, released Aug 2025) -->
        <dependency>
            <groupId>com.github.librepdf</groupId>
            <artifactId>openrtf</artifactId>
            <version>2.0.0</version>
        </dependency>


        <!-- apache xmlrpc -->
        <dependency>
            <groupId>xmlrpc</groupId>
            <artifactId>xmlrpc</artifactId>
            <version>1.2-b1</version>
        </dependency>

        <!-- apache xmlrpc -->
        <dependency>
            <groupId>drools</groupId>
            <artifactId>drools-all</artifactId>
            <version>2.0</version>
        </dependency>

        <!-- jasper reports -->
        <dependency>
            <groupId>net.sf.jasperreports</groupId>
            <artifactId>jasperreports</artifactId>
            <version>6.21.5</version>
            <exclusions>
                <exclusion>
                    <groupId>bouncycastle</groupId>
                    <artifactId>bcprov-jdk14</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>bouncycastle</groupId>
                    <artifactId>bcmail-jdk14</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.bouncycastle</groupId>
                    <artifactId>bcprov-jdk14</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.bouncycastle</groupId>
                    <artifactId>bctsp-jdk14</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.fasterxml.jackson.core</groupId>
                    <artifactId>jackson-core</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.fasterxml.jackson.core</groupId>
                    <artifactId>jackson-databind</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.fasterxml.jackson.core</groupId>
                    <artifactId>jackson-annotations</artifactId>
                </exclusion>
                <!-- Excluded this low version to avoid triggering security issue -->
                <exclusion>
                    <groupId>commons-beanutils</groupId>
                    <artifactId>commons-beanutils</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!-- Jackson dependencies for JSON processing -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>${jackson.version}</version>
        </dependency>

        <!-- Jackson Java 8 Date/Time support -->
        <dependency>
            <groupId>com.fasterxml.jackson.datatype</groupId>
            <artifactId>jackson-datatype-jsr310</artifactId>
            <version>${jackson.version}</version>
        </dependency>

        <!-- Jackson JAXB annotations support - provides JaxbAnnotationIntrospector used in Spring configs -->
        <dependency>
            <groupId>com.fasterxml.jackson.module</groupId>
            <artifactId>jackson-module-jaxb-annotations</artifactId>
            <version>${jackson.version}</version>
        </dependency>

        <!-- Jackson XML support - explicit version to override older transitive from jasperreports -->
        <dependency>
            <groupId>com.fasterxml.jackson.dataformat</groupId>
            <artifactId>jackson-dataformat-xml</artifactId>
            <version>${jackson.version}</version>
        </dependency>





        <!-- jcharts: now from Maven Central (same JAR, different coordinates) -->
        <dependency>
            <groupId>jcharts</groupId>
            <artifactId>jcharts</artifactId>
            <version>0.7.5</version>
        </dependency>

        <!-- cds: can be found in the local_repo folder -->
        <dependency>
            <groupId>cds</groupId>
            <artifactId>cds</artifactId>
            <version>5.2.3</version>
        </dependency>

        <!-- cds cihi phc vrs: can be found in the local_repo folder -->
        <dependency>
            <groupId>cds</groupId>
            <artifactId>cds_cihi_phcvrs</artifactId>
            <version>1.0</version>
        </dependency>
        <!-- cds cihi: can be found in the local_repo folder -->
        <dependency>
            <groupId>cds</groupId>
            <artifactId>cds_cihi</artifactId>
            <version>1.0</version>
        </dependency>
        <!-- cds rourke: can be found in the local_repo folder -->
        <dependency>
            <groupId>cds</groupId>
            <artifactId>cds_rourke</artifactId>
            <version>1.0</version>
        </dependency>
        <!-- cds hrm: can be found in the local_repo folder -->
        <dependency>
            <groupId>cds</groupId>
            <artifactId>cds_hrm</artifactId>
            <version>4.3.1</version>
        </dependency>

        <!-- HRM module: XSD classes now included directly in codebase -->
        <!-- HRM module 4.3: can be found in the local_repo folder -->
        <dependency>
            <groupId>omd</groupId>
            <artifactId>hrm</artifactId>
            <version>4.3</version>
        </dependency>


        <!-- apache xml beans -->
        <dependency>
            <groupId>org.apache.xmlbeans</groupId>
            <artifactId>xmlbeans</artifactId>
            <version>3.1.0</version>
        </dependency>

        <!-- email -->
        <dependency>
            <groupId>com.sun.mail</groupId>
            <artifactId>jakarta.mail</artifactId>
            <version>1.6.8</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/org.jfree/jfreechart -->
        <dependency>
            <groupId>org.jfree</groupId>
            <artifactId>jfreechart</artifactId>
            <version>1.5.6</version>
        </dependency>


        <!-- FOR BORN Project - AR2005 in XML format -->
        <!-- REMOVED: now included as source code -->


        <!-- FOR ORN Project - CKD config in XML format -->
        <!-- REMOVED: now included as source code -->


        <!-- apache poi -->
        <dependency>
            <groupId>org.apache.poi</groupId>
            <artifactId>poi</artifactId>
            <version>5.5.1</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>jcl-over-slf4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!-- ostermillerutils_1_04_03_for_java_1_4.jar
        we need to stop using this and replace it with apache commons -->
        <!-- Please look at PR #386 commit: 7da510760a7dd71fd86eabd7eb23842b60a482de for removal -->
        <dependency>
            <groupId>com.ostermiller</groupId>
            <artifactId>ostermillerutils</artifactId>
            <version>1.4.3</version>
        </dependency>

        <!-- UPGRADED displaytag to actively maintained hazendaz fork -->
        <!-- Temporary bridge solution - full DataTables migration planned for Q2 2026 -->
        <!-- Used in JSP files: admin (6), BC billing (3), PMmodule (1), casemgmt (1) -->
        <dependency>
            <groupId>com.github.hazendaz</groupId>
            <artifactId>displaytag</artifactId>
            <version>2.9.0</version>
            <exclusions>
                <!-- Exclude SLF4J to use OpenO's managed version -->
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-api</artifactId>
                </exclusion>
                <!-- Exclude to avoid conflicts with OpenO's logging setup -->
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>jcl-over-slf4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!-- zxing / 2d bar codes -->
        <dependency>
            <groupId>com.google.zxing</groupId>
            <artifactId>core</artifactId>
            <version>3.5.3</version>
        </dependency>
        <dependency>
            <groupId>com.google.zxing</groupId>
            <artifactId>javase</artifactId>
            <version>3.5.3</version>
        </dependency>

        <!-- chip / ping libararies -->
        <!-- Detected as "Unused dependency" but don't remove it, it's using in jsp -->
        <!-- can be found in the local_repo folder -->

        <dependency>
            <groupId>org.jsoup</groupId>
            <artifactId>jsoup</artifactId>
            <version>1.17.2</version>
        </dependency>

        <!-- janino - CRITICAL: Must stay on version 2.x -->
        <!-- Drools 2.0 (used by PreventionDSImpl for prevention rules) requires janino 2.x API -->
        <!-- Janino 3.x removed Scanner$LocatedException class, breaking Drools rule compilation -->
        <!-- DO NOT upgrade to janino 3.x without first upgrading Drools to 7.x+ -->
        <!-- Previous comment: Detected as "Unused dependency" but don't remove it, caused 404 error after removing -->
        <dependency>
            <groupId>janino</groupId>
            <artifactId>janino</artifactId>
            <version>2.3.2</version>
        </dependency>


        <dependency>
            <groupId>com.github.mwiede</groupId>
            <artifactId>jsch</artifactId>
            <version>0.2.19</version>
        </dependency>

        <!-- OLIS -->
        <dependency>
            <groupId>ca.ssha.www</groupId>
            <artifactId>olis-service</artifactId>
            <version>20111111</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/org.bouncycastle/bcpkix-jdk18on -->
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcpkix-jdk18on</artifactId>
            <version>1.79</version>
        </dependency>

        <!-- AXIS2 (for OLIS) -->
        <!-- 
            Updated to 1.8.2 for Jakarta EE migration preparation,
            the higher version 2.0.0 will need when we migrate to jakarta 
        -->
        <!-- https://mvnrepository.com/artifact/org.apache.axis2/axis2 -->
        <dependency>
            <groupId>org.apache.axis2</groupId>
            <artifactId>axis2</artifactId>
            <version>1.8.2</version>
            <type>pom</type>
        </dependency>
        <!-- Detected as "Unused dependency" but don't remove it, caused 404 error after removing -->
        <dependency>
            <groupId>org.apache.axis2</groupId>
            <artifactId>axis2-transport-http</artifactId>
            <version>1.8.2</version>
            <exclusions>
                <exclusion>
                    <groupId>org.apache.ws.commons.schema</groupId>
                    <artifactId>XmlSchema</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.neethi</groupId>
                    <artifactId>neethi</artifactId>
                </exclusion>
                <!-- Excluded this low version to avoid triggering security issue -->
                <exclusion>
                    <groupId>org.apache.ant</groupId>
                    <artifactId>ant</artifactId>
                </exclusion>
                <!-- Exclude old JAX-RS API to avoid conflict with jakarta.ws.rs -->
                <exclusion>
                    <groupId>javax.ws.rs</groupId>
                    <artifactId>jsr311-api</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <!-- https://mvnrepository.com/artifact/org.apache.axis2/axis2-adb -->
        <dependency>
            <groupId>org.apache.axis2</groupId>
            <artifactId>axis2-adb</artifactId>
            <version>1.8.2</version>
        </dependency>

        <!-- Added higher version to avoid security issue, suggested by GitHub Dependabot -->
        <!-- https://mvnrepository.com/artifact/org.apache.ant/ant -->
        <dependency>
            <groupId>org.apache.ant</groupId>
            <artifactId>ant</artifactId>
            <version>1.10.15</version>
        </dependency>

        <!-- velocity -->
        <dependency>
            <groupId>org.apache.velocity</groupId>
            <artifactId>velocity-engine-core</artifactId>
            <version>2.4.1</version>
            <exclusions>
                <exclusion>
                    <groupId>org.apache.commons</groupId>
                    <artifactId>commons-lang3</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.apache.velocity.tools</groupId>
            <artifactId>velocity-tools-generic</artifactId>
            <version>3.1</version>
            <scope>compile</scope>
            <exclusions>
                <exclusion>
                    <groupId>org.apache.struts</groupId>
                    <artifactId>struts-core</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.struts</groupId>
                    <artifactId>struts-taglib</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.struts</groupId>
                    <artifactId>struts-tiles</artifactId>
                </exclusion>
                <!-- Excluded this low version to avoid triggering security issue -->
                <exclusion>
                    <groupId>commons-beanutils</groupId>
                    <artifactId>commons-beanutils</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>
            <groupId>com.sun.xml.messaging.saaj</groupId>
            <artifactId>saaj-impl</artifactId>
            <version>1.5.3</version>
        </dependency>

        <!-- CXF -->
        <!-- Detected as "Unused dependency" but don't remove it, it's using actually -->
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>apache-cxf</artifactId>
            <version>${cxf.version}</version>
            <type>pom</type>
            <exclusions>
                <exclusion>
                    <groupId>org.springframework</groupId>
                    <artifactId>spring-asm</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.geronimo.specs</groupId>
                    <artifactId>geronimo-servlet_2.5_spec</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.geronimo.specs</groupId>
                    <artifactId>geronimo-servlet_3.0_spec</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.cxf.services.ws-discovery</groupId>
                    <artifactId>cxf-services-ws-discovery-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.cxf.services.ws-discovery</groupId>
                    <artifactId>cxf-services-ws-discovery-service</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-jdk14</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>joda-time</groupId>
                    <artifactId>joda-time</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.fasterxml.woodstox</groupId>
                    <artifactId>woodstox-core</artifactId>
                </exclusion>
                <!-- Not being used, excluded to avoid triggering security issue -->
                <exclusion>
                    <groupId>org.eclipse.jetty</groupId>
                    <artifactId>jetty-server</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.eclipse.jetty</groupId>
                    <artifactId>jetty-http</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>io.undertow</groupId>
                    <artifactId>undertow-core</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>io.netty</groupId>
                    <artifactId>netty-common</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>io.netty</groupId>
                    <artifactId>netty-handler</artifactId>
                </exclusion>
                <!-- Excluded this low version to avoid triggering security issue -->
                <exclusion>
                    <groupId>org.codehaus.jettison</groupId>
                    <artifactId>jettison</artifactId>
                </exclusion>
                <!-- 
                    Not being used, excluded to avoid triggering security issue,
                    these libraries are part of apache-cxf, 
                    but excluding them won't impact our project  
                -->
                <exclusion>
                    <groupId>org.apache.mina</groupId>
                    <artifactId>mina-core</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.activemq</groupId>
                    <artifactId>activemq-openwire-legacy</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.activemq</groupId>
                    <artifactId>activemq-client</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.cxf</groupId>
                    <artifactId>cxf-rt-rs-security-jose</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.cxf</groupId>
                    <artifactId>cxf-rt-rs-service-description</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.cxf</groupId>
                    <artifactId>cxf-rt-management</artifactId>
                </exclusion>
                <!-- 
                    Switched from Jettison (org.codehaus.jettison) to FasterXML Jackson 
                    for JSON handling in CXF JAX-RS providers. 
                    This ensures better compatibility and consistency of REST API 
                    request/response serialization and deserialization. 
                    Also excluded cxf-rt-rs-extension-providers to avoid Jettison being pulled in transitively.
                -->
                <exclusion>
                    <groupId>org.apache.cxf</groupId>
                    <artifactId>cxf-rt-rs-extension-providers</artifactId>
                </exclusion>
                <!-- Not used, excluded to fix CVE (RCE via untrusted JMS config) -->
                <exclusion>
                    <groupId>org.apache.cxf</groupId>
                    <artifactId>cxf-rt-transports-jms</artifactId>
                </exclusion>
                <!-- Not used, excluded to fix CVE (DoS via Rhino toFixed) -->
                <exclusion>
                    <groupId>org.apache.cxf</groupId>
                    <artifactId>cxf-rt-frontend-js</artifactId>
                </exclusion>
                <!-- Not used, excluded because Jetty 10 requires jakarta.servlet.* but app uses javax.servlet.* -->
                <exclusion>
                    <groupId>org.apache.cxf</groupId>
                    <artifactId>cxf-rt-transports-http-jetty</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-frontend-jaxws</artifactId>
            <version>${cxf.version}</version>
            <exclusions>
                <exclusion>
                    <groupId>org.codehaus.woodstox</groupId>
                    <artifactId>woodstox-core-asl</artifactId>
                </exclusion>
                <!-- 
                    Switched from Jettison (org.codehaus.jettison) to FasterXML Jackson 
                    for JSON handling in CXF JAX-RS providers. 
                    This ensures better compatibility and consistency of REST API 
                    request/response serialization and deserialization. 
                    Also excluded cxf-rt-rs-extension-providers to avoid Jettison being pulled in transitively.
                -->
                <exclusion>
                    <groupId>org.apache.cxf</groupId>
                    <artifactId>cxf-rt-rs-extension-providers</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-transports-http</artifactId>
            <version>${cxf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-core</artifactId>
            <version>${cxf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-rs-client</artifactId>
            <version>${cxf.version}</version>
        </dependency>
        <!-- 
            Switched from Jettison (org.codehaus.jettison) to FasterXML Jackson 
            for JSON handling in CXF JAX-RS providers. 
            This ensures better compatibility and consistency of REST API 
            request/response serialization and deserialization. 
            Also excluded cxf-rt-rs-extension-providers to avoid Jettison being pulled in transitively.
        -->
        <!-- <dependency>
            <groupId>org.apache.cxf</groupId>
            <artifactId>cxf-rt-rs-extension-providers</artifactId>
            <version>${cxf.version}</version>
        </dependency> -->

        <!-- ScribeJava OAuth 1.0a dependencies. Added after apache cxf was bumped to version 3.5.10 and lost support. -->
        <dependency>
            <groupId>com.github.scribejava</groupId>
            <artifactId>scribejava-apis</artifactId>
            <version>8.3.3</version>
        </dependency>
        <dependency>
            <groupId>com.github.scribejava</groupId>
            <artifactId>scribejava-core</artifactId>
            <version>8.3.3</version>
        </dependency>

        <dependency>
            <groupId>org.commonmark</groupId>
            <artifactId>commonmark</artifactId>
            <version>0.23.0</version>
        </dependency>

        <!-- can be found in the local_repo folder -->

        <!-- EBS and HCV Stubs -->
        <!-- REMOVED: now included as source code -->

        <!-- Detected as "Unused dependency" but don't remove it, it's using actually -->
        <dependency>
            <groupId>com.fasterxml.jackson.jaxrs</groupId>
            <artifactId>jackson-jaxrs-json-provider</artifactId>
            <version>${jackson.version}</version>
        </dependency>

        <!-- OWASP Encoder -->
        <!-- Detected as "Unused dependency" but don't remove it, it's using in jsp -->
        <dependency>
            <groupId>org.owasp.encoder</groupId>
            <artifactId>encoder-jsp</artifactId>
            <version>1.2.3</version>
        </dependency>
        <dependency>
            <groupId>org.owasp.encoder</groupId>
            <artifactId>encoder</artifactId>
            <version>1.2.1</version>
        </dependency>

        <dependency>
            <groupId>org.owasp</groupId>
            <artifactId>csrfguard</artifactId>
            <version>3.1.0</version>
        </dependency>
        
        <!-- OWASP ESAPI for ClickjackFilter -->
        <!-- Added higher version to avoid security issue, suggested by GitHub Dependabot -->
        <!-- https://mvnrepository.com/artifact/org.owasp.esapi/esapi -->
        <dependency>
            <groupId>org.owasp.esapi</groupId>
            <artifactId>esapi</artifactId>
            <version>2.6.2.0</version>
            <exclusions>
                <exclusion>
                    <groupId>commons-lang</groupId>
                    <artifactId>commons-lang</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>
            <groupId>org.jasypt</groupId>
            <artifactId>jasypt</artifactId>
            <version>1.9.3</version>
        </dependency>
        <!-- Apache Commons Exec - used by ExternalEDocConverter -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-exec</artifactId>
            <version>1.4.0</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/org.codehaus.jettison/jettison -->
        <dependency>
            <groupId>org.codehaus.jettison</groupId>
            <artifactId>jettison</artifactId>
            <version>1.5.4</version>
        </dependency>

        <dependency>
            <groupId>org.jetbrains</groupId>
            <artifactId>annotations</artifactId>
            <version>24.1.0</version>
            <scope>compile</scope>
        </dependency>
        
        <!-- Selenium test dependencies -->
        <!-- Detected as "Unused dependency" but don't remove it, it's using actually -->
        <!-- https://mvnrepository.com/artifact/org.seleniumhq.selenium/selenium-java -->
        <dependency>
            <groupId>org.seleniumhq.selenium</groupId>
            <artifactId>selenium-java</artifactId>
            <version>4.40.0</version>
            <scope>test</scope>
            <exclusions>
                <!-- Exclude DevTools - not using Chrome DevTools Protocol -->
                <exclusion>
                    <groupId>org.seleniumhq.selenium</groupId>
                    <artifactId>selenium-devtools-v142</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.seleniumhq.selenium</groupId>
                    <artifactId>selenium-devtools-v143</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.seleniumhq.selenium</groupId>
                    <artifactId>selenium-devtools-v144</artifactId>
                </exclusion>
                <!-- Exclude OpenTelemetry - not using observability features -->
                <exclusion>
                    <groupId>io.opentelemetry</groupId>
                    <artifactId>*</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <!-- webdrivermanager removed - Selenium 4.6+ has built-in Selenium Manager -->
        <!-- that auto-downloads browser drivers, making webdrivermanager unnecessary -->
        <!-- Also removes vulnerable OkHttp 3.x transitive dependency -->
        <!-- https://mvnrepository.com/artifact/org.testng/testng -->
        <dependency>
            <groupId>org.testng</groupId>
            <artifactId>testng</artifactId>
            <version>7.5.1</version>
            <scope>test</scope>
        </dependency>

        <!-- Modern Test Framework Dependencies -->

        <!-- Mockito for Java 21 -->
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>5.8.0</version>
            <scope>test</scope>
        </dependency>

        <!-- Mockito JUnit Jupiter integration -->

        <!-- AssertJ for fluent assertions -->
        <dependency>
            <groupId>org.assertj</groupId>
            <artifactId>assertj-core</artifactId>
            <version>3.24.2</version>
            <scope>test</scope>
        </dependency>

        <!-- H2 in-memory database for tests -->
        <dependency>
            <groupId>com.h2database</groupId>
            <artifactId>h2</artifactId>
            <version>2.2.224</version>
            <scope>test</scope>
        </dependency>

        <!-- DBUnit for database testing -->
        <dependency>
            <groupId>org.dbunit</groupId>
            <artifactId>dbunit</artifactId>
            <version>2.7.3</version>
            <scope>test</scope>
            <exclusions>
                <!-- Exclude PostgreSQL driver - OpenO uses MariaDB/MySQL only -->
                <!-- Fixes CVE GHSA-24rp-q3w6-vc56 false positive -->
                <exclusion>
                    <groupId>org.postgresql</groupId>
                    <artifactId>postgresql</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!-- Playwright for UI/smoke testing -->
        <dependency>
            <groupId>com.microsoft.playwright</groupId>
            <artifactId>playwright</artifactId>
            <version>1.40.0</version>
            <scope>test</scope>
        </dependency>
        <!-- https://mvnrepository.com/artifact/com.google.guava/guava -->
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>33.4.8-jre</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/org.xhtmlrenderer/flying-saucer-pdf -->
        <dependency>
            <groupId>org.xhtmlrenderer</groupId>
            <artifactId>flying-saucer-pdf</artifactId>
            <version>9.13.3</version>
        </dependency>


        <!-- This is a dependency for the Caisi Integrator Objects. Only required until
        OpenJPA is no longer needed in Integrator. -->
        <!-- Detected as "Unused dependency" but don't remove it, it's using actually -->
        <dependency>
            <groupId>org.apache.openjpa</groupId>
            <artifactId>openjpa</artifactId>
            <version>3.2.2</version>
        </dependency>

        <!-- HAPI FHIR -->
        <!-- can be found in the local_repo folder -->
        <dependency>
            <groupId>ca.uhn.hapi.fhir</groupId>
            <artifactId>hapi-fhir-base</artifactId>
            <version>${hapifhir.version}</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>jcl-over-slf4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>ca.uhn.hapi.fhir</groupId>
            <artifactId>hapi-fhir-structures-dstu2</artifactId>
            <version>${hapifhir.version}</version>
        </dependency>
        <!-- Detected as "Unused dependency" but don't remove it, it's using actually -->
        <dependency>
            <groupId>ca.uhn.hapi.fhir</groupId>
            <artifactId>hapi-fhir-structures-dstu3</artifactId>
            <version>${hapifhir.version}</version>
        </dependency>

        <!-- flowsheets JAR -->
        <!-- REMOVED: now included as source code (decompiled with IntelliJ) -->

        <!-- Detected as "Unused dependency" but don't remove it, it's using actually -->
        <dependency>
           <groupId>com.sun.xml.ws</groupId>
           <artifactId>jaxws-ri</artifactId>
           <version>2.3.7</version>
           <type>pom</type>
           <exclusions>
                <!-- Not being used, excluded to avoid triggering security issue -->
                <exclusion>
                    <groupId>com.fasterxml.woodstox</groupId>
                    <artifactId>woodstox-core</artifactId>
                </exclusion>
           </exclusions>
        </dependency>
        <dependency>
            <groupId>javax.annotation</groupId>
            <artifactId>javax.annotation-api</artifactId>
            <version>1.3.2</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/javax.inject/javax.inject -->
        <!-- Required for @Inject annotation in OAuth resources (was transitive from jersey-client) -->
        <dependency>
            <groupId>javax.inject</groupId>
            <artifactId>javax.inject</artifactId>
            <version>1</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/javax.servlet.jsp/javax.servlet.jsp-api -->
        <dependency>
            <groupId>javax.servlet.jsp</groupId>
            <artifactId>javax.servlet.jsp-api</artifactId>
            <version>2.3.3</version>
            <scope>provided</scope>
        </dependency>

        <!-- Removed jaxb-impl duplicate - using org.glassfish.jaxb:jaxb-runtime instead -->
        <!-- Added for Tomcat 9.0.97 - JAXB runtime implementation (version managed by dependencyManagement) -->
        <dependency>
            <groupId>org.glassfish.jaxb</groupId>
            <artifactId>jaxb-runtime</artifactId>
        </dependency>

        <!-- JSTL API is included as transitive dependency of javax.servlet.jsp.jstl -->
        <!-- Removed standalone javax.servlet:jstl:1.2 to avoid conflicts -->

        <dependency>
            <groupId>org.apache.struts</groupId>
            <artifactId>struts2-core</artifactId>
            <version>6.8.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.struts</groupId>
            <artifactId>struts2-spring-plugin</artifactId>
            <version>6.8.0</version>
        </dependency>
        <!-- Required for Struts 6.x caching -->
        <dependency>
            <groupId>com.github.ben-manes.caffeine</groupId>
            <artifactId>caffeine</artifactId>
            <version>3.2.3</version>
        </dependency>
		<!-- https://mvnrepository.com/artifact/org.jboss.aerogear/aerogear-otp-java -->
		<dependency>
			<groupId>org.jboss.aerogear</groupId>
			<artifactId>aerogear-otp-java</artifactId>
			<version>1.0.0</version>
		</dependency>


    </dependencies>

    <build>
        <resources>
            <resource>
                <directory>${basedir}/src/main/resources</directory>
                <filtering>true</filtering>
                <excludes>
                </excludes>
            </resource>
        </resources>

        <plugins>
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>0.8.11</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-resources-plugin</artifactId>
                <version>3.3.1</version>
                <configuration>
                    <propertiesEncoding>ISO-8859-1</propertiesEncoding>
                    <nonFilteredFileExtensions>
                        <nonFilteredFileExtension>pdf</nonFilteredFileExtension>
                        <nonFilteredFileExtension>jar</nonFilteredFileExtension>
                        <nonFilteredFileExtension>xls</nonFilteredFileExtension>
                        <nonFilteredFileExtension>dat</nonFilteredFileExtension>
                        <nonFilteredFileExtension>xsd</nonFilteredFileExtension>
                        <nonFilteredFileExtension>jasper</nonFilteredFileExtension>
                        <nonFilteredFileExtension>doc</nonFilteredFileExtension>
                    </nonFilteredFileExtensions>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>buildnumber-maven-plugin</artifactId>
                <version>3.2.0</version>
                <executions>
                    <execution>
                        <phase>validate</phase>
                        <goals>
                            <goal>create</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>


            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-site-plugin</artifactId>
                <version>3.21.0</version>
                <dependencies>
                    <dependency>
                        <groupId>org.apache.maven.doxia</groupId>
                        <artifactId>doxia-module-markdown</artifactId>
                        <version>2.0.0</version>
                    </dependency>
                </dependencies>
                <configuration>
                    <inputEncoding>UTF-8</inputEncoding>
                    <outputEncoding>UTF-8</outputEncoding>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.13.0</version>
                <configuration>
                    <source>21</source>
                    <target>21</target>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-clean-plugin</artifactId>
                <version>3.5.0</version>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-dependency-plugin</artifactId>
                <version>3.8.1</version>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-antrun-plugin</artifactId>
                <version>3.1.0</version>
                <executions>
                    <execution>
                        <phase>process-classes</phase>
                        <goals>
                            <goal>run</goal>
                        </goals>
                        <configuration>
                            <target>
                                <tstamp>
                                    <format property="build.dateTime.value" pattern="yyyy-MM-dd hh:mm aa"/>
                                </tstamp>
                                <echo level="info" message="build time : ${build.dateTime.value}"/>
                                <replace file="target/classes/oscar_mcmaster.properties" token="${build.dateTime}" value="${build.dateTime.value}"/>
                                <property environment="env"/>
                                <echo level="info" message="JOB_NAME - BUILD_NUMBER : ${env.JOB_NAME}-${env.BUILD_NUMBER}"/>
                                <replace file="target/classes/oscar_mcmaster.properties" token="${build.JOB_NAME}" value="${env.JOB_NAME}"/>
                                <replace file="target/classes/oscar_mcmaster.properties" token="${build.BUILD_NUMBER}" value="${env.BUILD_NUMBER}"/>
                            </target>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-war-plugin</artifactId>
                <version>3.4.0</version>
                <configuration>
                    <webResources>
                        <resource>
                            <directory>src/main/webapp</directory>
                        </resource>
                        <resource>
                            <directory>src/main/webapp/WEB-INF/classes</directory>
                            <filtering>true</filtering>
                            <targetPath>WEB-INF/classes</targetPath>
                        </resource>
                    </webResources>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>3.6.0</version>
                <configuration>
                    <configLocation>${project.basedir}/utils/checkstyle.xml</configLocation>
                    <encoding>${project.build.sourceEncoding}</encoding>
                    <failsOnError>true</failsOnError>
                    <consoleOutput>true</consoleOutput>
                    <sourceDirectories>
                        <sourceDirectory>${project.basedir}/src/main</sourceDirectory>
                    </sourceDirectories>
                    <includes>**/*.java</includes>
                    <!-- File types to exclude from checkstyle -->
                    <excludes>
                        **/*.jar,
                        **/*.txt,
                        **/*.rpt,
                        **/*.fla,
                        **/*.xml,
                        **/*.dtd,
                        **/*.xslt,
                        **/*.doc,
                        **/*.bak,
                        **/*.tld,
                        **/*.jpg,
                        **/*.png,
                        **/*.gif,
                        **/*.pdf,
                        **/*.swf,
                        **/*.js,
                        **/*.css,
                        **/*svg.jsp
                    </excludes>
                    <!-- Specific files to exclude from checkstyle -->
                    <exclude>src/main/webapp/casemgmt/Index2.jsp</exclude>
                    <exclude>src/main/java/oscar/oscarMessenger/util/MsgDemoMap.java</exclude>
                    <exclude>src/main/java/oscar/oscarEncounter/pageUtil/EctDisplayMsgAction.java</exclude>
                    <exclude>src/main/webapp/oscarEncounter/Index.jsp</exclude>
                    <exclude>src/main/java/oscar/oscarEncounter/data/EctPatientData.java</exclude>
                </configuration>
                <dependencies>
                    <dependency>
                        <groupId>com.puppycrawl.tools</groupId>
                        <artifactId>checkstyle</artifactId>
                        <version>10.20.1</version>
                    </dependency>
                </dependencies>
                <executions>
                    <execution>
                        <id>process-sources</id>
                        <phase>process-sources</phase>
                        <goals>
                            <goal>checkstyle</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <version>3.27.0</version>
                <configuration>
                    <!-- Target JDK version -->
                    <targetJdk>21</targetJdk>
                    
                    <!-- Custom ruleset -->
                    <rulesets>
                        <ruleset>utils/pmd_rules.xml</ruleset>
                    </rulesets>
                    
                    <!-- Analysis configuration -->
                    <includeTests>false</includeTests>
                    <minimumTokens>100</minimumTokens>
                    <printFailingErrors>true</printFailingErrors>
                    <linkXRef>false</linkXRef>
                    
                    <!-- Performance settings -->
                    <analysisCache>true</analysisCache>
                    <analysisCacheLocation>${project.build.directory}/pmd/pmd.cache</analysisCacheLocation>
                    
                    <!-- Output formats -->
                    <format>html</format>
                    <outputDirectory>${project.build.directory}/pmd</outputDirectory>
                    
                    <!-- Exclude generated code and known legacy files -->
                    <excludeRoots>
                        <excludeRoot>target/generated-sources</excludeRoot>
                    </excludeRoots>
                    <excludes>
                        <exclude>**/generated/**</exclude>
                        <exclude>**/*_.java</exclude>
                    </excludes>
                </configuration>
                <dependencies>
                    <dependency>
                        <groupId>net.sourceforge.pmd</groupId>
                        <artifactId>pmd-core</artifactId>
                        <version>7.10.0</version>
                    </dependency>
                    <dependency>
                        <groupId>net.sourceforge.pmd</groupId>
                        <artifactId>pmd-java</artifactId>
                        <version>7.10.0</version>
                    </dependency>
                </dependencies>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.2.5</version>
                <executions>
                    <!-- Override default test execution -->
                    <execution>
                        <id>default-test</id>
                        <configuration>
                            <skip>true</skip>
                        </configuration>
                    </execution>
                    <!-- Run modern tests with JUnit 5 -->
                    <execution>
                        <id>modern-tests</id>
                        <phase>${modern.tests.phase}</phase>
                        <goals>
                            <goal>test</goal>
                        </goals>
                        <configuration>
                            <skip>${skipModernTests}</skip>
                            <testSourceDirectory>src/test-modern/java</testSourceDirectory>
                            <reportsDirectory>${project.build.directory}/surefire-reports-modern</reportsDirectory>
                            <testClassesDirectory>${project.build.directory}/test-classes</testClassesDirectory>
                            <includes>
                                <include>**/test/**/*Test.java</include>
                                <include>**/test/**/*Tests.java</include>
                                <include>**/tickler/**/*Test.java</include>
                                <include>**/managers/**/*Test.java</include>
                            </includes>
                            <excludes>
                                <!-- Exclude archive tests from modern test run -->
                                <exclude>**/archive/**/*Test.java</exclude>
                            </excludes>
                            <argLine>
                                -Xmx2048m
                                -Dnet.bytebuddy.experimental=true
                                --add-opens java.base/java.lang=ALL-UNNAMED
                                --add-opens java.base/java.util=ALL-UNNAMED
                            </argLine>
                            <!-- Test filtering by groups when specified -->
                            <groups>${groups}</groups>
                        </configuration>
                    </execution>
                    <!-- Run legacy tests WITHOUT JUnit 5 -->
                    <execution>
                        <id>legacy-tests</id>
                        <phase>${legacy.tests.phase}</phase>
                        <goals>
                            <goal>test</goal>
                        </goals>
                        <configuration>
                            <skip>${skipLegacyTests}</skip>
                            <testSourceDirectory>src/test/java</testSourceDirectory>
                            <reportsDirectory>${project.build.directory}/surefire-reports</reportsDirectory>
                            <testClassesDirectory>${project.build.directory}/test-classes</testClassesDirectory>
                            <!-- Exclude modern test classes from classpath -->
                            <classpathDependencyExcludes>
                                <classpathDependencyExclude>*:*test-modern*</classpathDependencyExclude>
                            </classpathDependencyExcludes>
                            <excludes>
                                <exclude>**/*EDTTest.java</exclude>
                                <exclude>**/HinValidatorTest.java</exclude>
                                <exclude>**/AR2005*.java</exclude>
                                <exclude>**/OntarioMDSpec4DataTest.java</exclude>
                                <exclude>**/ONAREnhancedBornConnectorTest.java</exclude>
                                <exclude>org/oscarehr/e2e/**/*.java</exclude>
                                <!-- Exclude modern test packages from legacy test run -->
                                <exclude>**/tickler/dao/**IntegrationTest.java</exclude>
                                <exclude>**/tickler/dao/**UnitTest.java</exclude>
                                <exclude>**/tickler/manager/**Test.java</exclude>
                                <exclude>**/test/simple/**Test.java</exclude>
                                <exclude>**/test/examples/**Test.java</exclude>
                                <exclude>**/test/base/**Test.java</exclude>
                                <exclude>tests/**</exclude>
                            </excludes>
                            <systemPropertyVariables>
                                <oscar.dbinit.skip>${oscar.dbinit.skip}</oscar.dbinit.skip>
                                <buildDirectory>${project.build.directory}</buildDirectory>
                            </systemPropertyVariables>
                            <!-- Java 21 compatibility flags for JAXB -->
                            <argLine>
                                -Xmx2048m
                                -Dnet.bytebuddy.experimental=true
                                --add-opens java.base/java.lang=ALL-UNNAMED
                                --add-opens java.base/java.lang.reflect=ALL-UNNAMED
                                --add-opens java.base/sun.reflect=ALL-UNNAMED
                                --add-opens java.base/sun.nio.ch=ALL-UNNAMED
                                --add-opens java.base/java.io=ALL-UNNAMED
                                --add-opens java.base/java.util=ALL-UNNAMED
                            </argLine>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>build-helper-maven-plugin</artifactId>
                <version>3.6.0</version>
                <executions>
                    <execution>
                        <id>timestamp-property</id>
                        <goals>
                            <goal>timestamp-property</goal>
                        </goals>
                        <configuration>
                            <name>build.time</name>
                            <pattern>yy.MM.dd-HHmmss</pattern>
                            <locale>en_US</locale>
                            <timeZone>Canada/Eastern</timeZone>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!-- Update lockfile - mvn se.vandmo:dependency-lock-maven-plugin:lock -->
            <plugin>
                <groupId>se.vandmo</groupId>
                <artifactId>dependency-lock-maven-plugin</artifactId>
                <version>1.1.0</version>
                <configuration>
                    <!-- Can be overridden with -Ddependency.lock.filename=xxx -->
                    <filename>${dependency.lock.filename}</filename>
                </configuration>
                <executions>
                    <execution>
                        <id>check</id>
                        <phase>validate</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- Javadoc HTML generation for documentation -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>3.11.2</version>
                <configuration>
                    <outputDirectory>${project.build.directory}/site/apidocs</outputDirectory>
                    <reportOutputDirectory>${project.build.directory}/site/apidocs</reportOutputDirectory>
                    <destDir>apidocs</destDir>
                    <doclint>none</doclint>
                    <failOnError>false</failOnError>
                    <failOnWarnings>false</failOnWarnings>
                    <quiet>true</quiet>
                    <source>21</source>
                    <additionalJOptions>
                        <additionalJOption>-Xdoclint:none</additionalJOption>
                    </additionalJOptions>
                    <!-- Skip missing documentation gracefully -->
                    <additionalparam>-Xdoclint:none</additionalparam>
                </configuration>
                <executions>
                    <execution>
                        <id>generate-javadoc</id>
                        <phase>package</phase>
                        <goals>
                            <goal>javadoc</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <!-- Profile for modern tests with JUnit 5 -->
        <profile>
            <id>modern-tests</id>
            <activation>
                <property>
                    <!-- Activate when NOT skipping modern tests -->
                    <name>!skipModernTests</name>
                </property>
            </activation>
            <properties>
                <!-- Use modern lock file when modern-tests profile is active -->
                <dependency.lock.filename>dependencies-lock-modern.json</dependency.lock.filename>
            </properties>
            <dependencies>
                <!-- JUnit 5 (Jupiter) -->
                <dependency>
                    <groupId>org.junit.jupiter</groupId>
                    <artifactId>junit-jupiter</artifactId>
                    <version>5.10.1</version>
                    <scope>test</scope>
                </dependency>
                <!-- JUnit 5 Params for parameterized tests -->
                <dependency>
                    <groupId>org.junit.jupiter</groupId>
                    <artifactId>junit-jupiter-params</artifactId>
                    <version>5.10.1</version>
                    <scope>test</scope>
                </dependency>
                <!-- Mockito JUnit Jupiter integration -->
                <dependency>
                    <groupId>org.mockito</groupId>
                    <artifactId>mockito-junit-jupiter</artifactId>
                    <version>5.8.0</version>
                    <scope>test</scope>
                </dependency>
            </dependencies>
            <build>
                <plugins>
                    <!-- Add modern test sources only when profile is active -->
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>build-helper-maven-plugin</artifactId>
                        <version>3.6.0</version>
                        <executions>
                            <execution>
                                <id>add-modern-test-source</id>
                                <phase>generate-test-sources</phase>
                                <goals>
                                    <goal>add-test-source</goal>
                                </goals>
                                <configuration>
                                    <sources>
                                        <source>src/test-modern/java</source>
                                    </sources>
                                </configuration>
                            </execution>
                            <execution>
                                <id>add-modern-test-resource</id>
                                <phase>generate-test-resources</phase>
                                <goals>
                                    <goal>add-test-resource</goal>
                                </goals>
                                <configuration>
                                    <resources>
                                        <resource>
                                            <directory>src/test-modern/resources</directory>
                                        </resource>
                                    </resources>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <!-- Skip jsp compile, run 'mvn package -Pjspc' to compile jsps -->
            <id>jspc</id>
            <activation>
                <activeByDefault>false</activeByDefault>
            </activation>
            <build>
                <plugins>
                    <!-- https://mvnrepository.com/artifact/io.leonard.maven.plugins/jspc-maven-plugin -->
                    <plugin>
                        <groupId>io.leonard.maven.plugins</groupId>
                        <artifactId>jspc-maven-plugin</artifactId>
                        <version>3.0.0</version>
                        <executions>
                            <execution>
                                <id>jspc</id>
                                <goals>
                                    <goal>compile</goal>
                                </goals>
                                <configuration>
                                    <sourceDirectory>src/main/webapp</sourceDirectory>
                                    <outputDirectory>src/main/jsp</outputDirectory>
                                    <excludes>
                                        <exclude>**/*.jspf</exclude>
                                        <!-- Exclude the deprecated jsp file, the file is not using now -->
                                        <exclude>oscarEncounter/oscarConsultationRequest/attachConsultation2.jsp</exclude>
                                        <!-- Detect html taglib related errors, exclude for now -->
                                        <exclude>PMmodule/Admin/Bed/Bed.jsp</exclude>
                                        <exclude>PMmodule/Admin/AgencyEdit/bed.jsp</exclude>
                                    </excludes>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!-- Profile to skip modern tests if needed -->
        <profile>
            <id>skip-modern-tests</id>
            <activation>
                <property>
                    <name>skipModernTests</name>
                    <value>true</value>
                </property>
            </activation>
            <properties>
                <skipModernTests>true</skipModernTests>
                <modern.tests.phase>none</modern.tests.phase>
            </properties>
        </profile>
        <profile>
            <id>skip-legacy-tests</id>
            <activation>
                <property>
                    <name>skipLegacyTests</name>
                    <value>true</value>
                </property>
            </activation>
            <properties>
                <skipLegacyTests>true</skipLegacyTests>
                <legacy.tests.phase>none</legacy.tests.phase>
            </properties>
        </profile>
    </profiles>
</project>