From 5ce83c1bcf92140b1fe2e89e88c4e8c4beca2b8a Mon Sep 17 00:00:00 2001
From: Zebb McAteer <zebb.mcateer@smartservice.qld.gov.au>
Date: Mon, 10 Jun 2024 12:58:06 +1000
Subject: [PATCH] [440] Update pom with springboot BoM

---
 pom.xml | 739 ++++++++++++++++++++++++++++++--------------------------
 1 file changed, 397 insertions(+), 342 deletions(-)

diff --git a/pom.xml b/pom.xml
index a1b9bce..5732678 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1,5 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
 
     <groupId>au.gov.qld.online</groupId>
@@ -35,9 +36,6 @@
         <maven-pmd-plugin.version>3.22.0</maven-pmd-plugin.version>
         <owasp.dependency-check-maven.version>9.2.0</owasp.dependency-check-maven.version>
 
-        <!--<io.netty.version>4.1.87.Final</io.netty.version>--> <!-- verify this matches in org.seleniumhq.selenium:selenium-remote-driver -->
-        <!--<guava.version>32.0.0-jre</guava.version>--> <!-- verify this matches in selenium-chrome-driver -->
-
         <qa.directory>${project.basedir}/src/qa</qa.directory>
         <maven-checkstyle-plugin.version>3.4.0</maven-checkstyle-plugin.version>
         <checkstyle.version>10.17.0</checkstyle.version>
@@ -55,399 +53,456 @@
 
     <dependencyManagement>
         <dependencies>
-            <!--<dependency><scope>import</scope><type>pom</type><groupId>io.netty</groupId><artifactId>netty-bom</artifactId><version>${io.netty.version}</version></dependency>-->
-            <!--<dependency><scope>import</scope><type>pom</type><groupId>com.google.guava</groupId><artifactId>guava-bom</artifactId><version>${guava.version}</version></dependency>-->
-            <dependency><groupId>org.eclipse.jetty.websocket</groupId><artifactId>websocket-client</artifactId><version>9.4.54.v20240208</version></dependency>
-            <dependency><scope>import</scope><type>pom</type><groupId>org.assertj</groupId><artifactId>assertj-bom</artifactId><version>3.26.0</version></dependency>
-            <dependency><groupId>net.bytebuddy</groupId><artifactId>byte-buddy</artifactId><version>1.14.17</version>
+            <dependency>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-dependencies</artifactId>
+                <version>3.3.0</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.assertj</groupId>
+                <artifactId>assertj-bom</artifactId>
+                <version>3.26.0</version>
+                <type>pom</type>
+                <scope>import</scope>
             </dependency>
         </dependencies>
     </dependencyManagement>
 
     <dependencies>
-        <!-- overrides of wdm docker features -->
-        <dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.17.0</version></dependency>
-        <dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-annotations</artifactId><version>2.17.0</version></dependency>
-
-        <dependency><groupId>io.github.bonigarcia</groupId><artifactId>webdrivermanager</artifactId><version>5.8.0</version>
+        <dependency>
+            <groupId>io.github.bonigarcia</groupId>
+            <artifactId>webdrivermanager</artifactId>
+            <version>5.8.0</version>
             <exclusions>
-                <exclusion><groupId>org.slf4j</groupId><artifactId>slf4j-api</artifactId></exclusion>
-                <exclusion><groupId>com.google.guava</groupId><artifactId>guava</artifactId></exclusion>
-                <exclusion><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-annotations</artifactId></exclusion>
-                <exclusion><groupId>org.slf4j</groupId><artifactId>slf4j-api</artifactId></exclusion>
-                <exclusion><groupId>com.github.docker-java</groupId><artifactId>docker-java</artifactId></exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-api</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>com.google.guava</groupId>
+                    <artifactId>guava</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>com.fasterxml.jackson.core</groupId>
+                    <artifactId>jackson-annotations</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-api</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>com.github.docker-java</groupId>
+                    <artifactId>docker-java</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>commons-io</groupId>
+                    <artifactId>commons-io</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
+
         <dependency>
-            <groupId>org.apache.httpcomponents.client5</groupId>
-            <artifactId>httpclient5</artifactId>
-            <version>5.3.1</version>
+            <groupId>org.seleniumhq.selenium</groupId>
+            <artifactId>selenium-java</artifactId>
+            <version>4.21.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.seleniumhq.selenium</groupId>
+            <artifactId>htmlunit3-driver</artifactId>
+            <version>4.21.0</version>
         </dependency>
 
-        <dependency><groupId>org.slf4j</groupId><artifactId>slf4j-api</artifactId><version>2.0.13</version></dependency>
-
-        <dependency><groupId>org.seleniumhq.selenium</groupId><artifactId>selenium-java</artifactId><version>4.21.0</version>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
         </dependency>
-        <dependency><groupId>org.seleniumhq.selenium</groupId><artifactId>htmlunit3-driver</artifactId><version>4.21.0</version></dependency>
 
-        <dependency><scope>test</scope><groupId>org.junit.jupiter</groupId><artifactId>junit-jupiter-api</artifactId><version>5.10.2</version></dependency>
-        <dependency><scope>test</scope><groupId>org.assertj</groupId><artifactId>assertj-core</artifactId><version>3.22.0</version></dependency>
-        <dependency><scope>test</scope><groupId>ch.qos.logback</groupId><artifactId>logback-classic</artifactId><version>1.4.14</version>
+        <dependency>
+            <scope>test</scope>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-classic</artifactId>
+        </dependency>
+        <dependency>
+            <scope>test</scope>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-api</artifactId>
+        </dependency>
+        <dependency>
+            <scope>test</scope>
+            <groupId>org.assertj</groupId>
+            <artifactId>assertj-core</artifactId>
         </dependency>
     </dependencies>
 
     <build>
         <plugins>
             <!-- Disabled while upgrading to ensure it compiles. -->
-<!--        <plugin>-->
-<!--            <artifactId>maven-enforcer-plugin</artifactId>-->
-<!--            <version>3.5.0</version>-->
-<!--            <executions>-->
-<!--                <execution>-->
-<!--                    <id>enforce</id>-->
-<!--                    <configuration>-->
-<!--                        <rules>-->
-<!--                            <dependencyConvergence />-->
-<!--                            <banDuplicatePomDependencyVersions />-->
-<!--                        </rules>-->
-<!--                    </configuration>-->
-<!--                    <goals>-->
-<!--                        <goal>enforce</goal>-->
-<!--                    </goals>-->
-<!--                </execution>-->
-<!--            </executions>-->
-<!--        </plugin>-->
-        <plugin>
-            <artifactId>maven-compiler-plugin</artifactId>
-            <version>${maven-compiler-plugin.version}</version>
-            <configuration>
-                <release>${java.version}</release>
-            </configuration>
-        </plugin>
-
-        <plugin>
-            <groupId>org.jacoco</groupId><artifactId>jacoco-maven-plugin</artifactId>
-            <version>${jacoco.version}</version>
-        </plugin>
-
-
-        <plugin>
-            <artifactId>maven-eclipse-plugin</artifactId>
-            <version>2.10</version>
-            <configuration>
-                <downloadSources>true</downloadSources>
-                <downloadJavadocs>false</downloadJavadocs>
-                <wtpversion>2.0</wtpversion>
-            </configuration>
-        </plugin>
-
-        <plugin>
-            <groupId>pl.project13.maven</groupId>
-            <artifactId>git-commit-id-plugin</artifactId>
-            <version>${git-commit-id-plugin.version}</version>
-            <configuration>
-                <dotGitDirectory>${project.basedir}/.git</dotGitDirectory>
-                <!-- this is false by default, forces the plugin to generate the git.properties file -->
-                <generateGitPropertiesFile>true</generateGitPropertiesFile>
-                <!-- The path for the properties file to be generated. See Super Pom for default variable reference https://maven.apache.org/guides/introduction/introduction-to-the-pom.html -->
-                <generateGitPropertiesFilename>${project.build.outputDirectory}/git.properties</generateGitPropertiesFilename>
-            </configuration>
-        </plugin>
-
-        <!--Set up to ignore integration tests-->
-        <!-- mvn clean test -->
-        <plugin>
-            <artifactId>maven-surefire-plugin</artifactId>
-            <version>${maven-surefire-plugin.version}</version>
-            <configuration>
-                <skipTests>${surefire.skip}</skipTests>
-                <systemPropertyVariables>
-                    <!--<headless.disabled>false</headless.disabled>-->
-                </systemPropertyVariables>
-            </configuration>
-        </plugin>
-
-        <!-- integration tests which are not cumcumber mvn verify or mvn integration-test run's theses
-         turn off with -Dskip.failsafe.tests=false -->
-        <plugin>
-            <artifactId>maven-failsafe-plugin</artifactId>
-            <version>${maven-failsafe-plugin.version}</version>
-            <dependencies>
-                <dependency>
-                    <groupId>org.apache.maven.surefire</groupId>
-                    <artifactId>surefire-junit47</artifactId>
-                    <version>${maven-failsafe-plugin.version}</version>
-                </dependency>
-            </dependencies>
-            <executions>
-                <execution>
-                    <id>default</id>
-                    <goals>
-                        <goal>integration-test</goal>
-                        <goal>verify</goal>
-                    </goals>
-                    <configuration>
-                        <skipITs>${failsafe.skip}</skipITs>
-
-                    </configuration>
-                </execution>
-            </executions>
-        </plugin>
-
-
-        <plugin>
-            <artifactId>maven-checkstyle-plugin</artifactId>
-            <version>${maven-checkstyle-plugin.version}</version>
-        </plugin>
-
-        <plugin>
-            <artifactId>maven-pmd-plugin</artifactId>
-            <version>${maven-pmd-plugin.version}</version>
-        </plugin>
-
-        <plugin>
-            <groupId>com.github.spotbugs</groupId><artifactId>spotbugs-maven-plugin</artifactId>
-        </plugin>
-        <plugin>
-            <groupId>org.owasp</groupId><artifactId>dependency-check-maven</artifactId>
-            <version>${owasp.dependency-check-maven.version}</version>
-        </plugin>
-
-    </plugins>
-    <pluginManagement>
-        <plugins>
             <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <version>${maven-compiler-plugin.version}</version>
-                <configuration>
-                    <release>${java.version}</release>
-                </configuration>
-            </plugin>
-            <plugin>
-                <groupId>org.jacoco</groupId><artifactId>jacoco-maven-plugin</artifactId><version>${jacoco.version}</version>
-                <configuration>
-                    <excludes>
-                        <exclude>com/gargoylesoftware/htmlunit/**/*</exclude>
-                    </excludes>
-                </configuration>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <version>3.5.0</version>
                 <executions>
-                    <!--
-                        Prepares the property pointing to the JaCoCo runtime agent which
-                        is passed as VM argument when Maven the Surefire plugin is executed.
-                    -->
                     <execution>
-                        <id>default-prepare-agent</id>
-                        <phase>initialize</phase>
-                        <goals>
-                            <goal>prepare-agent</goal>
-                        </goals>
-                    </execution>
-                    <execution>
-                        <id>default-report</id>
-                        <goals>
-                            <goal>report</goal>
-                        </goals>
+                        <id>enforce</id>
                         <configuration>
-                            <title>Jacoco Unit Tests ${project.name}</title>
+                            <rules>
+                                <dependencyConvergence/>
+                                <banDuplicatePomDependencyVersions/>
+                            </rules>
                         </configuration>
-                    </execution>
-                    <execution>
-                        <id>pre-integration-test</id>
-                        <!--						<phase>pre-integration-test</phase>-->
                         <goals>
-                            <goal>prepare-agent-integration</goal>
+                            <goal>enforce</goal>
                         </goals>
                     </execution>
-                    <execution>
-                        <id>default-report-integration</id>
-                        <goals>
-                            <goal>report-integration</goal>
-                        </goals>
-                        <configuration>
-                            <title>Jacoco Integration ${project.name}</title>
-                        </configuration>
-                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>${maven-compiler-plugin.version}</version>
+                <configuration>
+                    <release>${java.version}</release>
+                </configuration>
+            </plugin>
 
-                    <execution>
-                        <id>default-merge</id>
-                        <phase>verify</phase>
-                        <goals>
-                            <goal>merge</goal>
-                        </goals>
-                        <configuration>
-                            <fileSets>
-                                <fileSet>
-                                    <directory>${project.build.directory}</directory>
-                                    <include>jacoco.exec</include>
-                                    <include>jacoco-it.exec</include>
-                                </fileSet>
-                            </fileSets>
-                            <destFile>${project.build.directory}/jacoco-merge.exec</destFile>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>default-report-merge</id>
-                        <goals>
-                            <goal>report-integration</goal>
-                        </goals>
-                        <configuration>
-                            <dataFile>${project.build.directory}/jacoco-merge.exec</dataFile>
-                            <outputDirectory>${project.reporting.outputDirectory}/jacoco-merge</outputDirectory>
-                            <title>Jacoco Merge ${project.name}</title>
-                        </configuration>
-                    </execution>
+            <plugin>
+                <groupId>org.jacoco</groupId>
+                <artifactId>jacoco-maven-plugin</artifactId>
+                <version>${jacoco.version}</version>
+            </plugin>
 
-                    <execution>
-                        <id>default-check</id>
-                        <goals>
-                            <goal>check</goal>
-                        </goals>
-                        <configuration>
-                            <dataFile>${project.build.directory}/jacoco-merge.exec</dataFile>
-                            <excludes>
-                                <!--<exclude>au/gov/qld/something/**/*.class</exclude>-->
-                            </excludes>
-                            <rules>
-                                <rule implementation="org.jacoco.maven.RuleConfiguration">
-                                    <element>CLASS</element>
-                                    <limits>
-                                        <limit implementation="org.jacoco.report.check.Limit">
-                                            <counter>BRANCH</counter>
-                                            <value>COVEREDRATIO</value>
-                                            <minimum>0.0</minimum><!-- FIXME! -->
-                                        </limit>
-                                        <limit implementation="org.jacoco.report.check.Limit">
-                                            <counter>INSTRUCTION</counter>
-                                            <value>COVEREDRATIO</value>
-                                            <minimum>0.0</minimum><!-- FIXME! -->
-                                        </limit>
-                                    </limits>
-                                </rule>
-                                <rule implementation="org.jacoco.maven.RuleConfiguration">
-                                    <element>BUNDLE</element>
-                                    <limits>
-                                        <limit implementation="org.jacoco.report.check.Limit">
-                                            <counter>INSTRUCTION</counter>
-                                            <value>COVEREDRATIO</value>
-                                            <minimum>0.0</minimum><!-- FIXME! -->
-                                        </limit>
-                                    </limits>
-                                </rule>
-                            </rules>
-                        </configuration>
-                    </execution>
-                </executions>
+
+            <plugin>
+                <artifactId>maven-eclipse-plugin</artifactId>
+                <version>2.10</version>
+                <configuration>
+                    <downloadSources>true</downloadSources>
+                    <downloadJavadocs>false</downloadJavadocs>
+                    <wtpversion>2.0</wtpversion>
+                </configuration>
             </plugin>
 
             <plugin>
-                <artifactId>maven-checkstyle-plugin</artifactId>
-                <version>${checkstyle.version}</version>
-                <dependencies>
-                    <dependency>
-                        <groupId>com.puppycrawl.tools</groupId>
-                        <artifactId>checkstyle</artifactId>
-                        <version>10.17.0</version>
-                    </dependency>
-                </dependencies>
+                <groupId>pl.project13.maven</groupId>
+                <artifactId>git-commit-id-plugin</artifactId>
+                <version>${git-commit-id-plugin.version}</version>
                 <configuration>
-                    <includeTestSourceDirectory>true</includeTestSourceDirectory>
-                    <configLocation>${qa.directory}/checkstyle_rules.xml</configLocation>
-                    <propertyExpansion>qa.directory=${qa.directory}</propertyExpansion>
-                    <excludes>
-                        node_modules,src/main/webapp/WEB-INF/eligibility-checklist/node_modules,src/main/webapp/WEB-INF/eligibility-checklist/dist.tar.gz
-                    </excludes>
+                    <dotGitDirectory>${project.basedir}/.git</dotGitDirectory>
+                    <!-- this is false by default, forces the plugin to generate the git.properties file -->
+                    <generateGitPropertiesFile>true</generateGitPropertiesFile>
+                    <!-- The path for the properties file to be generated. See Super Pom for default variable reference https://maven.apache.org/guides/introduction/introduction-to-the-pom.html -->
+                    <generateGitPropertiesFilename>${project.build.outputDirectory}/git.properties
+                    </generateGitPropertiesFilename>
+                </configuration>
+            </plugin>
 
+            <!--Set up to ignore integration tests-->
+            <!-- mvn clean test -->
+            <plugin>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <version>${maven-surefire-plugin.version}</version>
+                <configuration>
+                    <skipTests>${surefire.skip}</skipTests>
+                    <systemPropertyVariables>
+                        <!--<headless.disabled>false</headless.disabled>-->
+                    </systemPropertyVariables>
                 </configuration>
-                <executions>
-                    <execution>
-                        <phase>test-compile</phase> <!-- too late at prepare-package -->
-                        <goals>
-                            <!--<goal>checkstyle</goal> --><!-- can be checkstyle to not fail the build-->
-                            <goal>check</goal>
-                        </goals>
-                    </execution>
-                </executions>
             </plugin>
 
+            <!-- integration tests which are not cumcumber mvn verify or mvn integration-test run's theses
+             turn off with -Dskip.failsafe.tests=false -->
             <plugin>
-                <artifactId>maven-pmd-plugin</artifactId>
-                <version>${maven-pmd-plugin.version}</version>
+                <artifactId>maven-failsafe-plugin</artifactId>
+                <version>${maven-failsafe-plugin.version}</version>
                 <dependencies>
                     <dependency>
-                        <groupId>net.sourceforge.pmd</groupId>
-                        <artifactId>pmd-core</artifactId>
-                        <version>${pmd.version}</version>
-                    </dependency>
-                    <dependency>
-                        <groupId>net.sourceforge.pmd</groupId>
-                        <artifactId>pmd-java</artifactId>
-                        <version>${pmd.version}</version>
+                        <groupId>org.apache.maven.surefire</groupId>
+                        <artifactId>surefire-junit47</artifactId>
+                        <version>${maven-failsafe-plugin.version}</version>
                     </dependency>
                 </dependencies>
-                <configuration>
-                    <includeTests>false</includeTests>
-                    <rulesets>
-                        <!--<ruleset>/rulesets/java/basic.xml</ruleset>-->
-                        <ruleset>${qa.directory}/pmd-rules.xml</ruleset>
-                    </rulesets>
-                    <excludeRoots>
-                        <excludeRoot>${project.basedir}/target/generated-sources</excludeRoot>
-                    </excludeRoots>
-                    <printFailingErrors>true</printFailingErrors>
-                </configuration>
                 <executions>
                     <execution>
-                        <phase>validate</phase> <!-- too late at prepare-package -->
+                        <id>default</id>
                         <goals>
-                            <goal>check</goal>
+                            <goal>integration-test</goal>
+                            <goal>verify</goal>
                         </goals>
+                        <configuration>
+                            <skipITs>${failsafe.skip}</skipITs>
+
+                        </configuration>
                     </execution>
                 </executions>
             </plugin>
 
-            <plugin><groupId>com.github.spotbugs</groupId><artifactId>spotbugs-maven-plugin</artifactId>
-                <version>${spotbugs-maven-plugin.version}</version>
-                <configuration>
-                    <excludeFilterFile>${qa.directory}/findbugs-exclude.xml</excludeFilterFile>
-                    <effort>Max</effort>
-                    <threshold>High</threshold>
-                    <includeTests>true</includeTests>
-                    <plugins>
-                        <plugin><groupId>com.h3xstream.findsecbugs</groupId><artifactId>findsecbugs-plugin</artifactId><version>${findsecbugs-plugin.version}</version></plugin>
-                        <plugin><groupId>com.mebigfatguy.sb-contrib</groupId><artifactId>sb-contrib</artifactId><version>${sb-contrib.version}</version></plugin>
-                    </plugins>
-                </configuration>
-                <executions>
-                    <execution>
-                        <phase>test-compile</phase> <!-- too late at prepare-package -->
-                        <goals>
-                            <!--<goal>findbugs</goal>--> <!--can be findbugs to not fail the build-->
-                            <goal>check</goal>
-                        </goals>
-                    </execution>
-                </executions>
+
+            <plugin>
+                <artifactId>maven-checkstyle-plugin</artifactId>
+                <version>${maven-checkstyle-plugin.version}</version>
             </plugin>
 
             <plugin>
-                <groupId>org.owasp</groupId><artifactId>dependency-check-maven</artifactId><version>${owasp.dependency-check-maven.version}</version>
-                <configuration>
-                    <suppressionFile>${qa.directory}/owasp-dependency-checker-suppressions.xml</suppressionFile>
-                    <failBuildOnCVSS>2</failBuildOnCVSS>
-                    <skip>${dependency.skip}</skip>
-                    <nvdApiKey>${env.NVD_NIST_APIKEY}</nvdApiKey>
-                    <bundleAuditAnalyzerEnabled>false</bundleAuditAnalyzerEnabled>
-                </configuration>
-                <executions>
-                    <execution>
-                        <!--<phase>validate</phase>--> <!-- too late at prepare-package -->
-                        <goals><goal>check</goal></goals>
-                    </execution>
-                </executions>
+                <artifactId>maven-pmd-plugin</artifactId>
+                <version>${maven-pmd-plugin.version}</version>
+            </plugin>
+
+            <plugin>
+                <groupId>com.github.spotbugs</groupId>
+                <artifactId>spotbugs-maven-plugin</artifactId>
+            </plugin>
+            <plugin>
+                <groupId>org.owasp</groupId>
+                <artifactId>dependency-check-maven</artifactId>
+                <version>${owasp.dependency-check-maven.version}</version>
             </plugin>
         </plugins>
-    </pluginManagement>
-</build>
+
+        <pluginManagement>
+            <plugins>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-compiler-plugin</artifactId>
+                    <version>${maven-compiler-plugin.version}</version>
+                    <configuration>
+                        <release>${java.version}</release>
+                    </configuration>
+                </plugin>
+                <plugin>
+                    <groupId>org.jacoco</groupId>
+                    <artifactId>jacoco-maven-plugin</artifactId>
+                    <version>${jacoco.version}</version>
+                    <executions>
+                        <!--
+                            Prepares the property pointing to the JaCoCo runtime agent which
+                            is passed as VM argument when Maven the Surefire plugin is executed.
+                        -->
+                        <execution>
+                            <id>default-prepare-agent</id>
+                            <phase>initialize</phase>
+                            <goals>
+                                <goal>prepare-agent</goal>
+                            </goals>
+                        </execution>
+                        <execution>
+                            <id>default-report</id>
+                            <goals>
+                                <goal>report</goal>
+                            </goals>
+                            <configuration>
+                                <title>Jacoco Unit Tests ${project.name}</title>
+                            </configuration>
+                        </execution>
+                        <execution>
+                            <id>pre-integration-test</id>
+                            <!--						<phase>pre-integration-test</phase>-->
+                            <goals>
+                                <goal>prepare-agent-integration</goal>
+                            </goals>
+                        </execution>
+                        <execution>
+                            <id>default-report-integration</id>
+                            <goals>
+                                <goal>report-integration</goal>
+                            </goals>
+                            <configuration>
+                                <title>Jacoco Integration ${project.name}</title>
+                            </configuration>
+                        </execution>
+
+                        <execution>
+                            <id>default-merge</id>
+                            <phase>verify</phase>
+                            <goals>
+                                <goal>merge</goal>
+                            </goals>
+                            <configuration>
+                                <fileSets>
+                                    <fileSet>
+                                        <directory>${project.build.directory}</directory>
+                                        <include>jacoco.exec</include>
+                                        <include>jacoco-it.exec</include>
+                                    </fileSet>
+                                </fileSets>
+                                <destFile>${project.build.directory}/jacoco-merge.exec</destFile>
+                            </configuration>
+                        </execution>
+                        <execution>
+                            <id>default-report-merge</id>
+                            <goals>
+                                <goal>report-integration</goal>
+                            </goals>
+                            <configuration>
+                                <dataFile>${project.build.directory}/jacoco-merge.exec</dataFile>
+                                <outputDirectory>${project.reporting.outputDirectory}/jacoco-merge</outputDirectory>
+                                <title>Jacoco Merge ${project.name}</title>
+                            </configuration>
+                        </execution>
+
+                        <execution>
+                            <id>default-check</id>
+                            <goals>
+                                <goal>check</goal>
+                            </goals>
+                            <configuration>
+                                <dataFile>${project.build.directory}/jacoco-merge.exec</dataFile>
+                                <excludes>
+                                    <!--<exclude>au/gov/qld/something/**/*.class</exclude>-->
+                                </excludes>
+                                <rules>
+                                    <rule implementation="org.jacoco.maven.RuleConfiguration">
+                                        <element>CLASS</element>
+                                        <limits>
+                                            <limit implementation="org.jacoco.report.check.Limit">
+                                                <counter>BRANCH</counter>
+                                                <value>COVEREDRATIO</value>
+                                                <minimum>0.0</minimum><!-- FIXME! -->
+                                            </limit>
+                                            <limit implementation="org.jacoco.report.check.Limit">
+                                                <counter>INSTRUCTION</counter>
+                                                <value>COVEREDRATIO</value>
+                                                <minimum>0.0</minimum><!-- FIXME! -->
+                                            </limit>
+                                        </limits>
+                                    </rule>
+                                    <rule implementation="org.jacoco.maven.RuleConfiguration">
+                                        <element>BUNDLE</element>
+                                        <limits>
+                                            <limit implementation="org.jacoco.report.check.Limit">
+                                                <counter>INSTRUCTION</counter>
+                                                <value>COVEREDRATIO</value>
+                                                <minimum>0.0</minimum><!-- FIXME! -->
+                                            </limit>
+                                        </limits>
+                                    </rule>
+                                </rules>
+                            </configuration>
+                        </execution>
+                    </executions>
+                </plugin>
+
+                <plugin>
+                    <artifactId>maven-checkstyle-plugin</artifactId>
+                    <version>${checkstyle.version}</version>
+                    <dependencies>
+                        <dependency>
+                            <groupId>com.puppycrawl.tools</groupId>
+                            <artifactId>checkstyle</artifactId>
+                            <version>10.17.0</version>
+                        </dependency>
+                    </dependencies>
+                    <configuration>
+                        <includeTestSourceDirectory>true</includeTestSourceDirectory>
+                        <configLocation>${qa.directory}/checkstyle_rules.xml</configLocation>
+                        <propertyExpansion>qa.directory=${qa.directory}</propertyExpansion>
+                        <excludes>
+                            node_modules,src/main/webapp/WEB-INF/eligibility-checklist/node_modules,src/main/webapp/WEB-INF/eligibility-checklist/dist.tar.gz
+                        </excludes>
+
+                    </configuration>
+                    <executions>
+                        <execution>
+                            <phase>test-compile</phase> <!-- too late at prepare-package -->
+                            <goals>
+                                <!--<goal>checkstyle</goal> --><!-- can be checkstyle to not fail the build-->
+                                <goal>check</goal>
+                            </goals>
+                        </execution>
+                    </executions>
+                </plugin>
+
+                <plugin>
+                    <artifactId>maven-pmd-plugin</artifactId>
+                    <version>${maven-pmd-plugin.version}</version>
+                    <dependencies>
+                        <dependency>
+                            <groupId>net.sourceforge.pmd</groupId>
+                            <artifactId>pmd-core</artifactId>
+                            <version>${pmd.version}</version>
+                        </dependency>
+                        <dependency>
+                            <groupId>net.sourceforge.pmd</groupId>
+                            <artifactId>pmd-java</artifactId>
+                            <version>${pmd.version}</version>
+                        </dependency>
+                    </dependencies>
+                    <configuration>
+                        <includeTests>false</includeTests>
+                        <rulesets>
+                            <!--<ruleset>/rulesets/java/basic.xml</ruleset>-->
+                            <ruleset>${qa.directory}/pmd-rules.xml</ruleset>
+                        </rulesets>
+                        <excludeRoots>
+                            <excludeRoot>${project.basedir}/target/generated-sources</excludeRoot>
+                        </excludeRoots>
+                        <printFailingErrors>true</printFailingErrors>
+                    </configuration>
+                    <executions>
+                        <execution>
+                            <phase>validate</phase> <!-- too late at prepare-package -->
+                            <goals>
+                                <goal>check</goal>
+                            </goals>
+                        </execution>
+                    </executions>
+                </plugin>
+
+                <plugin>
+                    <groupId>com.github.spotbugs</groupId>
+                    <artifactId>spotbugs-maven-plugin</artifactId>
+                    <version>${spotbugs-maven-plugin.version}</version>
+                    <configuration>
+                        <excludeFilterFile>${qa.directory}/findbugs-exclude.xml</excludeFilterFile>
+                        <effort>Max</effort>
+                        <threshold>High</threshold>
+                        <includeTests>true</includeTests>
+                        <plugins>
+                            <plugin>
+                                <groupId>com.h3xstream.findsecbugs</groupId>
+                                <artifactId>findsecbugs-plugin</artifactId>
+                                <version>${findsecbugs-plugin.version}</version>
+                            </plugin>
+                            <plugin>
+                                <groupId>com.mebigfatguy.sb-contrib</groupId>
+                                <artifactId>sb-contrib</artifactId>
+                                <version>${sb-contrib.version}</version>
+                            </plugin>
+                        </plugins>
+                    </configuration>
+                    <executions>
+                        <execution>
+                            <phase>test-compile</phase> <!-- too late at prepare-package -->
+                            <goals>
+                                <!--<goal>findbugs</goal>--> <!--can be findbugs to not fail the build-->
+                                <goal>check</goal>
+                            </goals>
+                        </execution>
+                    </executions>
+                </plugin>
+
+                <plugin>
+                    <groupId>org.owasp</groupId>
+                    <artifactId>dependency-check-maven</artifactId>
+                    <version>${owasp.dependency-check-maven.version}</version>
+                    <configuration>
+                        <suppressionFile>${qa.directory}/owasp-dependency-checker-suppressions.xml</suppressionFile>
+                        <failBuildOnCVSS>2</failBuildOnCVSS>
+                        <skip>${dependency.skip}</skip>
+                        <nvdApiKey>${env.NVD_NIST_APIKEY}</nvdApiKey>
+                        <bundleAuditAnalyzerEnabled>false</bundleAuditAnalyzerEnabled>
+                    </configuration>
+                    <executions>
+                        <execution>
+                            <!--<phase>validate</phase>--> <!-- too late at prepare-package -->
+                            <goals>
+                                <goal>check</goal>
+                            </goals>
+                        </execution>
+                    </executions>
+                </plugin>
+            </plugins>
+        </pluginManagement>
+    </build>
     <profiles>
         <profile>
             <id>github</id>