X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=pom.xml;h=d9aeb55b2544352a8cd59d5b323d7164933320fd;hb=cea5c305eed3eb466ed46ee4d3e16729c7c828b1;hp=1cf8e7f6801be70336389d73eff999fc54ea2aa7;hpb=3252202a1444ae98df477b6964aa8b09666a828c;p=dmaap%2Fdbcapi.git

diff --git a/pom.xml b/pom.xml
index 1cf8e7f..d9aeb55 100644
--- a/pom.xml
+++ b/pom.xml
@@ -152,6 +152,36 @@
 		  </dependencies>
 		</plugin>
 
+		<!-- prevent SNAPSHOT dependencies -->
+		<plugin>
+			<groupId>org.apache.maven.plugins</groupId>
+			<artifactId>maven-enforcer-plugin</artifactId>
+			<executions>
+				<execution>
+					<id>enforce-no-snapshots</id>
+					<goals>
+						<goal>enforce</goal>
+					</goals>
+					<configuration>
+						<rules>
+							<requireReleaseDeps>
+								<message>No Snapshots Allowed!</message>
+								<excludes>
+									<exclude>org.onap.aaf.authz:aaf-cadi-client</exclude>
+									<exclude>org.onap.aaf.authz:aaf-misc-env</exclude>
+									<exclude>org.onap.aaf.authz:aaf-cadi-aaf</exclude>
+									<exclude>org.onap.aaf.authz:aaf-auth-client</exclude>
+									<exclude>org.onap.aaf.authz:aaf-cadi-core</exclude>
+									<exclude>org.onap.aaf.authz:aaf-misc-rosetta</exclude>
+								</excludes>
+							</requireReleaseDeps>
+						</rules>
+						<fail>true</fail>
+					</configuration>
+				</execution>
+			</executions>
+		</plugin>
+
 		</plugins>
 		<pluginManagement>
 			<plugins>
@@ -207,15 +237,6 @@
 			<artifactId>jackson-annotations</artifactId>
 			<version>${jackson.version}</version>
 		</dependency>
-		<dependency>
-			<groupId>com.fasterxml.jackson.core</groupId>
-			<artifactId>jackson-databind</artifactId>
-<!-- for DMAAP-205, a point release on the common version
-	 addresses a security issue.  Note the add notation here
-			<version>${jackson.version}.1</version>
-  -->
-			<version>${jackson.version}</version>
-		</dependency>
 		<dependency>
 			<groupId>com.fasterxml.jackson.dataformat</groupId>
 			<artifactId>jackson-dataformat-yaml</artifactId>
@@ -232,16 +253,19 @@
 			<version>1.2.0</version>
 		</dependency>
 <!-- DMAAP-656:
-   - removed this dependency because it utilized a third party
-   - lib called com.google.guava:20.0 which had severe threat identified.
-   - build code without this dependency and it seemed to work, so perhaps it
-   - is not needed?
+   - override this dependency because it utilized a third party
+   - lib called com.google.guava:20.0 which had severe security threat identified.
+ -->
+		<dependency>
+			<groupId>com.google.guava</groupId>
+			<artifactId>guava</artifactId>
+			<version>24.1.1-jre</version>
+		</dependency>
 		<dependency>
 			<groupId>io.swagger</groupId>
 			<artifactId>swagger-core</artifactId>
 			<version>${swagger.version}</version>
 		</dependency>
- -->
 		<dependency>
 			<groupId>io.swagger</groupId>
 			<artifactId>swagger-jersey2-jaxrs</artifactId>