Create new 'dependency-versions' pom module

- To be used as parent for all other poms, to ensure that the
  same versions of dependencies are used everywhere.

7 files changed, 140 insertions, 88 deletions

diff --git a/bootstrap.sh b/bootstrap.sh
index 0108999b1c6..e0dbfd33133 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -63,6 +63,10 @@ $top/dist/getversionmap.sh $top > $top/dist/vtag.map
 # must install parent poms first:
 echo "Downloading all dependencies. This may take a few minutes with an empty Maven cache."
 (
+  cd dependency-versions
+  mvn_install
+)
+(
   cd container-dependency-versions
   mvn_install
 )
diff --git a/container-dependency-versions/pom.xml b/container-dependency-versions/pom.xml
index 0e210a54d87..be60cbedbf4 100644
--- a/container-dependency-versions/pom.xml
+++ b/container-dependency-versions/pom.xml
@@ -2,7 +2,6 @@
 <!-- Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <modelVersion>4.0.0</modelVersion>
-    <groupId>com.yahoo.vespa</groupId>
     <artifactId>container-dependency-versions</artifactId>
     <packaging>pom</packaging>
     <version>8-SNAPSHOT</version>
@@ -10,6 +9,13 @@
     <description>Versions for all 3rd party dependencies provided from the Vespa container.</description>
     <url>https://github.com/vespa-engine</url>
 
+    <parent>
+        <groupId>com.yahoo.vespa</groupId>
+        <artifactId>dependency-versions</artifactId>
+        <version>8-SNAPSHOT</version>
+        <relativePath>../dependency-versions/pom.xml</relativePath>
+    </parent>
+
     <licenses>
         <license>
             <name>The Apache License, Version 2.0</name>
@@ -238,22 +244,4 @@
         </profile>
     </profiles>
 
-    <properties>
-        <aopalliance.version>1.0</aopalliance.version>
-        <error-prone-annotations.version>2.18.0</error-prone-annotations.version>
-        <guava.version>32.1.1-jre</guava.version>
-        <guice.version>4.2.3</guice.version>
-        <jackson2.version>2.15.2</jackson2.version>
-        <jackson-databind.version>2.15.2</jackson-databind.version>
-        <javax.inject.version>1</javax.inject.version>
-        <javax.servlet-api.version>3.1.0</javax.servlet-api.version>
-        <javax.ws.rs-api.version>2.0.1</javax.ws.rs-api.version>
-        <jaxb.version>2.3.0</jaxb.version>
-        <slf4j.version>1.7.32</slf4j.version> <!-- WARNING: when updated, also update c.y.v.tenant:base pom -->
-        <xml-apis.version>1.4.01</xml-apis.version>
-
-        <!-- Not a dependency. Only included to allow the versions-maven-plugin to check for updates of itself  -->
-        <versions-maven-plugin.version>2.8.1</versions-maven-plugin.version>
-    </properties>
-
 </project>
diff --git a/dependency-versions/README.md b/dependency-versions/README.md
new file mode 100644
index 00000000000..77290899619
--- /dev/null
+++ b/dependency-versions/README.md
@@ -0,0 +1,6 @@
+<!-- Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. -->
+# Version properites for all Vespa dependencies
+
+This pom should contain all version properties for 3rd party
+dependencies used in Vespa. It should be used as parent pom for
+all Vespa modules, including user "base poms".
diff --git a/dependency-versions/pom.xml b/dependency-versions/pom.xml
new file mode 100644
index 00000000000..f7e197f37d3
--- /dev/null
+++ b/dependency-versions/pom.xml
@@ -0,0 +1,121 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. -->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>com.yahoo.vespa</groupId>
+    <artifactId>dependency-versions</artifactId>
+    <packaging>pom</packaging>
+    <version>8-SNAPSHOT</version>
+    <description>Version properties for (almost) all Vespa dependencies.</description>
+    <url>https://github.com/vespa-engine</url>
+
+    <licenses>
+        <license>
+            <name>The Apache License, Version 2.0</name>
+            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+        </license>
+    </licenses>
+    <developers>
+        <developer>
+            <name>Vespa</name>
+            <url>https://github.com/vespa-engine</url>
+        </developer>
+    </developers>
+    <scm>
+        <connection>scm:git:git@github.com:vespa-engine/vespa.git</connection>
+        <developerConnection>scm:git:git@github.com:vespa-engine/vespa.git</developerConnection>
+        <url>git@github.com:vespa-engine/vespa.git</url>
+    </scm>
+
+    <properties>
+        
+        <!-- Dependencies available from the Jdisc container, see container-dependency-versions/pom.xml -->
+        <aopalliance.version>1.0</aopalliance.version>
+        <error-prone-annotations.version>2.18.0</error-prone-annotations.version>
+        <guava.version>32.1.1-jre</guava.version>
+        <guice.version>4.2.3</guice.version>
+        <jackson2.version>2.15.2</jackson2.version>
+        <jackson-databind.version>2.15.2</jackson-databind.version>
+        <javax.inject.version>1</javax.inject.version>
+        <javax.servlet-api.version>3.1.0</javax.servlet-api.version>
+        <javax.ws.rs-api.version>2.0.1</javax.ws.rs-api.version>
+        <jaxb.version>2.3.0</jaxb.version>
+        <slf4j.version>1.7.32</slf4j.version>
+        <xml-apis.version>1.4.01</xml-apis.version>
+
+
+        <!-- Dependencies used internally in Vespa, not visible for users -->
+        <airline.version>0.9</airline.version>
+        <antlr.version>3.5.3</antlr.version>
+        <antlr4.version>4.11.1</antlr4.version>
+        <apache.httpclient.version>4.5.14</apache.httpclient.version>
+        <apache.httpcore.version>4.4.16</apache.httpcore.version>
+        <apache.httpclient5.version>5.2.1</apache.httpclient5.version> <!-- WARNING: sync cloud-tenant-base-dependencies-enforcer/pom.xml -->
+        <apache.httpcore5.version>5.2.2</apache.httpcore5.version> <!-- WARNING: sync cloud-tenant-base-dependencies-enforcer/pom.xml -->
+        <asm.version>9.3</asm.version>
+
+        <!-- Athenz dependencies. Make sure these dependencies match those in Vespa's internal repositories -->
+        <athenz.version>1.11.34</athenz.version> <!-- WARNING: sync cloud-tenant-base-dependencies-enforcer/pom.xml -->
+        <aws-sdk.version>1.12.460</aws-sdk.version>
+        <!-- Athenz END -->
+
+        <!-- WARNING: If you change curator version, you also need to update
+                 zkfacade/src/main/java/org/apache/curator/**/package-info.java
+             using something like
+                 find zkfacade/src/main/java/org/apache/curator -name package-info.java | \
+                     xargs perl -pi -e 's/major = [0-9]+, minor = [0-9]+, micro = [0-9]+/major = 5, minor = 3, micro = 0/g'
+        -->
+        <bouncycastle.version>1.74</bouncycastle.version>
+        <curator.version>5.4.0</curator.version>
+        <commons-codec.version>1.15</commons-codec.version>
+        <commons-io.version>2.11.0</commons-io.version>
+        <commons.math3.version>3.6.1</commons.math3.version>
+        <eclipse-collections.version>11.0.0</eclipse-collections.version>
+        <felix.version>7.0.5</felix.version>
+        <felix.log.version>1.0.1</felix.log.version>
+        <findbugs.version>3.0.2</findbugs.version> <!-- Should be kept in sync with guava -->
+        <hdrhistogram.version>2.1.12</hdrhistogram.version>
+        <jetty.version>11.0.15</jetty.version>
+        <jetty-servlet-api.version>5.0.2</jetty-servlet-api.version>
+        <jjwt.version>0.11.5</jjwt.version>
+        <jna.version>5.11.0</jna.version>
+        <junit.version>5.8.1</junit.version>
+        <maven-archiver.version>3.6.0</maven-archiver.version>
+        <maven-wagon.version>2.10</maven-wagon.version>
+        <mockito.version>4.0.0</mockito.version>
+        <netty.version>4.1.94.Final</netty.version>
+        <netty-tcnative.version>2.0.61.Final</netty-tcnative.version>
+        <onnxruntime.version>1.13.1</onnxruntime.version> <!-- WARNING: sync cloud-tenant-base-dependencies-enforcer/pom.xml -->
+        <org.json.version>20230227</org.json.version>
+        <org.lz4.version>1.8.0</org.lz4.version>
+        <prometheus.client.version>0.6.0</prometheus.client.version>
+        <protobuf.version>3.21.7</protobuf.version>
+        <spifly.version>1.3.6</spifly.version>
+        <surefire.version>3.0.0-M9</surefire.version>
+        <wiremock.version>2.35.0</wiremock.version>
+        <zero-allocation-hashing.version>0.16</zero-allocation-hashing.version>
+        <zookeeper.client.version>3.8.0</zookeeper.client.version>
+
+
+        <!-- Maven plugins -->
+        <maven-assembly-plugin.version>3.3.0</maven-assembly-plugin.version>
+        <maven-bundle-plugin.version>5.1.9</maven-bundle-plugin.version>
+        <maven-compiler-plugin.version>3.10.1</maven-compiler-plugin.version>
+        <maven-core.version>3.8.7</maven-core.version>
+        <maven-dependency-plugin.version>3.6.0</maven-dependency-plugin.version> <!-- NOTE: When upgrading, also update explicit versions in tenant base poms! -->
+        <maven-deploy-plugin.version>2.8.2</maven-deploy-plugin.version>
+        <maven-enforcer-plugin.version>3.3.0</maven-enforcer-plugin.version>
+        <maven-failsafe-plugin.version>3.0.0-M6</maven-failsafe-plugin.version>
+        <maven-install-plugin.version>3.1.1</maven-install-plugin.version>
+        <maven-jar-plugin.version>3.2.0</maven-jar-plugin.version>
+        <maven-javadoc-plugin.version>3.3.1</maven-javadoc-plugin.version>
+        <maven-plugin-api.version>${maven-core.version}</maven-plugin-api.version>
+        <maven-plugin-tools.version>3.6.4</maven-plugin-tools.version>
+        <maven-resources-plugin.version>3.2.0</maven-resources-plugin.version>
+        <maven-shade-plugin.version>3.4.1</maven-shade-plugin.version>
+        <maven-site-plugin.version>3.9.1</maven-site-plugin.version>
+        <maven-source-plugin.version>3.2.1</maven-source-plugin.version>
+        <versions-maven-plugin.version>2.8.1</versions-maven-plugin.version>
+    </properties>
+
+</project>
diff --git a/parent/pom.xml b/parent/pom.xml
index 8f057bcf7ae..e61161dd88a 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -1136,74 +1136,6 @@
     </dependencyManagement>
 
     <properties>
-        <airline.version>0.9</airline.version>
-        <antlr.version>3.5.3</antlr.version>
-        <antlr4.version>4.11.1</antlr4.version>
-        <apache.httpclient.version>4.5.14</apache.httpclient.version>
-        <apache.httpcore.version>4.4.16</apache.httpcore.version>
-        <apache.httpclient5.version>5.2.1</apache.httpclient5.version> <!-- WARNING: sync cloud-tenant-base-dependencies-enforcer/pom.xml -->
-        <apache.httpcore5.version>5.2.2</apache.httpcore5.version> <!-- WARNING: sync cloud-tenant-base-dependencies-enforcer/pom.xml -->
-        <asm.version>9.3</asm.version>
-
-        <!-- Athenz dependencies. Make sure these dependencies match those in Vespa's internal repositories -->
-        <athenz.version>1.11.34</athenz.version> <!-- WARNING: sync cloud-tenant-base-dependencies-enforcer/pom.xml -->
-        <aws-sdk.version>1.12.460</aws-sdk.version>
-        <!-- Athenz END -->
-
-        <!-- WARNING: If you change curator version, you also need to update
-                 zkfacade/src/main/java/org/apache/curator/**/package-info.java
-             using something like
-                 find zkfacade/src/main/java/org/apache/curator -name package-info.java | \
-                     xargs perl -pi -e 's/major = [0-9]+, minor = [0-9]+, micro = [0-9]+/major = 5, minor = 3, micro = 0/g'
-        -->
-        <bouncycastle.version>1.74</bouncycastle.version>
-        <curator.version>5.4.0</curator.version>
-        <commons-codec.version>1.15</commons-codec.version>
-        <commons-io.version>2.11.0</commons-io.version>
-        <commons.math3.version>3.6.1</commons.math3.version>
-        <eclipse-collections.version>11.0.0</eclipse-collections.version>
-        <felix.version>7.0.5</felix.version>
-        <felix.log.version>1.0.1</felix.log.version>
-        <findbugs.version>3.0.2</findbugs.version> <!-- Should be kept in sync with guava -->
-        <hdrhistogram.version>2.1.12</hdrhistogram.version>
-        <jetty.version>11.0.15</jetty.version>
-        <jetty-servlet-api.version>5.0.2</jetty-servlet-api.version>
-        <jjwt.version>0.11.5</jjwt.version>
-        <jna.version>5.11.0</jna.version>
-        <junit.version>5.8.1</junit.version>
-        <maven-archiver.version>3.6.0</maven-archiver.version>
-        <maven-assembly-plugin.version>3.3.0</maven-assembly-plugin.version>
-        <maven-bundle-plugin.version>5.1.9</maven-bundle-plugin.version>
-        <maven-compiler-plugin.version>3.10.1</maven-compiler-plugin.version>
-        <maven-core.version>3.8.7</maven-core.version>
-        <maven-dependency-plugin.version>3.6.0</maven-dependency-plugin.version> <!-- NOTE: When upgrading, also update explicit versions in tenant base poms! -->
-        <maven-deploy-plugin.version>2.8.2</maven-deploy-plugin.version>
-        <maven-enforcer-plugin.version>3.3.0</maven-enforcer-plugin.version>
-        <maven-failsafe-plugin.version>3.0.0-M6</maven-failsafe-plugin.version>
-        <maven-install-plugin.version>3.1.1</maven-install-plugin.version>
-        <maven-jar-plugin.version>3.2.0</maven-jar-plugin.version>
-        <maven-javadoc-plugin.version>3.3.1</maven-javadoc-plugin.version>
-        <maven-plugin-api.version>${maven-core.version}</maven-plugin-api.version>
-        <maven-plugin-tools.version>3.6.4</maven-plugin-tools.version>
-        <maven-resources-plugin.version>3.2.0</maven-resources-plugin.version>
-        <maven-shade-plugin.version>3.4.1</maven-shade-plugin.version>
-        <maven-site-plugin.version>3.9.1</maven-site-plugin.version>
-        <maven-source-plugin.version>3.2.1</maven-source-plugin.version>
-        <maven-wagon.version>2.10</maven-wagon.version>
-        <mockito.version>4.0.0</mockito.version>
-        <netty.version>4.1.94.Final</netty.version>
-        <netty-tcnative.version>2.0.61.Final</netty-tcnative.version>
-        <onnxruntime.version>1.13.1</onnxruntime.version> <!-- WARNING: sync cloud-tenant-base-dependencies-enforcer/pom.xml -->
-        <org.json.version>20230227</org.json.version>
-        <org.lz4.version>1.8.0</org.lz4.version>
-        <prometheus.client.version>0.6.0</prometheus.client.version>
-        <protobuf.version>3.21.7</protobuf.version>
-        <spifly.version>1.3.6</spifly.version>
-        <surefire.version>3.0.0-M9</surefire.version>
-        <wiremock.version>2.35.0</wiremock.version>
-        <zero-allocation-hashing.version>0.16</zero-allocation-hashing.version>
-        <zookeeper.client.version>3.8.0</zookeeper.client.version>
-
         <doclint>all</doclint>
         <test.hide>true</test.hide>
 
diff --git a/pom.xml b/pom.xml
index 7e54b97383e..ba25de063f1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -66,6 +66,7 @@
         <module>controller-api</module>
         <module>controller-server</module>
         <module>defaults</module>
+        <module>dependency-versions</module>
         <module>docproc</module>
         <module>docprocs</module>
         <module>document</module>
diff --git a/screwdriver/release-java-artifacts.sh b/screwdriver/release-java-artifacts.sh
index 8cf61dfc839..bdfb7131227 100755
--- a/screwdriver/release-java-artifacts.sh
+++ b/screwdriver/release-java-artifacts.sh
@@ -61,6 +61,7 @@ export FACTORY_VESPA_VERSION=$VESPA_RELEASE
 
 COMMON_MAVEN_OPTS="$VESPA_MAVEN_EXTRA_OPTS --no-snapshot-updates --settings $(pwd)/screwdriver/settings-publish.xml --activate-profiles ossrh-deploy-vespa -DskipTests"
 TMPFILE=$(mktemp)
+mvn $COMMON_MAVEN_OPTS  -pl :dependency-versions -DskipStagingRepositoryClose=true deploy 2>&1 | tee $TMPFILE
 mvn $COMMON_MAVEN_OPTS  -pl :container-dependency-versions -DskipStagingRepositoryClose=true deploy 2>&1 | tee $TMPFILE
 
 # Find the stage repo name
@@ -81,4 +82,3 @@ mvn $COMMON_MAVEN_OPTS -N org.sonatype.plugins:nexus-staging-maven-plugin:1.6.12
 
 # Delete the GPG rings
 rm -rf $SD_SOURCE_DIR/screwdriver/deploy
-