From 7035dafb3fb45105a76a92df0a54be9dab8f5de9 Mon Sep 17 00:00:00 2001
From: James Nord <jnord+github@cloudbees.com>
Date: Fri, 9 Aug 2019 10:08:39 +0100
Subject: [PATCH 1/5] introduce a BOM for Jenkins dependencies that can be
 consumed by plugins

---
 cli/pom.xml      |  12 +++++
 core/pom.xml     |  14 +++++-
 pom.xml          | 113 +++--------------------------------------------
 test-pom/pom.xml |   7 +++
 war/pom.xml      |  12 +++++
 5 files changed, 50 insertions(+), 108 deletions(-)

diff --git a/cli/pom.xml b/cli/pom.xml
index 5d3738bd42..3f98578ed5 100644
--- a/cli/pom.xml
+++ b/cli/pom.xml
@@ -18,6 +18,18 @@
     <findbugs.threshold>Medium</findbugs.threshold>
   </properties>
 
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.jenkins-ci.main</groupId>
+        <artifactId>jenkins-bom</artifactId>
+        <version>${project.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
     <dependency>
       <groupId>org.powermock</groupId>
diff --git a/core/pom.xml b/core/pom.xml
index 41c58c486f..dcec9cb898 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -44,6 +44,19 @@ THE SOFTWARE.
     <groovy.version>2.4.12</groovy.version>
   </properties>
 
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.jenkins-ci.main</groupId>
+        <artifactId>jenkins-bom</artifactId>
+        <version>${project.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
+
   <dependencies>
     <dependency>
       <groupId>org.jenkins-ci.plugins.icon-shim</groupId>
@@ -53,7 +66,6 @@ THE SOFTWARE.
     <dependency>
       <groupId>${project.groupId}</groupId>
       <artifactId>remoting</artifactId>
-      <!-- specified in the parent -->
     </dependency>
     <dependency>
       <groupId>${project.groupId}</groupId>
diff --git a/pom.xml b/pom.xml
index f5b1d423ec..9568766d1d 100755
--- a/pom.xml
+++ b/pom.xml
@@ -49,6 +49,7 @@ THE SOFTWARE.
   </licenses>
 
   <modules>
+    <module>bom</module>
     <module>core</module>
     <module>war</module>
     <module>test-pom</module>
@@ -90,17 +91,11 @@ THE SOFTWARE.
     <project.patchManagement.url>https://api.github.com</project.patchManagement.url>
     <patch.tracker.serverId>jenkins-jira</patch.tracker.serverId>
 
-    <guavaVersion>11.0.1</guavaVersion>
-    <slf4jVersion>1.7.26</slf4jVersion>
     <maven-plugin.version>2.14</maven-plugin.version>
     <matrix-auth.version>2.3</matrix-auth.version>
     <matrix-project.version>1.14</matrix-project.version>
     <sorcerer.version>0.11</sorcerer.version>
     <animal.sniffer.skip>${skipTests}</animal.sniffer.skip>
-    <access-modifier.version>1.14</access-modifier.version>
-    <access-modifier-annotation.version>${access-modifier.version}</access-modifier-annotation.version> <!-- differing only where needed for timestamped snapshots -->
-    <access-modifier-checker.version>${access-modifier.version}</access-modifier-checker.version>
-
     <java.level>8</java.level>
 
     <changelog.url>https://jenkins.io/changelog</changelog.url>
@@ -116,6 +111,10 @@ THE SOFTWARE.
     <findbugs.effort>Max</findbugs.effort>
     <findbugs.threshold>High</findbugs.threshold>
     <findbugs.excludeFilterFile>${project.basedir}/../src/findbugs/findbugs-excludes.xml</findbugs.excludeFilterFile>
+
+    <!-- XXX keep these in sync -->
+    <access-modifier-annotation.version>1.14</access-modifier-annotation.version>
+    <access-modifier-checker.version>1.14</access-modifier-checker.version>
   </properties>
 
   <!-- Note that the 'repositories' and 'pluginRepositories' blocks below are actually copy-pasted
@@ -137,24 +136,8 @@ THE SOFTWARE.
   </pluginRepositories>
 
   <dependencyManagement>
+    <!-- any dependecies that can be used by plugins must be defined in the bom and not here -->
     <dependencies>
-      <dependency>
-        <groupId>org.apache.ant</groupId>
-        <artifactId>ant</artifactId>
-        <version>1.9.14</version>
-      </dependency>
-
-      <dependency>
-        <groupId>commons-io</groupId>
-        <artifactId>commons-io</artifactId>
-        <version>2.6</version>
-      </dependency>
-
-      <dependency>
-        <groupId>commons-lang</groupId>
-        <artifactId>commons-lang</artifactId>
-        <version>2.6</version>
-      </dependency>
 
       <dependency>
         <groupId>org.mockito</groupId>
@@ -178,78 +161,6 @@ THE SOFTWARE.
         <version>2.6</version>
       </dependency>
 
-      <dependency>
-        <groupId>commons-httpclient</groupId>
-        <artifactId>commons-httpclient</artifactId>
-        <version>3.1-jenkins-1</version>
-      </dependency>
-
-      <dependency>
-        <groupId>org.jenkins-ci.main</groupId>
-        <artifactId>remoting</artifactId>
-        <version>${remoting.version}</version>
-      </dependency>
-
-      <dependency>
-        <groupId>com.google.guava</groupId>
-        <artifactId>guava</artifactId>
-        <version>${guavaVersion}</version>
-      </dependency>
-      <dependency>
-        <groupId>com.google.guava</groupId>
-        <artifactId>guava-testlib</artifactId>
-        <version>${guavaVersion}</version>
-      </dependency>
-
-      <dependency>
-        <groupId>com.google.inject</groupId>
-        <artifactId>guice</artifactId>
-        <version>4.0</version>
-      </dependency>
-
-      <!-- SLF4J used in maven-plugin and core -->
-      <dependency>
-        <groupId>org.slf4j</groupId>
-        <artifactId>slf4j-api</artifactId>
-        <version>${slf4jVersion}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.slf4j</groupId>
-        <artifactId>slf4j-jdk14</artifactId>
-        <version>${slf4jVersion}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.slf4j</groupId>
-        <artifactId>jcl-over-slf4j</artifactId>
-        <version>${slf4jVersion}</version>
-      </dependency>
-      <dependency>
-        <groupId>commons-logging</groupId>
-        <artifactId>commons-logging</artifactId>
-        <version>1.2</version>
-        <scope>provided</scope><!-- by jcl-over-slf4j -->
-      </dependency>
-      <dependency>
-        <groupId>org.slf4j</groupId>
-        <artifactId>log4j-over-slf4j</artifactId>
-        <version>${slf4jVersion}</version>
-      </dependency>
-      <dependency>
-        <groupId>log4j</groupId>
-        <artifactId>log4j</artifactId>
-        <version>1.2.17</version>
-        <scope>provided</scope><!-- by log4j-over-slf4j -->
-      </dependency>
-      <dependency>
-        <groupId>org.samba.jcifs</groupId>
-        <artifactId>jcifs</artifactId>
-        <version>1.3.17-kohsuke-1</version>
-      </dependency>
-      <dependency>
-        <groupId>org.kohsuke</groupId>
-        <artifactId>access-modifier-annotation</artifactId>
-        <version>${access-modifier-annotation.version}</version>
-      </dependency>
       <dependency>
         <!--  make sure these old servlet versions are never used by us or by any plugins which end up depending on this version -->
         <!--  plugin-pom tries to fudge servlet support to be compatible with cores < 2.0 and JTH which needs 3.x for jetty, and ends up causing issues with some IDEs -->
@@ -268,18 +179,6 @@ THE SOFTWARE.
         <scope>provided</scope>
         <optional>true</optional>
       </dependency>
-      <!--  TODO also add commons-logging and log4j -->
-      <dependency>
-        <groupId>commons-codec</groupId>
-        <artifactId>commons-codec</artifactId>
-        <version>1.12</version>
-      </dependency>
-
-      <dependency>
-        <groupId>org.jenkins-ci</groupId>
-        <artifactId>annotation-indexer</artifactId>
-        <version>1.12</version>
-      </dependency>
     </dependencies>
   </dependencyManagement>
 
diff --git a/test-pom/pom.xml b/test-pom/pom.xml
index e082082283..8d967e897f 100644
--- a/test-pom/pom.xml
+++ b/test-pom/pom.xml
@@ -45,6 +45,13 @@ THE SOFTWARE.
 
   <dependencyManagement>
     <dependencies>
+      <dependency>
+        <groupId>org.jenkins-ci.main</groupId>
+        <artifactId>jenkins-bom</artifactId>
+        <version>${project.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>com.google.code.findbugs</groupId>
         <artifactId>annotations</artifactId>
diff --git a/war/pom.xml b/war/pom.xml
index 4ffd2b7678..342cb78e75 100644
--- a/war/pom.xml
+++ b/war/pom.xml
@@ -45,6 +45,18 @@ THE SOFTWARE.
     <yarn.version>0.24.5</yarn.version>
   </properties>
 
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.jenkins-ci.main</groupId>
+        <artifactId>jenkins-bom</artifactId>
+        <version>${project.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
     <dependency>
       <groupId>org.jenkins-ci</groupId>

From 9f5479e050a606d1c0e043d96772385700f5aee6 Mon Sep 17 00:00:00 2001
From: James Nord <jnord+github@cloudbees.com>
Date: Thu, 22 Aug 2019 16:06:11 +0100
Subject: [PATCH 2/5] [JENKINS-48578] Forgot to add the bom POM

---
 bom/pom.xml | 200 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 200 insertions(+)
 create mode 100644 bom/pom.xml

diff --git a/bom/pom.xml b/bom/pom.xml
new file mode 100644
index 0000000000..5de370d380
--- /dev/null
+++ b/bom/pom.xml
@@ -0,0 +1,200 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+The MIT License
+
+Copyright (c) 2019, CloudBees, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <parent>
+    <groupId>org.jenkins-ci.main</groupId>
+    <artifactId>jenkins-parent</artifactId>
+    <version>${revision}${changelist}</version>
+  </parent>
+
+  <groupId>org.jenkins-ci.main</groupId>
+  <artifactId>jenkins-bom</artifactId>
+  <version>${revision}${changelist}</version>
+  <packaging>pom</packaging>
+
+  <name>Jenkins BOM</name>
+  <description>The module contains dependencies that are used by a specific Jenkins version</description>
+
+
+  <properties>
+    <guavaVersion>11.0.1</guavaVersion>
+    <slf4jVersion>1.7.26</slf4jVersion>
+  </properties>
+
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.apache.ant</groupId>
+        <artifactId>ant</artifactId>
+        <version>1.9.14</version>
+      </dependency>
+
+      <dependency>
+        <groupId>commons-io</groupId>
+        <artifactId>commons-io</artifactId>
+        <version>2.6</version>
+      </dependency>
+
+      <dependency>
+        <groupId>commons-lang</groupId>
+        <artifactId>commons-lang</artifactId>
+        <version>2.6</version>
+      </dependency>
+
+      <dependency>
+        <groupId>commons-httpclient</groupId>
+        <artifactId>commons-httpclient</artifactId>
+        <version>3.1-jenkins-1</version>
+      </dependency>
+
+      <dependency>
+        <groupId>org.jenkins-ci.main</groupId>
+        <artifactId>remoting</artifactId>
+        <version>${remoting.version}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${guavaVersion}</version>
+      </dependency>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava-testlib</artifactId>
+        <version>${guavaVersion}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>com.google.inject</groupId>
+        <artifactId>guice</artifactId>
+        <version>4.0</version>
+      </dependency>
+
+      <!-- SLF4J used in maven-plugin and core -->
+      <dependency>
+        <groupId>org.slf4j</groupId>
+        <artifactId>slf4j-api</artifactId>
+        <version>${slf4jVersion}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.slf4j</groupId>
+        <artifactId>slf4j-jdk14</artifactId>
+        <version>${slf4jVersion}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.slf4j</groupId>
+        <artifactId>jcl-over-slf4j</artifactId>
+        <version>${slf4jVersion}</version>
+      </dependency>
+      <dependency>
+        <groupId>commons-logging</groupId>
+        <artifactId>commons-logging</artifactId>
+        <version>1.2</version>
+        <scope>provided</scope><!-- by jcl-over-slf4j -->
+      </dependency>
+      <dependency>
+        <groupId>org.slf4j</groupId>
+        <artifactId>log4j-over-slf4j</artifactId>
+        <version>${slf4jVersion}</version>
+      </dependency>
+      <dependency>
+        <groupId>log4j</groupId>
+        <artifactId>log4j</artifactId>
+        <version>1.2.17</version>
+        <scope>provided</scope><!-- by log4j-over-slf4j -->
+      </dependency>
+      <dependency>
+        <groupId>org.samba.jcifs</groupId>
+        <artifactId>jcifs</artifactId>
+        <version>1.3.17-kohsuke-1</version>
+      </dependency>
+      <dependency>
+        <groupId>org.kohsuke</groupId>
+        <artifactId>access-modifier-annotation</artifactId>
+        <version>${access-modifier-annotation.version}</version>
+      </dependency>
+      <dependency>
+        <!--  make sure these old servlet versions are never used by us or by any plugins which end up depending on this version -->
+        <!--  plugin-pom tries to fudge servlet support to be compatible with cores < 2.0 and JTH which needs 3.x for jetty, and ends up causing issues with some IDEs -->
+        <groupId>javax.servlet</groupId>
+        <!-- the old artifactID for the servlet API -->
+        <artifactId>servlet-api</artifactId>
+        <version>[0]</version>
+        <!-- 
+              "[0]" is a range that must be exaclty 0
+              this is different to "0" which is hint to use version 0.
+              therefore unless anyone else uses ranges (they should not) this version will always win
+              We have deployed a version 0 to jenkins repo which has an empty jar
+              This prevents conflicts between the old Servet API and the new Servlet API as the groupIDs have changed
+              see https://github.com/jenkinsci/jenkins/pull/3033/files#r141325857 for a fuller description
+        -->
+        <scope>provided</scope>
+        <optional>true</optional>
+      </dependency>
+
+      <dependency>
+        <groupId>commons-codec</groupId>
+        <artifactId>commons-codec</artifactId>
+        <version>1.12</version>
+      </dependency>
+
+      <dependency>
+        <groupId>org.jenkins-ci</groupId>
+        <artifactId>annotation-indexer</artifactId>
+        <version>1.12</version>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
+  <build>
+    <plugins>
+      <!-- override the default to keep the dependencyManagement intact -->
+      <plugin>
+        <groupId>org.codehaus.mojo</groupId>
+        <artifactId>flatten-maven-plugin</artifactId>
+        <configuration>
+          <updatePomFile>true</updatePomFile>
+          <outputDirectory>${project.build.directory}</outputDirectory>
+          <flattenedPomFilename>${project.artifactId}-${project.version}.pom</flattenedPomFilename>
+        </configuration>
+        <executions>
+          <execution>
+            <id>flatten</id>
+            <phase>process-resources</phase>
+            <goals>
+              <goal>flatten</goal>
+            </goals>
+            <configuration>
+              <flattenMode>bom</flattenMode>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+
+</project>

From 8cbbdb7407fa7612d3b1d44308a1e27a88e6eca3 Mon Sep 17 00:00:00 2001
From: Mark Wynn-Mackenzie <mwynnmackenzie@cloudbees.com>
Date: Fri, 23 Aug 2019 14:24:11 +0100
Subject: [PATCH 3/5] Centralise some more dependencies from plugin-pom.

---
 bom/pom.xml | 45 +++++++++++++++++++++++++++++++++++++++------
 1 file changed, 39 insertions(+), 6 deletions(-)

diff --git a/bom/pom.xml b/bom/pom.xml
index 5de370d380..6dfcb02e38 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -47,36 +47,70 @@ THE SOFTWARE.
 
   <dependencyManagement>
     <dependencies>
+      <dependency>
+        <groupId>com.github.spotbugs</groupId>
+        <artifactId>spotbugs-annotations</artifactId>
+        <version>3.1.11</version>
+      </dependency>
+      <dependency>
+        <groupId>net.jcip</groupId>
+        <artifactId>jcip-annotations</artifactId>
+        <version>1.0</version>
+      </dependency>
+      <dependency>
+        <groupId>junit</groupId>
+        <artifactId>junit</artifactId>
+        <version>4.12</version>
+      </dependency>
+      <!--
+        Recommended versions of Mockito and PowerMock for build with Java 11 (JENKINS-55098)
+        The versions require Java 8 as a minimum baseline, but they can be downgraded in plugins if needed.
+      -->
+      <dependency>
+        <groupId>org.mockito</groupId>
+        <artifactId>mockito-core</artifactId>
+        <version>2.28.2</version>
+      </dependency>
+      <dependency>
+        <groupId>org.powermock</groupId>
+        <artifactId>powermock-module-junit4</artifactId>
+        <version>2.0.2</version>
+      </dependency>
+      <dependency>
+        <groupId>org.powermock</groupId>
+        <artifactId>powermock-api-mockito2</artifactId>
+        <version>2.0.2</version>
+      </dependency>
+      <dependency>
+        <groupId>org.objenesis</groupId>
+        <artifactId>objenesis</artifactId>
+        <version>3.0.1</version>
+      </dependency>
       <dependency>
         <groupId>org.apache.ant</groupId>
         <artifactId>ant</artifactId>
         <version>1.9.14</version>
       </dependency>
-
       <dependency>
         <groupId>commons-io</groupId>
         <artifactId>commons-io</artifactId>
         <version>2.6</version>
       </dependency>
-
       <dependency>
         <groupId>commons-lang</groupId>
         <artifactId>commons-lang</artifactId>
         <version>2.6</version>
       </dependency>
-
       <dependency>
         <groupId>commons-httpclient</groupId>
         <artifactId>commons-httpclient</artifactId>
         <version>3.1-jenkins-1</version>
       </dependency>
-
       <dependency>
         <groupId>org.jenkins-ci.main</groupId>
         <artifactId>remoting</artifactId>
         <version>${remoting.version}</version>
       </dependency>
-
       <dependency>
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>
@@ -87,7 +121,6 @@ THE SOFTWARE.
         <artifactId>guava-testlib</artifactId>
         <version>${guavaVersion}</version>
       </dependency>
-
       <dependency>
         <groupId>com.google.inject</groupId>
         <artifactId>guice</artifactId>

From 1738eb2c3815937314cac9bfc25826ed6edf0b9b Mon Sep 17 00:00:00 2001
From: Mark Wynn-Mackenzie <mwynnmackenzie@cloudbees.com>
Date: Mon, 2 Sep 2019 17:34:35 +0100
Subject: [PATCH 4/5] Remove test dependencies from bom.

---
 bom/pom.xml | 29 -----------------------------
 1 file changed, 29 deletions(-)

diff --git a/bom/pom.xml b/bom/pom.xml
index 6dfcb02e38..690632fbc2 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -57,35 +57,6 @@ THE SOFTWARE.
         <artifactId>jcip-annotations</artifactId>
         <version>1.0</version>
       </dependency>
-      <dependency>
-        <groupId>junit</groupId>
-        <artifactId>junit</artifactId>
-        <version>4.12</version>
-      </dependency>
-      <!--
-        Recommended versions of Mockito and PowerMock for build with Java 11 (JENKINS-55098)
-        The versions require Java 8 as a minimum baseline, but they can be downgraded in plugins if needed.
-      -->
-      <dependency>
-        <groupId>org.mockito</groupId>
-        <artifactId>mockito-core</artifactId>
-        <version>2.28.2</version>
-      </dependency>
-      <dependency>
-        <groupId>org.powermock</groupId>
-        <artifactId>powermock-module-junit4</artifactId>
-        <version>2.0.2</version>
-      </dependency>
-      <dependency>
-        <groupId>org.powermock</groupId>
-        <artifactId>powermock-api-mockito2</artifactId>
-        <version>2.0.2</version>
-      </dependency>
-      <dependency>
-        <groupId>org.objenesis</groupId>
-        <artifactId>objenesis</artifactId>
-        <version>3.0.1</version>
-      </dependency>
       <dependency>
         <groupId>org.apache.ant</groupId>
         <artifactId>ant</artifactId>

From 958dd74c337b3155d55f19b54dc24a23515d6d4d Mon Sep 17 00:00:00 2001
From: Mark Wynn-Mackenzie <mwynnmackenzie@cloudbees.com>
Date: Thu, 5 Sep 2019 13:51:14 +0100
Subject: [PATCH 5/5] Apply suggestions from code review

Co-Authored-By: Jesse Glick <jglick@cloudbees.com>
---
 bom/pom.xml | 1 -
 pom.xml     | 4 ++--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/bom/pom.xml b/bom/pom.xml
index 690632fbc2..bef9f8bb9d 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -33,7 +33,6 @@ THE SOFTWARE.
 
   <groupId>org.jenkins-ci.main</groupId>
   <artifactId>jenkins-bom</artifactId>
-  <version>${revision}${changelist}</version>
   <packaging>pom</packaging>
 
   <name>Jenkins BOM</name>
diff --git a/pom.xml b/pom.xml
index b9409d198f..f5a56f6e16 100755
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ THE SOFTWARE.
     <findbugs.threshold>High</findbugs.threshold>
     <findbugs.excludeFilterFile>${project.basedir}/../src/findbugs/findbugs-excludes.xml</findbugs.excludeFilterFile>
 
-    <!-- XXX keep these in sync -->
+    <!-- TODO keep these in sync -->
     <access-modifier-annotation.version>1.14</access-modifier-annotation.version>
     <access-modifier-checker.version>1.14</access-modifier-checker.version>
   </properties>
@@ -136,7 +136,7 @@ THE SOFTWARE.
   </pluginRepositories>
 
   <dependencyManagement>
-    <!-- any dependecies that can be used by plugins must be defined in the bom and not here -->
+    <!-- any dependencies that can be used by plugins must be defined in the bom and not here -->
     <dependencies>
 
       <dependency>