slachiewicz commented on issue #12811: URL: https://github.com/apache/maven/issues/12811#issuecomment-5450964595
Follow-up on @gnodet's recommendation — all items are now covered: - **Console warning** (CLI): #12882 (maven-3.9.x) and #12881 (maven-3.10.x) — `MavenCli.encryption()` now prints a one-line notice that Maven 3.x password encryption is obfuscation-grade, pointing to the encryption guide. - **User-facing documentation**: apache/maven-site#1659 — a note in the Maven 3.x encryption guide that it is obfuscation-grade, not a substitute for proper secrets management (file permissions, CI/CD vaults, or Maven 4). - **Stay on plexus-cipher 2.0**: done earlier via #12878 (3.9.x POM note), #12879 (3.10.x POM note) and #12880 (dependabot ignore on master). - **#12786**: already closed. With these, the recommendation items are covered. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
