slachiewicz opened a new pull request, #1724: URL: https://github.com/apache/maven-dependency-plugin/pull/1724
Clears the last five Dependabot alerts, all in IT fixtures, without changing what the tests cover. - `list-repositories` and `copy-dependencies-with-conflict` now depend on mock POMs served by mrm instead of maven-core 3.2.5 and `org.jdom:jdom` (which has no fixed release). The mock dependency declares the `sonatype-nexus-snapshots` repository that previously came from maven-core's parent chain; it needs a child node because the collector attaches a POM's repositories to that POM's dependencies. - `tree-verbose` bumps batik-bridge 1.7 → 1.19. Batik only contributed the "omitted for duplicate" diamond, which the new tree keeps; the managed-version and conflict cases come from maven-project 2.0.6. Verified: `mvn -P run-its verify` on the three ITs with a clean `target` → passed under Maven 3.9.16 and 4.0.0-rc-7 (`tree-verbose` also under 3.9.0). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
