slachiewicz opened a new issue, #13755: URL: https://github.com/apache/maven/issues/13755
`pilot:audit` (eu.maveniverse.maven.plugins:pilot-plugin 0.5.0) over the estate reports HIGH or CRITICAL advisories in the dependencies of 92 repositories. Most of them clear with releases whose fixes are already on master: | Advisory source | Repositories | Cleared by | |---|---|---| | Guava 33.6.0-jre to 33.7.1-jre (GHSA-xxph-c9ww-hj94), `provided` through maven-core | 84 | Maven 3.9.17 (all lines already pin 33.7.2-jre) | | commons-beanutils 1.9.4, through doxia-site-renderer 2.0.0 and velocity-tools-generic 3.1 | 20 | maven-doxia-sitetools 2.2.0 (master excludes it) | | aircompressor 0.27, through maven-archiver 3.6.6 and plexus-archiver 4.10.4 | 4 | maven-archiver 3.6.7 (master uses plexus-archiver 4.15.0) | The rest need a change in the repository itself, one pull request each: - maven-resolver: hazelcast 5.3.8 (named-locks-hazelcast), netty-handler 4.2.16.Final, jackson 2.21.2 - maven-wagon: mina-core 2.2.4, bcprov-jdk18on 1.81, jetty 9.4.58, plexus-utils 3.6.0, plexus-archiver 2.2 - maven-doxia-sitetools, maven-release, maven-scm-publish-plugin: sshd 2.7.0 through the JGit 5.13 SCM provider - maven-scm: plexus-utils 3.6.0, Guava 30.1-jre - maven-clean-plugin, maven-resources-plugin: plexus-utils 3.6.0 - maven-archetype, maven-build-cache-extension, maven-pmd-plugin: jackson - maven-javadoc-plugin: jetty 9.4.58 - maven-plugin-tools: commons-io 2.11.0 Repositories outside apache/maven-* (MojoHaus, codehaus-plexus) are tracked in the same list. Each pull request states whether the dependency reaches the published artifact or only the tests. Pull requests: -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
