slachiewicz opened a new pull request, #2248: URL: https://github.com/apache/maven-resolver/pull/2248
Imports the Netty and Jackson BOMs (4.2.17.Final, 2.21.7) so the transitives of Redisson and MinIO resolve to versions without the open HIGH and CRITICAL advisories, for example GHSA-c4c3-7fpv-j4q5 in `netty-handler`. Both are compile-scope dependencies of `maven-resolver-named-locks-redisson` and `maven-resolver-transport-minio`, so they reach the published artifacts of those two optional modules (not Maven core's distribution). Hazelcast is left to #2199. Verified: `mvn verify -pl maven-resolver-transport-minio,maven-resolver-named-locks-redisson -am` → BUILD SUCCESS; `dependency:tree` shows netty-handler 4.2.17.Final and jackson-databind 2.21.7. Part of apache/maven#13755 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
