slachiewicz opened a new pull request, #1424: URL: https://github.com/apache/maven-scm/pull/1424
Consumers of `maven-scm-provider-jgit` 2.2.1 resolve Apache MINA SSHD 2.7.0 (GHSA-fhw8-8j55-vwgq, GHSA-2326-hx7g-3m9r) because the `dependencyManagement` entry in the provider POM does not reach them; the provider now declares `sshd-sftp` and `sshd-osgi` directly. JGit stays on 5.13.5, the last line for Java 8. plexus-utils 3.6.0 to 3.6.2 (GHSA-6fmv-xxpf-w3cw) and guava 30.1 to 33.7.2-jre (GHSA-xxph-c9ww-hj94) are managed for the build. Guava arrives only through `guice` in `maven-scm-test`, which downstream projects use for tests; plexus-utils and sshd reach the published providers. Verified: `mvn verify` on all modules, and a consumer of the installed snapshot resolves sshd 2.20.0 → pass Part of apache/maven#13755 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
