Re: [VOTE] Release maven-compiler-plugin 3.11.0

2023-02-14 Thread Slawomir Jaranowski
+1

On GitHub release notes section - "What's Changed" looks like
duplicated with previous items inserted by release drafter.

wt., 14 lut 2023 o 09:51 Guillaume Nodet  napisał(a):

> Hi,
> I'd like to release Apache Maven Compiler Plugin 3.11.0
>
> 7 issues fixed
> https://issues.apache.org/jira/projects/MCOMPILER/versions/12351444
>
> draft github release notes (sadly only for people with write access as it's
> a draft:() :
>
> https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0
>
>
> staging repo
> https://repository.apache.org/content/repositories/maven-1873/
> artifacts here
>
> https://repository.apache.org/content/repositories/maven-1873/org/apache/maven/plugins/maven-compiler-plugin/3.11.0/
>
> staging site
> https://maven.apache.org/plugins-archives/maven-compiler-plugin-LATEST/
>
> Vote open for 72H
>
>
> --
> 
> Guillaume Nodet
>


-- 
Sławomir Jaranowski


Re: [VOTE] Release maven-compiler-plugin 3.11.0

2023-02-14 Thread Delany
+1
Delany

On Tue, 14 Feb 2023 at 10:51, Guillaume Nodet  wrote:

> Hi,
> I'd like to release Apache Maven Compiler Plugin 3.11.0
>
> 7 issues fixed
> https://issues.apache.org/jira/projects/MCOMPILER/versions/12351444
>
> draft github release notes (sadly only for people with write access as it's
> a draft:() :
>
> https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0
>
>
> staging repo
> https://repository.apache.org/content/repositories/maven-1873/
> artifacts here
>
> https://repository.apache.org/content/repositories/maven-1873/org/apache/maven/plugins/maven-compiler-plugin/3.11.0/
>
> staging site
> https://maven.apache.org/plugins-archives/maven-compiler-plugin-LATEST/
>
> Vote open for 72H
>
>
> --
> 
> Guillaume Nodet
>


JDK 20 Release Candidate and Deprecation

2023-02-14 Thread David Delabassee

Welcome to the latest OpenJDK Quality Outreach update!

The first Release Candidates of JDK 20 have been released [1] as per the 
schedule [2]. At this stage, only P1 issues will be evaluated. And with 
the JDK 20 General Availability sets for March 21st, it is now time to 
fully focus on JDK 21. I'd like to thank those of you who have already 
provided feedback on the Early Builds of JDK 21. Feedback is always 
extremely useful, even more, when it comes early in the development cycle.


We are always thinking about the future but the future is not limited to 
new features (pun intended). Properly removing legacy features from the 
platform is also critical. Deprecation has always been an important, 
phased, and ongoing effort. To name just two recent examples, 
`Thread.stop()` is removed in JDK 20 [3], and the URL Public 
Constructors are deprecated in JDK 20 (see the related heads-up below). 
It is important to prepare your codebase for such upcoming evolutions 
sooner rather than later. To conclude on deprecation, I'll mention my 
colleague Nicolai who recently did a full video on this exact topic, 
i.e. "Prepare your Codebase for the Future Now!" [4].


[1] https://mail.openjdk.org/pipermail/jdk-dev/2023-February/007364.html
[2] https://openjdk.org/projects/jdk/20/
[3] https://inside.java/2022/11/09/quality-heads-up/
[4] https://inside.java/2023/02/02/newscast-41/


## Heads-Up - JDK 20 - Deprecate URL Public Constructors

The `java.net.URL` class, dating from Java SE 1.0, does not encode or 
decode any URL components according to the RFC2396 escaping mechanism. 
It is the responsibility of the caller to encode any fields, which need 
to be escaped prior to calling URL, and also to decode any escaped 
fields that are returned from URL. This has led to many usability 
issues, including some potential vulnerabilities when the calling code 
did not take this into consideration.


In Java SE 1.4, the `java.net.URI` class has been added to mitigate some 
of the `java.net.URL` shortcomings. It also offers methods to create an 
URL from an URI.


JDK 20 will deprecate all public constructors of `java.net.URL`. This 
will provide a strong warning and discourage developers from using them. 
To construct a URL, the `URI::toURL` alternative should instead be 
preferred. To construct a `file:` based URL, `Path::toURI` should be 
used prior to `URI::toURL`.


For more details, see https://bugs.openjdk.org/browse/JDK-8294241


## Heads-Up - JDK 20 - JMX Connections Use an ObjectInputFilter by Default

The default JMX agent now sets an ObjectInputFilter on the RMI 
connection to restrict the types that the server will deserialize. This 
should not affect normal usage of the MBeans in the JDK. Applications 
which register their own MBeans in the platform MBeanServer may need to 
extend the serialization filter to support any additional types that 
their custom MBeans accept as parameters. The default filter already 
covers any type that OpenMBeans and MXBeans might use.


The serialization filter pattern is set in 
`JDK/conf/management/management.properties` using the property 
`com.sun.management.jmxremote.serial.filter.pattern`. If additional Java 
types need to be passed, the default can be overridden by running with 
`-Dcom.sun.management.jmxremote.serial.filter.pattern=.`


Serialization Filtering and the filter pattern format are described in 
detail in the Core Libraries Guide [5].


[5] 
https://docs.oracle.com/en/java/javase/19/core/serialization-filtering1.html#GUID-55BABE96-3048-4A9F-A7E6-781790FF3480



## Heads-Up - Testing Loom: Scoped Values and Structured Concurrency

With one JEP in Preview (Virtual Threads - 2nd Preview) and two JEPs 
incubating (Scoped Values - Incubator & Structured Concurrency - 2nd 
Incubator) Loom made considerable progress in JDK 20. The Loom team is 
always eager to hear from developers experimenting with those APIs, 
especially given that both Scoped Values and Structured Concurrency 
might become Preview in JDK 21. Feedback should be reported to the 
loom-dev [6] mailing list.


[6] https://mail.openjdk.org/pipermail/loom-dev/


## JDK 20 Release Candidate builds

The Release Candidate builds (builds 36) are available [7] and are 
provided under the GNU General Public License v2, with the Classpath 
Exception. The Release Notes are available here [8].


[7] https://jdk.java.net/20/
[8] https://jdk.java.net/20/release-notes

### Changes in recent JDK 20 builds that may be of interest:

- JDK-8300623: Lambda deserialization regression involving Enum method 
reference

- JDK-8298400: Virtual thread instability when stack overflows
- JDK-8298377: JfrVframeStream causes deadlocks in ZGC


## JDK 21 Early-Access builds

The JDK 21 Early-Access (builds 9) are available [9], and are provided 
under the GNU General Public License v2, with the Classpath Exception. 
The related Javadocs are available here [10] and the Release Notes here 
[11].


[9] https://jdk.java.net/21/
[10] 

Re: [VOTE] Release maven-compiler-plugin 3.11.0

2023-02-14 Thread Herve Boutemy
+1

Reproducible Build ok: reference build done with JDK 17 on *nix

Regards,

Hervé

On 2023/02/14 08:51:00 Guillaume Nodet wrote:
> Hi,
> I'd like to release Apache Maven Compiler Plugin 3.11.0
> 
> 7 issues fixed
> https://issues.apache.org/jira/projects/MCOMPILER/versions/12351444
> 
> draft github release notes (sadly only for people with write access as it's
> a draft:() :
> https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0
> 
> 
> staging repo https://repository.apache.org/content/repositories/maven-1873/
> artifacts here
> https://repository.apache.org/content/repositories/maven-1873/org/apache/maven/plugins/maven-compiler-plugin/3.11.0/
> 
> staging site
> https://maven.apache.org/plugins-archives/maven-compiler-plugin-LATEST/
> 
> Vote open for 72H
> 
> 
> -- 
> 
> Guillaume Nodet
> 

-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org



Re: [VOTE] Release maven-compiler-plugin 3.11.0

2023-02-14 Thread Sylwester Lachiewicz
+1

wt., 14 lut 2023, 09:51 użytkownik Guillaume Nodet 
napisał:

> Hi,
> I'd like to release Apache Maven Compiler Plugin 3.11.0
>
> 7 issues fixed
> https://issues.apache.org/jira/projects/MCOMPILER/versions/12351444
>
> draft github release notes (sadly only for people with write access as it's
> a draft:() :
>
> https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0
>
>
> staging repo
> https://repository.apache.org/content/repositories/maven-1873/
> artifacts here
>
> https://repository.apache.org/content/repositories/maven-1873/org/apache/maven/plugins/maven-compiler-plugin/3.11.0/
>
> staging site
> https://maven.apache.org/plugins-archives/maven-compiler-plugin-LATEST/
>
> Vote open for 72H
>
>
> --
> 
> Guillaume Nodet
>


[ANN] Maven Site Plugin 4.0.0-M5 released

2023-02-14 Thread Michael Osipov
The Apache Maven team is pleased to announce the release of the Maven 
Site Plugin, version 4.0.0-M5.


https://maven.apache.org/plugins/maven-site-plugin/


Release Notes - Maven Site Plugin - Version 4.0.0-M5

** Bug
* [MSITE-220] - site:run mojo will not display Javadoc or JXR 
report results


** Improvement
* [MSITE-872] - Set content type on Doxia output
* [MSITE-924] - Populate SiteRenderingContext#getPublishDate() with 
${project.build.outputTimestamp}

* [MSITE-929] - Make server host configurable

** Task
* [MSITE-920] - Remove Maven 2 compat code

** Dependency upgrade
* [MSITE-925] - Upgrade to Doxia/Doxia Sitetools to 2.0.0-M5
* [MSITE-926] - Upgrade to Maven Reporting API/Exec 4.0.0-M4
* [MSITE-927] - Upgrade Parent to 39
* [MSITE-928] - Upgrade plugins and components


Enjoy,

-The Apache Maven team

-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org



[ANN] Apache Maven Reporting Impl 4.0.0-M4 released

2023-02-14 Thread Michael Osipov
The Apache Maven team is pleased to announce the release of the Maven 
Reporting Impl version 4.0.0-M4.


https://maven.apache.org/shared/maven-reporting-impl/


Release Notes - Maven Shared Components - Version 
maven-reporting-impl-4.0.0-M4


** New Feature
* [MSHARED-1168] - Add support for markup output
* [MSHARED-1185] - Introduce 
AbstractMavenReportRenderer#verbatimSource()


** Improvement
* [MSHARED-480] - Use maven-site-plugin's site.xml to use site's 
skin instead of default when run as mojo

* [MSHARED-1174] - Don't wrap elements in anchors
* [MSHARED-1181] - Populate SiteRenderingContext#getPublishDate() 
with ${project.build.outputTimestamp}

* [MSHARED-1182] - Drop incorrect usage of SinkEventAttributeSet#BOXED
* [MSHARED-1183] - Don't pass implied args to 
AbstractMavenReportRenderer#startTable()
* [MSHARED-1184] - Drop unnecessary use of type attribute with 
JavaScript


** Dependency upgrade
* [MSHARED-1186] - Upgrade Parent to 39
* [MSHARED-1187] - Upgrade to Doxia 2.0.0-M5
* [MSHARED-1188] - Upgrade to Maven Reporting API 4.0.0-M4
* [MSHARED-1189] - Upgrade plugins and components in ITs
* [MSHARED-1194] - Upgrade to Doxia Sitetools 2.0.0-M5


Enjoy,

-The Apache Maven team

-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org



Re: Maven 3.9.0 plexus-utils issue in extension

2023-02-14 Thread Falko Modler

Maybe really a backport is the way to go. Please check in and out and
I will happily merge if this fixes the problem for components like yours.


I was able to backport and test it sucessfully, see
https://github.com/apache/maven/pull/999

Btw, I'll explore a reflection hack to mitigate the impact on GIB users,
but the above change would make sense anyway (if there's ever a 3.8.8).

Cheers,

Falko

Am 10.02.2023 um 19:44 schrieb Michael Osipov:

Am 2023-02-10 um 18:55 schrieb Falko Modler:

Hi Michael,


Have you tried to back port the class loading strategy from gnodet@
back to 3.8.x?

Not yet. First, I'm looking for solutions without touching Maven itself
but there might be none in this case.

I was actually thinking myself whether that feature could be backported,
so good you mentioned it.

It would probably make it work with 3.8.8 (and 3.9+), but obviously not
with <=3.8.7.

Btw, I think that 1.1.0 xsd hasn't been uploaded yet, or has it?


Done, Tamás simply did forget to upload. No issue.

This should be it:
* https://issues.apache.org/jira/browse/MNG-7160
*
https://github.com/apache/maven/commit/a1d8a07e08927a754f6dd72d5729d85ae15d3e63

It is almost two years old and has been reported against 3.6.x as
well. Maybe really a backport is the way to go. Please check in and
out and I will happily merge if this fixes the problem for components
like yours.

Michael


-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org




-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org



Re: [VOTE] Release maven-compiler-plugin 3.11.0

2023-02-14 Thread Michael Osipov

Am 2023-02-14 um 09:51 schrieb Guillaume Nodet:

Hi,
I'd like to release Apache Maven Compiler Plugin 3.11.0

7 issues fixed
https://issues.apache.org/jira/projects/MCOMPILER/versions/12351444

draft github release notes (sadly only for people with write access as it's
a draft:() :
https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0


staging repo https://repository.apache.org/content/repositories/maven-1873/
artifacts here
https://repository.apache.org/content/repositories/maven-1873/org/apache/maven/plugins/maven-compiler-plugin/3.11.0/

staging site
https://maven.apache.org/plugins-archives/maven-compiler-plugin-LATEST/



+1


-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org



Re: [VOTE] Release Maven Fluido Skin version 2.0.0-M3

2023-02-14 Thread Michael Osipov

Am 2023-02-12 um 19:49 schrieb Michael Osipov:

IMPORTANT: Requires Maven Site Plugin 4.0.0-M5 vote/staging repo!

Hi,

We solved 5 issues:
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12317926=12352919

There are still a couple of issues left in JIRA:
https://issues.apache.org/jira/issues/?jql=project%20%3D%20MSKINS%20AND%20resolution%20%3D%20Unresolved%20AND%20component%20%3D%20%22Fluido%20Skin%22

Staging repo:
https://repository.apache.org/content/repositories/maven-1871/
https://repository.apache.org/content/repositories/maven-1871/org/apache/maven/skins/maven-fluido-skin/2.0.0-M3/maven-fluido-skin-2.0.0-M3-source-release.zip

Source release checksum(s):
maven-fluido-skin-2.0.0-M3-source-release.zip
sha512: 
0c6eadcb37dcbe7a121557ca4033e2a4113ba6c2bf3367685a5949a3af829002189acd34074d4d1a417a226122cd47d19065a9915003692f1402ba908aa24136


Staging site:
https://maven.apache.org/components/skins-archives/maven-fluido-skin-LATEST/

Guide to testing staged releases:
https://maven.apache.org/guides/development/guide-testing-releases.html

Vote open for 72 hours.


+1


-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org



[RESULT] [VOTE] Release Maven Site Plugin version 4.0.0-M5

2023-02-14 Thread Michael Osipov

Hi,

The vote has passed with the following result:

+1: Michael Osipov, Hervé Boutemy, Slawomir Jaranowski

PMC quorum: reached

I will promote the artifacts to the central repo, the source release ZIP 
file

and add this release the board report.


[RESULT] [VOTE] Release Apache Maven Reporting Impl 4.0.0-M4

2023-02-14 Thread Michael Osipov

Hi,

The vote has passed with the following result:

+1: Michael Osipov, Hervé Boutemy, Slawomir Jaranowski

PMC quorum: reached

I will promote the artifacts to the central repo, the source release ZIP 
file

and add this release the board report.


Re: CVEs in maven-compat via toolchains

2023-02-14 Thread Mark Derricutt

On 15 Feb 2023, at 8:30, Tamás Cservenák wrote:


This artifact ceased to exist (well, to be produced) since.


Sweet - dropped the dependency and all good - and re-released.

Cheers,
Mark


---
"The ease with which a change can be implemented has no relevance at all 
to whether it is the right change for the (Java) Platform for all time." 
 Mark Reinhold.


Mark Derricutt
http://www.chaliceofblood.net
http://www.theoryinpractice.net
http://twitter.com/talios
http://facebook.com/mderricutt


Re: CVEs in maven-compat via toolchains

2023-02-14 Thread Tamás Cservenák
No, it doesn't.
Somewhere around 3.0-alpha-3 (?) the toolchains were pulled into maven
https://github.com/apache/maven/commit/5377165201decef84c10ad00b0ecef18935e0539

And I guess some reshuffle happened, and finally it ended up in maven-core.

This artifact ceased to exist (well, to be produced) since.

HTH
T

On Tue, Feb 14, 2023 at 8:19 PM Mark Derricutt  wrote:

> On 15 Feb 2023, at 1:19, Elliotte Rusty Harold wrote:
>
> > That's extremely old and seems unmaintained and never released. You
> > probably want the maven-toolchains-plugin
>
> Isn't that for USING toolchains - not adding tool chain support to a
> plugin? Will do some more digging.
>
>
>
> ---
> "The ease with which a change can be implemented has no relevance at all
> to whether it is the right change for the (Java) Platform for all time."
>  Mark Reinhold.
>
> Mark Derricutt
> http://www.chaliceofblood.net
> http://www.theoryinpractice.net
> http://twitter.com/talios
> http://facebook.com/mderricutt
>


Re: CVEs in maven-compat via toolchains

2023-02-14 Thread Mark Derricutt

On 15 Feb 2023, at 1:19, Elliotte Rusty Harold wrote:


That's extremely old and seems unmaintained and never released. You
probably want the maven-toolchains-plugin


Isn't that for USING toolchains - not adding tool chain support to a 
plugin? Will do some more digging.




---
"The ease with which a change can be implemented has no relevance at all 
to whether it is the right change for the (Java) Platform for all time." 
 Mark Reinhold.


Mark Derricutt
http://www.chaliceofblood.net
http://www.theoryinpractice.net
http://twitter.com/talios
http://facebook.com/mderricutt


Re: CVEs in maven-compat via toolchains

2023-02-14 Thread Karl Heinz Marbaise

Hi,


On 14.02.23 11:22, Mark Derricutt wrote:

Hey all,

I was alerted the other day about a security issue with my
clojure-maven-plugin apparently pulling in log4j 1.2, but using the
dependency:tree plugin showed nothing.

Seems this is due to dependencies being overridden by newer maven
versions, anyway - I use toolchains in the plugin and have this
dependency tree:

```
[INFO] +- org.apache.maven:maven-toolchain:jar:3.0-alpha-2:compile
[INFO] |  +- (org.apache.maven:maven-core:jar:3.0-alpha-2:compile -
omitted for conflict with 3.9.0)
[INFO] |  \- org.apache.maven:maven-compat:jar:3.0-alpha-2:compile
[INFO] | +- (org.apache.maven:maven-model:jar:3.0-alpha-2:compile -
omitted for conflict with 3.9.0)
[INFO] | +-
(org.codehaus.plexus:plexus-container-default:jar:1.0-beta-3.0.5:compile
- omitted for duplicate)
[INFO] | +-
(org.codehaus.plexus:plexus-component-annotations:jar:1.0-beta-3.0.5:compile - 
omitted for conflict with 1.5.5)
```



The version maven-toolchain 3.0-alpha-2 is of 2009 !!!

https://search.maven.org/search?q=g:org.apache.maven%20a:maven-toolchain


Also taken a look at:
https://github.com/talios/clojure-maven-plugin/blob/develop/pom.xml

which exactly shows this:

   
  org.apache.maven
  maven-toolchain
  3.0-alpha-2


which I think is the culprit...

The current version of toolchains-plugin:

https://maven.apache.org/plugins/maven-toolchains-plugin/

The current ToolchainManager can be obtained from the maven-core (I
would suggest to set minimum maven version to 3.2.5)...(Take a deeper
look into maven-compiler-plugin)...


Kind regards
Karl Heinz Marbaise



This trips up with:

```
[ERROR]   org.apache.maven:maven-compat:jar:3.0-alpha-2:compile;
https://ossindex.sonatype.org/component/pkg:maven/org.apache.maven/maven-compat@3.0-alpha-2?utm_source=ossindex-client_medium=integration_content=1.8.1
[ERROR] * [CVE-2021-26291] CWE-346: Origin Validation Error (9.1);
https://ossindex.sonatype.org/vulnerability/CVE-2021-26291?component-type=maven=org.apache.maven%2Fmaven-compat_source=ossindex-client_medium=integration_content=1.8.1
```

There doesn't appear to be a newer version of `maven-toolchain` at all -
or is there and I'm just looking in the wrong place these days?

Cheers,
Mark





-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org



Re: CVEs in maven-compat via toolchains

2023-02-14 Thread Elliotte Rusty Harold
On Tue, Feb 14, 2023 at 5:23 AM Mark Derricutt  wrote:
>
> Hey all,
>
> I was alerted the other day about a security issue with my
> clojure-maven-plugin apparently pulling in log4j 1.2, but using the
> dependency:tree plugin showed nothing.

Interesting discovery. It sounds like the security tool doesn't
properly analyze Maven classpaths, whereas the dependency:tree plugin
does. If that's so, file a bug against the security analyzer. These
sorts of false positives really reduce its functionality and make all
of us less secure.

> [ERROR]   org.apache.maven:maven-compat:jar:3.0-alpha-2:compile;
> https://ossindex.sonatype.org/component/pkg:maven/org.apache.maven/maven-compat@3.0-alpha-2?utm_source=ossindex-client_medium=integration_content=1.8.1
> [ERROR] * [CVE-2021-26291] CWE-346: Origin Validation Error (9.1);
> https://ossindex.sonatype.org/vulnerability/CVE-2021-26291?component-type=maven=org.apache.maven%2Fmaven-compat_source=ossindex-client_medium=integration_content=1.8.1
> ```

That's extremely old and seems unmaintained and never released. You
probably want the maven-toolchains-plugin instead.

-- 
Elliotte Rusty Harold
elh...@ibiblio.org

-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org



Re: [VOTE] Release maven-compiler-plugin 3.11.0

2023-02-14 Thread Petr Široký
+1 (non-binding)

Tested on several projects (on Linux and JDK 19.0.2). No issue found.

Petr

--- Original Message ---
On Tuesday, February 14th, 2023 at 09:51, Guillaume Nodet  
wrote:


> 
> 
> Hi,
> I'd like to release Apache Maven Compiler Plugin 3.11.0
> 
> 7 issues fixed
> https://issues.apache.org/jira/projects/MCOMPILER/versions/12351444
> 
> draft github release notes (sadly only for people with write access as it's
> a draft:() :
> https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0
> 
> 
> staging repo https://repository.apache.org/content/repositories/maven-1873/
> artifacts here
> https://repository.apache.org/content/repositories/maven-1873/org/apache/maven/plugins/maven-compiler-plugin/3.11.0/
> 
> staging site
> https://maven.apache.org/plugins-archives/maven-compiler-plugin-LATEST/
> 
> Vote open for 72H
> 
> 
> --
> 
> Guillaume Nodet

-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org



CVEs in maven-compat via toolchains

2023-02-14 Thread Mark Derricutt

Hey all,

I was alerted the other day about a security issue with my 
clojure-maven-plugin apparently pulling in log4j 1.2, but using the 
dependency:tree plugin showed nothing.


Seems this is due to dependencies being overridden by newer maven 
versions, anyway - I use toolchains in the plugin and have this 
dependency tree:


```
[INFO] +- org.apache.maven:maven-toolchain:jar:3.0-alpha-2:compile
[INFO] |  +- (org.apache.maven:maven-core:jar:3.0-alpha-2:compile - 
omitted for conflict with 3.9.0)

[INFO] |  \- org.apache.maven:maven-compat:jar:3.0-alpha-2:compile
[INFO] | +- (org.apache.maven:maven-model:jar:3.0-alpha-2:compile - 
omitted for conflict with 3.9.0)
[INFO] | +- 
(org.codehaus.plexus:plexus-container-default:jar:1.0-beta-3.0.5:compile 
- omitted for duplicate)
[INFO] | +- 
(org.codehaus.plexus:plexus-component-annotations:jar:1.0-beta-3.0.5:compile 
- omitted for conflict with 1.5.5)

```

This trips up with:

```
[ERROR]   org.apache.maven:maven-compat:jar:3.0-alpha-2:compile; 
https://ossindex.sonatype.org/component/pkg:maven/org.apache.maven/maven-compat@3.0-alpha-2?utm_source=ossindex-client_medium=integration_content=1.8.1
[ERROR] * [CVE-2021-26291] CWE-346: Origin Validation Error (9.1); 
https://ossindex.sonatype.org/vulnerability/CVE-2021-26291?component-type=maven=org.apache.maven%2Fmaven-compat_source=ossindex-client_medium=integration_content=1.8.1

```

There doesn't appear to be a newer version of `maven-toolchain` at all - 
or is there and I'm just looking in the wrong place these days?


Cheers,
Mark






---
"The ease with which a change can be implemented has no relevance at all 
to whether it is the right change for the (Java) Platform for all time." 
 Mark Reinhold.


Mark Derricutt
http://www.chaliceofblood.net
http://www.theoryinpractice.net
http://twitter.com/talios
http://facebook.com/mderricutt


Re: [VOTE] Release maven-compiler-plugin 3.11.0

2023-02-14 Thread Tamás Cservenák
+1

On Tue, Feb 14, 2023 at 9:51 AM Guillaume Nodet  wrote:

> Hi,
> I'd like to release Apache Maven Compiler Plugin 3.11.0
>
> 7 issues fixed
> https://issues.apache.org/jira/projects/MCOMPILER/versions/12351444
>
> draft github release notes (sadly only for people with write access as it's
> a draft:() :
>
> https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0
>
>
> staging repo
> https://repository.apache.org/content/repositories/maven-1873/
> artifacts here
>
> https://repository.apache.org/content/repositories/maven-1873/org/apache/maven/plugins/maven-compiler-plugin/3.11.0/
>
> staging site
> https://maven.apache.org/plugins-archives/maven-compiler-plugin-LATEST/
>
> Vote open for 72H
>
>
> --
> 
> Guillaume Nodet
>


Re: [VOTE] Release maven-compiler-plugin 3.11.0

2023-02-14 Thread Karl Heinz Marbaise

Hi,

+1 from me.

Kind regards
Karl Heinz Marbaise
On 14.02.23 09:51, Guillaume Nodet wrote:

Hi,
I'd like to release Apache Maven Compiler Plugin 3.11.0

7 issues fixed
https://issues.apache.org/jira/projects/MCOMPILER/versions/12351444


This link seemed to be incorrect.

Try this one:

https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0


That was wrong as well..

This is the correct one:

https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12317225=12351444






draft github release notes (sadly only for people with write access as
it's
a draft:() :
https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0


staging repo
https://repository.apache.org/content/repositories/maven-1873/
artifacts here
https://repository.apache.org/content/repositories/maven-1873/org/apache/maven/plugins/maven-compiler-plugin/3.11.0/

staging site
https://maven.apache.org/plugins-archives/maven-compiler-plugin-LATEST/

Vote open for 72H







-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org



Re: [VOTE] Release maven-compiler-plugin 3.11.0

2023-02-14 Thread Karl Heinz Marbaise

Hi,

+1 from me.

Kind regards
Karl Heinz Marbaise
On 14.02.23 09:51, Guillaume Nodet wrote:

Hi,
I'd like to release Apache Maven Compiler Plugin 3.11.0

7 issues fixed
https://issues.apache.org/jira/projects/MCOMPILER/versions/12351444


This link seemed to be incorrect.

Try this one:

https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0



draft github release notes (sadly only for people with write access as it's
a draft:() :
https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0


staging repo https://repository.apache.org/content/repositories/maven-1873/
artifacts here
https://repository.apache.org/content/repositories/maven-1873/org/apache/maven/plugins/maven-compiler-plugin/3.11.0/

staging site
https://maven.apache.org/plugins-archives/maven-compiler-plugin-LATEST/

Vote open for 72H





-
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org



[VOTE] Release maven-compiler-plugin 3.11.0

2023-02-14 Thread Guillaume Nodet
Hi,
I'd like to release Apache Maven Compiler Plugin 3.11.0

7 issues fixed
https://issues.apache.org/jira/projects/MCOMPILER/versions/12351444

draft github release notes (sadly only for people with write access as it's
a draft:() :
https://github.com/apache/maven-compiler-plugin/releases/tag/untagged-0ec6b3d056333c4a2ed0


staging repo https://repository.apache.org/content/repositories/maven-1873/
artifacts here
https://repository.apache.org/content/repositories/maven-1873/org/apache/maven/plugins/maven-compiler-plugin/3.11.0/

staging site
https://maven.apache.org/plugins-archives/maven-compiler-plugin-LATEST/

Vote open for 72H


-- 

Guillaume Nodet