Re: maven-clean-plugin and plexus-utils 1.1 (CVE-2017-1000487)

2022-09-22 Thread Tamás Cservenák
Howdy, @Tomo it is happening, see this (using 3.8.6): https://gist.github.com/cstamas/3cecd1f521a92910a1f8555fc4aa9b17#file-gistfile1-txt-L38 Clean plugin 3.2.0 is okay, this is Maven doing it. In Maven 3.8.x line there is a legacy component doing it:

Re: Plans to deprecate or change the default value of maven compiler plugin's showWarnings

2022-09-22 Thread Florent Biville
Thanks for the reply! Can I go ahead and open an issue and/or a PR? > What other settings do you have in mind? Maybe the same logic could apply to showDeprecation but I have not thought about it too much and the situation may be a bit different there. On Thu, Sep 22, 2022 at 10:31 AM Olivier

Re: maven-clean-plugin and plexus-utils 1.1 (CVE-2017-1000487)

2022-09-22 Thread Tomo Suzuki
Hi Martin, Would you share the output of your [1] setup, where you saw “plexus-utils-1.1.jar is being downloaded“? mvn -X -s settings.xml -Dmaven.repo.local=repository org.apache.maven.plugins:maven-clean-plugin:3.2.0:clean (Doesn’t the debug flag explain why it’s downloading it?) Regards,

Re: Plans to deprecate or change the default value of maven compiler plugin's showWarnings

2022-09-22 Thread Olivier Lamy
On Thu, 15 Sept 2022 at 00:52, Florent Biville wrote: > Hi everyone, > > A colleague of mine recently stumbled upon this > < > https://stackoverflow.com/questions/9192613/how-do-i-get-a-java-maven-build-to-fail-for-compiler-warnings/33823355#33823355 > > > . > > Quoting the above Stackoverflow

maven-clean-plugin and plexus-utils 1.1 (CVE-2017-1000487)

2022-09-22 Thread Martin D'Aloia
Hi, we are seeing that even with the latest maven-clean-plugin (currently 3.2.0) a plexus-utils-1.1.jar is being downloaded. We think that it is a real issue but we wanted to check in case we are overlooking something. This is reproducible 100% with a simple setup shown below. [1] In theory