Repository navigation
Update dependencies with known vulnerabilities #13755
Description
pilot:audit (eu.maveniverse.maven.plugins:pilot-plugin 0.5.0) over the estate reports HIGH or CRITICAL advisories in the dependencies of 92 repositories. Most of them clear with releases whose fixes are already on master:
| Advisory source | Repositories | Cleared by |
|---|---|---|
Guava 33.6.0-jre to 33.7.1-jre (GHSA-xxph-c9ww-hj94), provided through maven-core |
84 | Maven 3.9.17 (all lines already pin 33.7.2-jre) |
| commons-beanutils 1.9.4, through doxia-site-renderer 2.0.0 and velocity-tools-generic 3.1 | 20 | maven-doxia-sitetools 2.2.0 (master excludes it) |
| aircompressor 0.27, through maven-archiver 3.6.6 and plexus-archiver 4.10.4 | 4 | maven-archiver 3.6.7 (master uses plexus-archiver 4.15.0) |
The rest need a change in the repository itself, one pull request each:
- maven-resolver: hazelcast 5.3.8 (named-locks-hazelcast), netty-handler 4.2.16.Final, jackson 2.21.2
- maven-wagon: mina-core 2.2.4, bcprov-jdk18on 1.81, jetty 9.4.58, plexus-utils 3.6.0, plexus-archiver 2.2
- maven-doxia-sitetools, maven-release, maven-scm-publish-plugin: sshd 2.7.0 through the JGit 5.13 SCM provider
- maven-scm: plexus-utils 3.6.0, Guava 30.1-jre
- maven-clean-plugin, maven-resources-plugin: plexus-utils 3.6.0
- maven-archetype, maven-build-cache-extension, maven-pmd-plugin: jackson
- maven-javadoc-plugin: jetty 9.4.58
- maven-plugin-tools: commons-io 2.11.0
Repositories outside apache/maven-* (MojoHaus, codehaus-plexus) are tracked in the same list. Each pull request states whether the dependency reaches the published artifact or only the tests.
Pull requests:
- Upgrade Netty and Jackson to fix security advisories maven-resolver#2248
- build(deps): bump com.hazelcast:hazelcast from 5.3.8 to 5.7.0 in /maven-resolver-named-locks-hazelcast maven-resolver#2199 (hazelcast 5.7.0, Dependabot)
- Upgrade dependencies with security advisories maven-wagon#1014
- Upgrade mina-core to 2.2.10 mojohaus/wagon-maven-plugin#201
- Update sshd, plexus-utils and guava to fixed versions maven-scm#1424
- Update Apache MINA SSHD to 2.20.0 in doxia-site-scm-context maven-doxia-sitetools#722
- Update Apache MINA SSHD to 2.20.0 maven-release#1529
- Update Apache MINA SSHD to 2.20.0 maven-scm-publish-plugin#171
- Update plexus-utils to 3.6.2 maven-clean-plugin#387
- Update plexus-utils to 3.6.2 maven-resources-plugin#558
- Update jackson to 2.21.8 maven-archetype#1053
- Update jackson, handlebars and httpcore5 in test dependencies maven-build-cache-extension#566
- Update wiremock and commons-beanutils to fixed versions maven-pmd-plugin#763
- Update commons-io to 2.22.0 maven-plugin-tools#1260
- Update guava to 33.7.2-jre codehaus-plexus/modello#621
Jetty 9.4.x and 10.0.x have no fixed release on Maven Central (fixes are in 9.4.60 and 10.0.28; Central ends at 9.4.58 and 10.0.26), so maven-wagon, maven-javadoc-plugin and mrm keep Jetty until a move to Jetty 12.
The sshd management in maven-doxia-sitetools, maven-release and maven-scm-publish-plugin can go once a maven-scm release with #1424 is out. modello keeps maven-core 3.6.3 and maven-shared-utils 3.2.1: they are its provided Maven floor.
Activity