Upgrade maven-core dependency version #11881
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello, this PR is related to issue 11869 about security dependency.
After passing my professional application to the XRAY scan, it appears that your application has multiple dependencies which open up major flaws:
The version of org.sonatype.plexus:plexus-build-api:jar (0.0.7) which is very old (from 2011) and contains org.codehaus.plexus:plexus-utils:jar:1.5.8:compile reassembled by xray. In addition, your jar also contains a version of maven-core which is obsolete and also contains a major security flaw.
I just upgraded maven core to last version but i cant for plaxus build api because there is no new version since 2007 => why do you use it ? Could you use another lib instead ? If you wants use plexus utils you can take last versions like https://mvnrepository.com/artifact/org.codehaus.plexus/plexus-utils
Thanks you