You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@maven.apache.org by Clebert Suconic <cl...@gmail.com> on 2026/04/02 11:00:28 UTC
Plexus ustils 3.6.0 on bin
Plexus utils 3.6.0 is affected by a CVE:
https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
Would be possible to update the dependency by a non affected version
(I think 3.9.0?) and have a maven 3.9.15 with the upgrade?
I develop a maven plugin and that makes my code to appear in security
scanners, even though the dependency has a provided scope and is
downloaded by Maven itself.
Thank you
--
Clebert Suconic
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: Plexus ustils 3.6.0 on bin
Posted by Slawomir Jaranowski <s....@gmail.com>.
Hi,
I will take care about release 3.9.15
On Mon, 6 Apr 2026 at 17:27, Clebert Suconic <cl...@gmail.com>
wrote:
> Thanks a lot
>
> Is there anyone planning to release it already? it would be nice to
> have a release on it...
>
> Thanks
>
> On Thu, Apr 2, 2026 at 4:00 PM Slawomir Jaranowski
> <s....@gmail.com> wrote:
> >
> > Hi,
> >
> > Fixed for 3.9.15 -
> https://github.com/apache/maven/milestone/125?closed=1
> >
> >
> >
> >
> > I add info at
> > https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
> > thate plexus-utils 3.6.1 alos has a fix
> >
> >
> > On Thu, 2 Apr 2026 at 14:24, Clebert Suconic <cl...@gmail.com>
> > wrote:
> >
> > > From my line of usage: These two jars:
> > >
> > > org.apache.maven:maven-plugin-api:jar:3.9.14
> > > org.apache.maven:maven-core:jar:3.9.14
> > >
> > >
> > > If you look on the pom, you will see:
> > >
> > > https://github.com/apache/maven/blob/maven-3.9.x/pom.xml#L138
> > >
> > > On Thu, Apr 2, 2026 at 7:22 AM Guillaume Nodet <gn...@apache.org>
> wrote:
> > > >
> > > > Do you know which jars depend on this plexus-utils 3.6.0 ?
> > > >
> > > > Le jeu. 2 avr. 2026 à 13:02, Clebert Suconic <
> clebert.suconic@gmail.com>
> > > a
> > > > écrit :
> > > >
> > > > > Plexus utils 3.6.0 is affected by a CVE:
> > > > >
> > > > > https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
> > > > >
> > > > >
> > > > >
> > > > > Would be possible to update the dependency by a non affected
> version
> > > > > (I think 3.9.0?) and have a maven 3.9.15 with the upgrade?
> > > > >
> > > > > I develop a maven plugin and that makes my code to appear in
> security
> > > > > scanners, even though the dependency has a provided scope and is
> > > > > downloaded by Maven itself.
> > > > >
> > > > >
> > > > >
> > > > > Thank you
> > > > >
> > > > > --
> > > > > Clebert Suconic
> > > > >
> > > > >
> ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > > > > For additional commands, e-mail: dev-help@maven.apache.org
> > > > >
> > > > >
> > > >
> > > > --
> > > > ------------------------
> > > > Guillaume Nodet
> > >
> > >
> > >
> > > --
> > > Clebert Suconic
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > > For additional commands, e-mail: dev-help@maven.apache.org
> > >
> > >
> >
> > --
> > Sławomir Jaranowski
>
>
>
> --
> Clebert Suconic
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
--
Sławomir Jaranowski
Re: Plexus ustils 3.6.0 on bin
Posted by Clebert Suconic <cl...@gmail.com>.
Thanks a lot
Is there anyone planning to release it already? it would be nice to
have a release on it...
Thanks
On Thu, Apr 2, 2026 at 4:00 PM Slawomir Jaranowski
<s....@gmail.com> wrote:
>
> Hi,
>
> Fixed for 3.9.15 - https://github.com/apache/maven/milestone/125?closed=1
>
>
>
>
> I add info at
> https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
> thate plexus-utils 3.6.1 alos has a fix
>
>
> On Thu, 2 Apr 2026 at 14:24, Clebert Suconic <cl...@gmail.com>
> wrote:
>
> > From my line of usage: These two jars:
> >
> > org.apache.maven:maven-plugin-api:jar:3.9.14
> > org.apache.maven:maven-core:jar:3.9.14
> >
> >
> > If you look on the pom, you will see:
> >
> > https://github.com/apache/maven/blob/maven-3.9.x/pom.xml#L138
> >
> > On Thu, Apr 2, 2026 at 7:22 AM Guillaume Nodet <gn...@apache.org> wrote:
> > >
> > > Do you know which jars depend on this plexus-utils 3.6.0 ?
> > >
> > > Le jeu. 2 avr. 2026 à 13:02, Clebert Suconic <cl...@gmail.com>
> > a
> > > écrit :
> > >
> > > > Plexus utils 3.6.0 is affected by a CVE:
> > > >
> > > > https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
> > > >
> > > >
> > > >
> > > > Would be possible to update the dependency by a non affected version
> > > > (I think 3.9.0?) and have a maven 3.9.15 with the upgrade?
> > > >
> > > > I develop a maven plugin and that makes my code to appear in security
> > > > scanners, even though the dependency has a provided scope and is
> > > > downloaded by Maven itself.
> > > >
> > > >
> > > >
> > > > Thank you
> > > >
> > > > --
> > > > Clebert Suconic
> > > >
> > > > ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > > > For additional commands, e-mail: dev-help@maven.apache.org
> > > >
> > > >
> > >
> > > --
> > > ------------------------
> > > Guillaume Nodet
> >
> >
> >
> > --
> > Clebert Suconic
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > For additional commands, e-mail: dev-help@maven.apache.org
> >
> >
>
> --
> Sławomir Jaranowski
--
Clebert Suconic
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
[maven-jar-plugin] Status of 3.5.1 release?
Posted by Jo�o Paulo Sim�es Martins via dev <de...@maven.apache.org>.
Hi everyone,
I noticed that the latest released version of the maven-jar-plugin appears to be 3.5.0<https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-jar-plugin/3.5.0>.
That version is reported as having two CVEs affecting its dependencies, which is currently triggering security warnings in downstream usage.
I also noticed that PR #516<https://github.com/apache/maven-jar-plugin/pull/516#event-21980579791> updates plexus-archiver (from 4.10.4 to 4.11.0) which appears to address the dependency versions flagged by the reported CVEs.
Is there any information about the current status of the next release?
Best regards,
João
Re: Plexus ustils 3.6.0 on bin
Posted by Slawomir Jaranowski <s....@gmail.com>.
Hi,
Fixed for 3.9.15 - https://github.com/apache/maven/milestone/125?closed=1
I add info at
https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
thate plexus-utils 3.6.1 alos has a fix
On Thu, 2 Apr 2026 at 14:24, Clebert Suconic <cl...@gmail.com>
wrote:
> From my line of usage: These two jars:
>
> org.apache.maven:maven-plugin-api:jar:3.9.14
> org.apache.maven:maven-core:jar:3.9.14
>
>
> If you look on the pom, you will see:
>
> https://github.com/apache/maven/blob/maven-3.9.x/pom.xml#L138
>
> On Thu, Apr 2, 2026 at 7:22 AM Guillaume Nodet <gn...@apache.org> wrote:
> >
> > Do you know which jars depend on this plexus-utils 3.6.0 ?
> >
> > Le jeu. 2 avr. 2026 à 13:02, Clebert Suconic <cl...@gmail.com>
> a
> > écrit :
> >
> > > Plexus utils 3.6.0 is affected by a CVE:
> > >
> > > https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
> > >
> > >
> > >
> > > Would be possible to update the dependency by a non affected version
> > > (I think 3.9.0?) and have a maven 3.9.15 with the upgrade?
> > >
> > > I develop a maven plugin and that makes my code to appear in security
> > > scanners, even though the dependency has a provided scope and is
> > > downloaded by Maven itself.
> > >
> > >
> > >
> > > Thank you
> > >
> > > --
> > > Clebert Suconic
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > > For additional commands, e-mail: dev-help@maven.apache.org
> > >
> > >
> >
> > --
> > ------------------------
> > Guillaume Nodet
>
>
>
> --
> Clebert Suconic
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
--
Sławomir Jaranowski
Re: Plexus ustils 3.6.0 on bin
Posted by Clebert Suconic <cl...@gmail.com>.
From my line of usage: These two jars:
org.apache.maven:maven-plugin-api:jar:3.9.14
org.apache.maven:maven-core:jar:3.9.14
If you look on the pom, you will see:
https://github.com/apache/maven/blob/maven-3.9.x/pom.xml#L138
On Thu, Apr 2, 2026 at 7:22 AM Guillaume Nodet <gn...@apache.org> wrote:
>
> Do you know which jars depend on this plexus-utils 3.6.0 ?
>
> Le jeu. 2 avr. 2026 à 13:02, Clebert Suconic <cl...@gmail.com> a
> écrit :
>
> > Plexus utils 3.6.0 is affected by a CVE:
> >
> > https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
> >
> >
> >
> > Would be possible to update the dependency by a non affected version
> > (I think 3.9.0?) and have a maven 3.9.15 with the upgrade?
> >
> > I develop a maven plugin and that makes my code to appear in security
> > scanners, even though the dependency has a provided scope and is
> > downloaded by Maven itself.
> >
> >
> >
> > Thank you
> >
> > --
> > Clebert Suconic
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > For additional commands, e-mail: dev-help@maven.apache.org
> >
> >
>
> --
> ------------------------
> Guillaume Nodet
--
Clebert Suconic
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: Plexus ustils 3.6.0 on bin
Posted by Guillaume Nodet <gn...@apache.org>.
Do you know which jars depend on this plexus-utils 3.6.0 ?
Le jeu. 2 avr. 2026 à 13:02, Clebert Suconic <cl...@gmail.com> a
écrit :
> Plexus utils 3.6.0 is affected by a CVE:
>
> https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
>
>
>
> Would be possible to update the dependency by a non affected version
> (I think 3.9.0?) and have a maven 3.9.15 with the upgrade?
>
> I develop a maven plugin and that makes my code to appear in security
> scanners, even though the dependency has a provided scope and is
> downloaded by Maven itself.
>
>
>
> Thank you
>
> --
> Clebert Suconic
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
--
------------------------
Guillaume Nodet