[PR] Remove vulnerable coordinates from the remaining IT fixtures [maven-dependency-plugin]

["slachiewicz (via GitHub)" <gi...@apache.org>]

slachiewicz opened a new pull request, #1724:
URL: https://github.com/apache/maven-dependency-plugin/pull/1724

   Clears the last five Dependabot alerts, all in IT fixtures, without changing what the tests cover.
   
   - `list-repositories` and `copy-dependencies-with-conflict` now depend on mock POMs served by mrm instead of maven-core 3.2.5 and `org.jdom:jdom` (which has no fixed release). The mock dependency declares the `sonatype-nexus-snapshots` repository that previously came from maven-core's parent chain; it needs a child node because the collector attaches a POM's repositories to that POM's dependencies.
   - `tree-verbose` bumps batik-bridge 1.7 → 1.19. Batik only contributed the "omitted for duplicate" diamond, which the new tree keeps; the managed-version and conflict cases come from maven-project 2.0.6.
   
   Verified: `mvn -P run-its verify` on the three ITs with a clean `target` → passed under Maven 3.9.16 and 4.0.0-rc-7 (`tree-verbose` also under 3.9.0).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Remove vulnerable coordinates from the remaining IT fixtures [maven-dependency-plugin]

["slachiewicz (via GitHub)" <gi...@apache.org>]

slachiewicz merged PR #1724:
URL: https://github.com/apache/maven-dependency-plugin/pull/1724


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org