You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "Gazy Mahomar (Jira)" <ji...@apache.org> on 2021/10/13 10:03:00 UTC
[jira] [Comment Edited] (MDEP-775) Update velocity-tools from 2.0
to a newer version that doesn't depend on struts 1.3.8
[ https://issues.apache.org/jira/browse/MDEP-775?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17428123#comment-17428123 ]
Gazy Mahomar edited comment on MDEP-775 at 10/13/21, 10:02 AM:
---------------------------------------------------------------
No joy. At this point I'm no longer sure if the issue is coming from this plugin. After checking out the repo and taking a look, it's clear to me that MDEP-626 should have removed all references to struts. I can't tell where it's coming from, other than it's getting re-downloaded any time I run {{dependency:tree}}. Also, {{dependency:resolve-plugins}} shows no plugins that depend (in)directly on struts (and running it also downloads struts), so I'm at a loss.
I honestly think this issue can be closed, unless someone else wants to look into it. Thanks for the quick response and sorry for the noise.
I guess I'll just create a minutely cron job that removes struts from my local repo...
was (Author: gmahomarf):
No joy. At this point I'm no longer sure if the issue is coming from this plugin. After checking out the repo and taking a look, it's clear to me that MDEP-626 should have removed all references to struts. I can't tell where it's coming from, other than it's getting re-downloaded any time I run {{dependency:tree}}. Also, {{dependency:resolve-plugins}} shows no plugins that depend (in)directly on struts (and running it also downloads struts), so I'm at a loss.
I honestly think this issue can be closed, unless someone else wants to look into it. Thanks for the quick response and sorry for the noise.
> Update velocity-tools from 2.0 to a newer version that doesn't depend on struts 1.3.8
> -------------------------------------------------------------------------------------
>
> Key: MDEP-775
> URL: https://issues.apache.org/jira/browse/MDEP-775
> Project: Maven Dependency Plugin
> Issue Type: Dependency upgrade
> Reporter: Gazy Mahomar
> Priority: Major
>
> The Dependency plugin depends on {{org.apache.velocity:velocity-tools:2.0}}, which in turn depends on {{org.apache.struts:struts-core 1.3.8}}. As mentioned in MDEP-626, {{struts-core:1.3.8}} has several CVEs against it. For those of us with overzealous IT departments in corporate environments, this presents a problem, as the {{struts-core:1.3.8}} jar constantly triggers vulnerability checks.
> Would it be possible to update {{velocity-tools}} to a newer version without struts?
--
This message was sent by Atlassian Jira
(v8.3.4#803005)