You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@netbeans.apache.org by "sdedic (via GitHub)" <gi...@apache.org> on 2024/02/05 10:18:06 UTC
[PR] Override conflicting dependencies with the finally used ones. [netbeans]
sdedic opened a new pull request, #7028:
URL: https://github.com/apache/netbeans/pull/7028
There's a bug in Maven dependency reporter. In case of conflicting artifacts, the next children were taken from the real dependency, but the node itself was still added to the tree.
So in case that 4rd party dependency `gson:gson:jar:2.8.6` conflict with project-mandated `2.10.1`, 2.8.6 is actually used by project. Maven reporter implementation traverses below using children from 2.10.1, but `gson:jar:2.8.6` was still included in the tree.
This may cause false vulnerability reports in ADM.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Override conflicting dependencies with the finally used ones. [netbeans]
Posted by "sdedic (via GitHub)" <gi...@apache.org>.
sdedic merged PR #7028:
URL: https://github.com/apache/netbeans/pull/7028
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists