You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "HarshMehta112 (via GitHub)" <gi...@apache.org> on 2025/12/16 12:10:38 UTC
[PR] Fixes :: #1489 :: Add security warnings against version ranges and special version qualifiers [maven-site]
HarshMehta112 opened a new pull request, #1494:
URL: https://github.com/apache/maven-site/pull/1494
Fixes : #1489
Following this checklist to help us incorporate your
contribution quickly and easily:
- [x] Your pull request should address just one issue, without pulling in other changes.
- [x] Each commit in the pull request should have a meaningful subject line and body.
Note that commits might be squashed by a maintainer on merge.
- [x] Run `mvn site` and examine output in `target/site` directory.
Site will also be built on your pull request automatically and attached to GitHub Action result.
If your pull request is about ~20 lines of code you don't need to sign an
[Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf) if you are unsure
please ask on the developers list.
To make clear that you license your contribution under
the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)
you have to acknowledge this by using the following check-box.
- [x] I hereby declare this contribution to be licenced under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)
- [x] In any other case, please file an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fixes :: #1489 :: Add security warnings against version ranges and special version qualifiers [maven-site]
Posted by "elharo (via GitHub)" <gi...@apache.org>.
elharo commented on code in PR #1494:
URL: https://github.com/apache/maven-site/pull/1494#discussion_r2624074605
##########
content/markdown/pom.md:
##########
@@ -314,6 +314,8 @@ Version requirements have the following syntax:
Maven picks the highest version of each project that satisfies all the hard requirements of the dependencies on that project.
If no version satisfies all the hard requirements, the build fails.
+**Security Warning**: The use of version ranges (hard requirements with brackets and parentheses) is **strongly discouraged** due to security concerns. Version ranges introduce unpredictability in builds, can lead to non-reproducible builds, and may unexpectedly pull in vulnerable versions of dependencies. Always prefer using explicit, fixed version numbers for dependencies to ensure build reproducibility and security. For similar reasons, the use of `min` and `max` suffixes in version strings should also be avoided (see [Version Order Specification](#version-order-specification) below).
Review Comment:
No,, this is much worse than system dependencies. It should never have been added and should never be used..
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fixes :: #1489 :: Add security warnings against version ranges and special version qualifiers [maven-site]
Posted by "slachiewicz (via GitHub)" <gi...@apache.org>.
slachiewicz closed pull request #1494: Fixes :: #1489 :: Add security warnings against version ranges and special version qualifiers
URL: https://github.com/apache/maven-site/pull/1494
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fixes :: #1489 :: Add security warnings against version ranges and special version qualifiers [maven-site]
Posted by "Bukama (via GitHub)" <gi...@apache.org>.
Bukama commented on code in PR #1494:
URL: https://github.com/apache/maven-site/pull/1494#discussion_r2623960241
##########
content/markdown/pom.md:
##########
@@ -314,6 +314,8 @@ Version requirements have the following syntax:
Maven picks the highest version of each project that satisfies all the hard requirements of the dependencies on that project.
If no version satisfies all the hard requirements, the build fails.
+**Security Warning**: The use of version ranges (hard requirements with brackets and parentheses) is **strongly discouraged** due to security concerns. Version ranges introduce unpredictability in builds, can lead to non-reproducible builds, and may unexpectedly pull in vulnerable versions of dependencies. Always prefer using explicit, fixed version numbers for dependencies to ensure build reproducibility and security. For similar reasons, the use of `min` and `max` suffixes in version strings should also be avoided (see [Version Order Specification](#version-order-specification) below).
Review Comment:
I would like to only have warning a warning on this page that using those (as well as min/max, latest etc) are not recommended as they can lead to undesired behavior and pulled in artifacts and that we recommend using the enforcer-rule to enforce it. And then link to the page where version ranges are described, which is https://maven.apache.org/enforcer/enforcer-rules/versionRanges.html and which also needs a warning with a more detailed explanation and examples and a link to the rule.
(at @elharo For me it's very similar to the system dependency: Maven support it and there are reasons to use it. Are those special and situations are rare? Yes, but they are there. So Maven should not warn about itself having a security problem, but explain it as best practice to avoid this pitfall. It's not a security problem of Maven, but of every automatic dependency mechanism.
##########
content/markdown/security.md:
##########
@@ -31,6 +31,27 @@ the code, dependencies and repositories that are used in your build.
If you want to use Maven to build untrusted code, it is up to you to
provide the required isolation.
+## Security Best Practices
Review Comment:
I don't see the warning on this page. In my opinion this page is about CVE things.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fixes :: #1489 :: Add security warnings against version ranges and special version qualifiers [maven-site]
Posted by "elharo (via GitHub)" <gi...@apache.org>.
elharo commented on code in PR #1494:
URL: https://github.com/apache/maven-site/pull/1494#discussion_r2624108024
##########
content/markdown/pom.md:
##########
@@ -314,6 +314,8 @@ Version requirements have the following syntax:
Maven picks the highest version of each project that satisfies all the hard requirements of the dependencies on that project.
If no version satisfies all the hard requirements, the build fails.
+**Security Warning**: The use of version ranges (hard requirements with brackets and parentheses) is **strongly discouraged** due to security concerns. Version ranges introduce unpredictability in builds, can lead to non-reproducible builds, and may unexpectedly pull in vulnerable versions of dependencies. Always prefer using explicit, fixed version numbers for dependencies to ensure build reproducibility and security. For similar reasons, the use of `min` and `max` suffixes in version strings should also be avoided (see [Version Order Specification](#version-order-specification) below).
Review Comment:
also, not all uses of brackets and parentheses introduce version ranges. They can also be used to pin a specific version during transitive dependency resolution
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org