You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maven.apache.org by sl...@apache.org on 2026/10/05 20:02:41 UTC
(maven-resolver-ant-tasks) 01/01: Ignore plexus-cipher 2.1.0 and later in Dependabot
This is an automated email from the ASF dual-hosted git repository.
slachiewicz pushed a commit to branch agent/dependabot-ignore-plexus-cipher
in repository https://gitbox.apache.org/repos/asf/maven-resolver-ant-tasks.git
commit 876f54a5b09f4dc8a16fe56aa39c1c0b19bfd6af
Author: Sylwester Lachiewicz <sl...@apache.org>
AuthorDate: Mon Oct 5 22:02:31 2026 +0200
Ignore plexus-cipher 2.1.0 and later in Dependabot
---
.github/dependabot.yml | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 96546c3..a7cd02e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -24,6 +24,10 @@ updates:
# JUnit 6 requires Java 17; the build still runs on JDK 8
- dependency-name: "org.junit*"
versions: [">= 6.0.0"]
+ # plexus-cipher 2.1.0 changed the KDF, so passwords encrypted for Maven 3
+ # no longer decrypt; 3.0.0 also drops org.sonatype.plexus.components.cipher
+ - dependency-name: "org.codehaus.plexus:plexus-cipher"
+ versions: [">= 2.1.0"]
- package-ecosystem: "github-actions"
directory: "/"
schedule: