Skip to content

Bump vulnerable versions in IT fixtures where the version is incidental #1723

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
slachiewicz merged 1 commit into from
Oct 7, 2026
Merged

Bump vulnerable versions in IT fixtures where the version is incidental #1723

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/it/projects/analyze-ignore-used-undeclared-dependency/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-core</artifactId>
<version>3.0</version>
<version>3.9.16</version>
</dependency>
</dependencies>

Expand Down
2 changes: 1 addition & 1 deletion src/it/projects/mdep-689-apply-filtering-go-offline-goal/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ under the License.
<dependency> <!-- excluded by excludeClassifier -->
<groupId>ch.qos.logback</groupId>
<artifactId>logback-core</artifactId>
<version>1.5.6</version>
<version>1.5.34</version>
<classifier>skipThisClassifierToo</classifier>
</dependency>
<dependency><!-- should not be excluded -->
Expand Down
66 changes: 31 additions & 35 deletions src/it/projects/tree-scope/expected1-v4.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,37 +1,33 @@
org.apache.maven.its.dependency:test:jar:1.0-SNAPSHOT
\- org.apache.maven:maven-core:jar:3.6.3:compile
+- org.apache.maven:maven-model:jar:3.6.3:compile
+- org.apache.maven:maven-settings:jar:3.6.3:compile
+- org.apache.maven:maven-settings-builder:jar:3.6.3:compile
| +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
| \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
| \- org.sonatype.plexus:plexus-cipher:jar:1.7:compile
+- org.apache.maven:maven-builder-support:jar:3.6.3:compile
+- org.apache.maven:maven-repository-metadata:jar:3.6.3:compile
+- org.apache.maven:maven-artifact:jar:3.6.3:compile
+- org.apache.maven:maven-plugin-api:jar:3.6.3:compile
+- org.apache.maven:maven-model-builder:jar:3.6.3:compile
+- org.apache.maven:maven-resolver-provider:jar:3.6.3:compile
+- org.apache.maven.resolver:maven-resolver-impl:jar:1.4.1:compile
+- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
+- org.apache.maven.resolver:maven-resolver-spi:jar:1.4.1:compile
+- org.apache.maven.resolver:maven-resolver-util:jar:1.4.1:compile
+- org.apache.maven.shared:maven-shared-utils:jar:3.2.1:compile
| \- commons-io:commons-io:jar:2.5:compile
+- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
| \- javax.enterprise:cdi-api:jar:1.0:compile
| \- javax.annotation:jsr250-api:jar:1.0:compile
+- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.3.4:compile
+- com.google.inject:guice:jar:no_aop:4.2.1:compile
| +- aopalliance:aopalliance:jar:1.0:compile
| \- com.google.guava:guava:jar:25.1-android:compile
| +- com.google.code.findbugs:jsr305:jar:3.0.1:compile
| +- org.checkerframework:checker-compat-qual:jar:2.0.0:compile
| +- com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
| +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
| \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
\- org.apache.maven:maven-core:jar:3.9.16:compile
+- org.apache.maven:maven-model:jar:3.9.16:compile
+- org.apache.maven:maven-settings:jar:3.9.16:compile
+- org.apache.maven:maven-settings-builder:jar:3.9.16:compile
| \- org.codehaus.plexus:plexus-sec-dispatcher:jar:2.0:compile
| \- org.codehaus.plexus:plexus-cipher:jar:2.0:compile
+- org.apache.maven:maven-builder-support:jar:3.9.16:compile
+- org.apache.maven:maven-repository-metadata:jar:3.9.16:compile
+- org.apache.maven:maven-artifact:jar:3.9.16:compile
+- org.apache.maven:maven-plugin-api:jar:3.9.16:compile
+- org.apache.maven:maven-model-builder:jar:3.9.16:compile
+- org.apache.maven:maven-resolver-provider:jar:3.9.16:compile
+- org.apache.maven.resolver:maven-resolver-impl:jar:1.9.27:compile
| \- org.apache.maven.resolver:maven-resolver-named-locks:jar:1.9.27:compile
+- org.apache.maven.resolver:maven-resolver-api:jar:1.9.27:compile
+- org.apache.maven.resolver:maven-resolver-spi:jar:1.9.27:compile
+- org.apache.maven.resolver:maven-resolver-util:jar:1.9.27:compile
+- org.apache.maven.shared:maven-shared-utils:jar:3.4.2:compile
+- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:1.0.0:compile
+- org.eclipse.sisu:org.eclipse.sisu.inject:jar:1.0.0:compile
+- org.ow2.asm:asm:jar:9.9.1:compile
+- com.google.inject:guice:jar:classes:5.1.0:compile
| \- aopalliance:aopalliance:jar:1.0:compile
+- com.google.guava:guava:jar:33.6.0-jre:compile
| \- org.jspecify:jspecify:jar:1.0.0:compile
+- com.google.guava:failureaccess:jar:1.0.3:compile
+- javax.inject:javax.inject:jar:1:compile
+- org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
+- org.codehaus.plexus:plexus-classworlds:jar:2.6.0:compile
+- org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
\- org.apache.commons:commons-lang3:jar:3.8.1:compile
+- org.codehaus.plexus:plexus-utils:jar:3.6.1:compile
+- org.codehaus.plexus:plexus-classworlds:jar:2.11.0:compile
+- org.codehaus.plexus:plexus-interpolation:jar:1.29:compile
+- org.codehaus.plexus:plexus-component-annotations:jar:2.2.0:compile
\- org.slf4j:slf4j-api:jar:1.7.36:compile
66 changes: 31 additions & 35 deletions src/it/projects/tree-scope/expected1.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,37 +1,33 @@
org.apache.maven.its.dependency:test:jar:1.0-SNAPSHOT
\- org.apache.maven:maven-core:jar:3.6.3:compile
+- org.apache.maven:maven-model:jar:3.6.3:compile
+- org.apache.maven:maven-settings:jar:3.6.3:compile
+- org.apache.maven:maven-settings-builder:jar:3.6.3:compile
| +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
| \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
| \- org.sonatype.plexus:plexus-cipher:jar:1.4:compile
+- org.apache.maven:maven-builder-support:jar:3.6.3:compile
+- org.apache.maven:maven-repository-metadata:jar:3.6.3:compile
+- org.apache.maven:maven-artifact:jar:3.6.3:compile
+- org.apache.maven:maven-plugin-api:jar:3.6.3:compile
+- org.apache.maven:maven-model-builder:jar:3.6.3:compile
+- org.apache.maven:maven-resolver-provider:jar:3.6.3:compile
+- org.apache.maven.resolver:maven-resolver-impl:jar:1.4.1:compile
+- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
+- org.apache.maven.resolver:maven-resolver-spi:jar:1.4.1:compile
+- org.apache.maven.resolver:maven-resolver-util:jar:1.4.1:compile
+- org.apache.maven.shared:maven-shared-utils:jar:3.2.1:compile
| \- commons-io:commons-io:jar:2.5:compile
+- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
| \- javax.enterprise:cdi-api:jar:1.0:compile
| \- javax.annotation:jsr250-api:jar:1.0:compile
+- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.3.4:compile
+- com.google.inject:guice:jar:no_aop:4.2.1:compile
| +- aopalliance:aopalliance:jar:1.0:compile
| \- com.google.guava:guava:jar:25.1-android:compile
| +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
| +- org.checkerframework:checker-compat-qual:jar:2.0.0:compile
| +- com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
| +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
| \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
\- org.apache.maven:maven-core:jar:3.9.16:compile
+- org.apache.maven:maven-model:jar:3.9.16:compile
+- org.apache.maven:maven-settings:jar:3.9.16:compile
+- org.apache.maven:maven-settings-builder:jar:3.9.16:compile
| \- org.codehaus.plexus:plexus-sec-dispatcher:jar:2.0:compile
| \- org.codehaus.plexus:plexus-cipher:jar:2.0:compile
+- org.apache.maven:maven-builder-support:jar:3.9.16:compile
+- org.apache.maven:maven-repository-metadata:jar:3.9.16:compile
+- org.apache.maven:maven-artifact:jar:3.9.16:compile
+- org.apache.maven:maven-plugin-api:jar:3.9.16:compile
+- org.apache.maven:maven-model-builder:jar:3.9.16:compile
+- org.apache.maven:maven-resolver-provider:jar:3.9.16:compile
+- org.apache.maven.resolver:maven-resolver-impl:jar:1.9.27:compile
| \- org.apache.maven.resolver:maven-resolver-named-locks:jar:1.9.27:compile
+- org.apache.maven.resolver:maven-resolver-api:jar:1.9.27:compile
+- org.apache.maven.resolver:maven-resolver-spi:jar:1.9.27:compile
+- org.apache.maven.resolver:maven-resolver-util:jar:1.9.27:compile
+- org.apache.maven.shared:maven-shared-utils:jar:3.4.2:compile
+- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:1.0.0:compile
+- org.eclipse.sisu:org.eclipse.sisu.inject:jar:1.0.0:compile
+- org.ow2.asm:asm:jar:9.9.1:compile
+- com.google.inject:guice:jar:classes:5.1.0:compile
| \- aopalliance:aopalliance:jar:1.0:compile
+- com.google.guava:guava:jar:33.6.0-jre:compile
| \- org.jspecify:jspecify:jar:1.0.0:compile
+- com.google.guava:failureaccess:jar:1.0.3:compile
+- javax.inject:javax.inject:jar:1:compile
+- org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
+- org.codehaus.plexus:plexus-classworlds:jar:2.6.0:compile
+- org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
\- org.apache.commons:commons-lang3:jar:3.8.1:compile
+- org.codehaus.plexus:plexus-utils:jar:3.6.1:compile
+- org.codehaus.plexus:plexus-classworlds:jar:2.11.0:compile
+- org.codehaus.plexus:plexus-interpolation:jar:1.29:compile
+- org.codehaus.plexus:plexus-component-annotations:jar:2.2.0:compile
\- org.slf4j:slf4j-api:jar:1.7.36:compile
67 changes: 31 additions & 36 deletions src/it/projects/tree-scope/expected2-v4.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,39 +1,34 @@
org.apache.maven.its.dependency:test:jar:1.0-SNAPSHOT
+- org.apache.maven:maven-core:jar:3.6.3:compile
| +- org.apache.maven:maven-model:jar:3.6.3:compile
| +- org.apache.maven:maven-settings:jar:3.6.3:compile
| +- org.apache.maven:maven-settings-builder:jar:3.6.3:compile
| | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
| | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
| | \- org.sonatype.plexus:plexus-cipher:jar:1.7:compile
| +- org.apache.maven:maven-builder-support:jar:3.6.3:compile
| +- org.apache.maven:maven-repository-metadata:jar:3.6.3:compile
| +- org.apache.maven:maven-artifact:jar:3.6.3:compile
| +- org.apache.maven:maven-plugin-api:jar:3.6.3:compile
| +- org.apache.maven:maven-model-builder:jar:3.6.3:compile
| +- org.apache.maven:maven-resolver-provider:jar:3.6.3:compile
| +- org.apache.maven.resolver:maven-resolver-impl:jar:1.4.1:compile
| +- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
| +- org.apache.maven.resolver:maven-resolver-spi:jar:1.4.1:compile
| +- org.apache.maven.resolver:maven-resolver-util:jar:1.4.1:compile
| +- org.apache.maven.shared:maven-shared-utils:jar:3.2.1:compile
| | \- commons-io:commons-io:jar:2.5:compile
| +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
| | \- javax.enterprise:cdi-api:jar:1.0:compile
| | \- javax.annotation:jsr250-api:jar:1.0:compile
| +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.3.4:compile
| +- com.google.inject:guice:jar:no_aop:4.2.1:compile
| | +- aopalliance:aopalliance:jar:1.0:compile
| | \- com.google.guava:guava:jar:25.1-android:compile
| | +- com.google.code.findbugs:jsr305:jar:3.0.1:compile
| | +- org.checkerframework:checker-compat-qual:jar:2.0.0:compile
| | +- com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
| | +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
| | \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
+- org.apache.maven:maven-core:jar:3.9.16:compile
| +- org.apache.maven:maven-model:jar:3.9.16:compile
| +- org.apache.maven:maven-settings:jar:3.9.16:compile
| +- org.apache.maven:maven-settings-builder:jar:3.9.16:compile
| | \- org.codehaus.plexus:plexus-sec-dispatcher:jar:2.0:compile
| | \- org.codehaus.plexus:plexus-cipher:jar:2.0:compile
| +- org.apache.maven:maven-builder-support:jar:3.9.16:compile
| +- org.apache.maven:maven-repository-metadata:jar:3.9.16:compile
| +- org.apache.maven:maven-artifact:jar:3.9.16:compile
| +- org.apache.maven:maven-plugin-api:jar:3.9.16:compile
| +- org.apache.maven:maven-model-builder:jar:3.9.16:compile
| +- org.apache.maven:maven-resolver-provider:jar:3.9.16:compile
| +- org.apache.maven.resolver:maven-resolver-impl:jar:1.9.27:compile
| | \- org.apache.maven.resolver:maven-resolver-named-locks:jar:1.9.27:compile
| +- org.apache.maven.resolver:maven-resolver-api:jar:1.9.27:compile
| +- org.apache.maven.resolver:maven-resolver-spi:jar:1.9.27:compile
| +- org.apache.maven.resolver:maven-resolver-util:jar:1.9.27:compile
| +- org.apache.maven.shared:maven-shared-utils:jar:3.4.2:compile
| +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:1.0.0:compile
| +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:1.0.0:compile
| +- org.ow2.asm:asm:jar:9.9.1:compile
| +- com.google.inject:guice:jar:classes:5.1.0:compile
| | \- aopalliance:aopalliance:jar:1.0:compile
| +- com.google.guava:guava:jar:33.6.0-jre:compile
| | \- org.jspecify:jspecify:jar:1.0.0:compile
| +- com.google.guava:failureaccess:jar:1.0.3:compile
| +- javax.inject:javax.inject:jar:1:compile
| +- org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
| +- org.codehaus.plexus:plexus-classworlds:jar:2.6.0:compile
| +- org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
| \- org.apache.commons:commons-lang3:jar:3.8.1:compile
| +- org.codehaus.plexus:plexus-utils:jar:3.6.1:compile
| +- org.codehaus.plexus:plexus-classworlds:jar:2.11.0:compile
| +- org.codehaus.plexus:plexus-interpolation:jar:1.29:compile
| +- org.codehaus.plexus:plexus-component-annotations:jar:2.2.0:compile
| \- org.slf4j:slf4j-api:jar:1.7.36:compile
\- org.slf4j:slf4j-simple:jar:2.0.13:test
\- org.slf4j:slf4j-api:jar:2.0.13:compile
67 changes: 31 additions & 36 deletions src/it/projects/tree-scope/expected2.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,39 +1,34 @@
org.apache.maven.its.dependency:test:jar:1.0-SNAPSHOT
+- org.apache.maven:maven-core:jar:3.6.3:compile
| +- org.apache.maven:maven-model:jar:3.6.3:compile
| +- org.apache.maven:maven-settings:jar:3.6.3:compile
| +- org.apache.maven:maven-settings-builder:jar:3.6.3:compile
| | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
| | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
| | \- org.sonatype.plexus:plexus-cipher:jar:1.4:compile
| +- org.apache.maven:maven-builder-support:jar:3.6.3:compile
| +- org.apache.maven:maven-repository-metadata:jar:3.6.3:compile
| +- org.apache.maven:maven-artifact:jar:3.6.3:compile
| +- org.apache.maven:maven-plugin-api:jar:3.6.3:compile
| +- org.apache.maven:maven-model-builder:jar:3.6.3:compile
| +- org.apache.maven:maven-resolver-provider:jar:3.6.3:compile
| +- org.apache.maven.resolver:maven-resolver-impl:jar:1.4.1:compile
| +- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
| +- org.apache.maven.resolver:maven-resolver-spi:jar:1.4.1:compile
| +- org.apache.maven.resolver:maven-resolver-util:jar:1.4.1:compile
| +- org.apache.maven.shared:maven-shared-utils:jar:3.2.1:compile
| | \- commons-io:commons-io:jar:2.5:compile
| +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
| | \- javax.enterprise:cdi-api:jar:1.0:compile
| | \- javax.annotation:jsr250-api:jar:1.0:compile
| +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.3.4:compile
| +- com.google.inject:guice:jar:no_aop:4.2.1:compile
| | +- aopalliance:aopalliance:jar:1.0:compile
| | \- com.google.guava:guava:jar:25.1-android:compile
| | +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
| | +- org.checkerframework:checker-compat-qual:jar:2.0.0:compile
| | +- com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
| | +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
| | \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
+- org.apache.maven:maven-core:jar:3.9.16:compile
| +- org.apache.maven:maven-model:jar:3.9.16:compile
| +- org.apache.maven:maven-settings:jar:3.9.16:compile
| +- org.apache.maven:maven-settings-builder:jar:3.9.16:compile
| | \- org.codehaus.plexus:plexus-sec-dispatcher:jar:2.0:compile
| | \- org.codehaus.plexus:plexus-cipher:jar:2.0:compile
| +- org.apache.maven:maven-builder-support:jar:3.9.16:compile
| +- org.apache.maven:maven-repository-metadata:jar:3.9.16:compile
| +- org.apache.maven:maven-artifact:jar:3.9.16:compile
| +- org.apache.maven:maven-plugin-api:jar:3.9.16:compile
| +- org.apache.maven:maven-model-builder:jar:3.9.16:compile
| +- org.apache.maven:maven-resolver-provider:jar:3.9.16:compile
| +- org.apache.maven.resolver:maven-resolver-impl:jar:1.9.27:compile
| | \- org.apache.maven.resolver:maven-resolver-named-locks:jar:1.9.27:compile
| +- org.apache.maven.resolver:maven-resolver-api:jar:1.9.27:compile
| +- org.apache.maven.resolver:maven-resolver-spi:jar:1.9.27:compile
| +- org.apache.maven.resolver:maven-resolver-util:jar:1.9.27:compile
| +- org.apache.maven.shared:maven-shared-utils:jar:3.4.2:compile
| +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:1.0.0:compile
| +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:1.0.0:compile
| +- org.ow2.asm:asm:jar:9.9.1:compile
| +- com.google.inject:guice:jar:classes:5.1.0:compile
| | \- aopalliance:aopalliance:jar:1.0:compile
| +- com.google.guava:guava:jar:33.6.0-jre:compile
| | \- org.jspecify:jspecify:jar:1.0.0:compile
| +- com.google.guava:failureaccess:jar:1.0.3:compile
| +- javax.inject:javax.inject:jar:1:compile
| +- org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
| +- org.codehaus.plexus:plexus-classworlds:jar:2.6.0:compile
| +- org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
| \- org.apache.commons:commons-lang3:jar:3.8.1:compile
| +- org.codehaus.plexus:plexus-utils:jar:3.6.1:compile
| +- org.codehaus.plexus:plexus-classworlds:jar:2.11.0:compile
| +- org.codehaus.plexus:plexus-interpolation:jar:1.29:compile
| +- org.codehaus.plexus:plexus-component-annotations:jar:2.2.0:compile
| \- org.slf4j:slf4j-api:jar:1.7.36:compile
\- org.slf4j:slf4j-simple:jar:2.0.13:test
\- org.slf4j:slf4j-api:jar:2.0.13:compile
2 changes: 1 addition & 1 deletion src/it/projects/tree-scope/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-core</artifactId>
<version>3.6.3</version>
<version>3.9.16</version>
</dependency>

<dependency>
Expand Down
Loading
Loading