From 9aae1cdc642cc50f9bb0e54a9aaf2f2698f31b80 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Wed, 7 Oct 2026 22:24:12 +0200
Subject: [PATCH 1/3] Serve the list-repositories IT dependency from the mock
 repository

The fixture only needs a dependency whose POM declares a repository, so
that list-repositories reports it as mirrored. maven-core 3.2.5 provided
that through oss-parent in its POM chain and carries GHSA-2f88-5hg8-9x2x.
The collector attaches descriptor repositories to the child nodes, so the
mock dependency needs a transitive leaf for the repository to show up.
---
 .../repository/list-repositories-dep-1.0.pom  | 51 +++++++++++++++++++
 .../repository/list-repositories-leaf-1.0.pom | 30 +++++++++++
 src/it/projects/list-repositories/pom.xml     |  6 +--
 3 files changed, 84 insertions(+), 3 deletions(-)
 create mode 100644 src/it/mrm/repository/list-repositories-dep-1.0.pom
 create mode 100644 src/it/mrm/repository/list-repositories-leaf-1.0.pom

diff --git a/src/it/mrm/repository/list-repositories-dep-1.0.pom b/src/it/mrm/repository/list-repositories-dep-1.0.pom
new file mode 100644
index 000000000..ca128787f
--- /dev/null
+++ b/src/it/mrm/repository/list-repositories-dep-1.0.pom
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>org.apache.maven.its.dependency</groupId>
+  <artifactId>list-repositories-dep</artifactId>
+  <version>1.0</version>
+
+  <!-- a dependency whose POM brings its own repository; the collector attaches it to the nodes below, so list-repositories reports it (mirrored) through list-repositories-leaf -->
+  <repositories>
+    <repository>
+      <id>sonatype-nexus-snapshots</id>
+      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
+      <releases>
+        <enabled>false</enabled>
+      </releases>
+      <snapshots>
+        <enabled>true</enabled>
+      </snapshots>
+    </repository>
+  </repositories>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.apache.maven.its.dependency</groupId>
+      <artifactId>list-repositories-leaf</artifactId>
+      <version>1.0</version>
+    </dependency>
+  </dependencies>
+</project>
diff --git a/src/it/mrm/repository/list-repositories-leaf-1.0.pom b/src/it/mrm/repository/list-repositories-leaf-1.0.pom
new file mode 100644
index 000000000..dfa8d6c6d
--- /dev/null
+++ b/src/it/mrm/repository/list-repositories-leaf-1.0.pom
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <!-- transitive dependency of list-repositories-dep: the repository that POM declares applies to this node -->
+  <groupId>org.apache.maven.its.dependency</groupId>
+  <artifactId>list-repositories-leaf</artifactId>
+  <version>1.0</version>
+</project>
diff --git a/src/it/projects/list-repositories/pom.xml b/src/it/projects/list-repositories/pom.xml
index 10847069a..3ce2dc871 100644
--- a/src/it/projects/list-repositories/pom.xml
+++ b/src/it/projects/list-repositories/pom.xml
@@ -52,9 +52,9 @@
 
   <dependencies>
     <dependency>
-      <groupId>org.apache.maven</groupId>
-      <artifactId>maven-core</artifactId>
-      <version>3.2.5</version>
+      <groupId>org.apache.maven.its.dependency</groupId>
+      <artifactId>list-repositories-dep</artifactId>
+      <version>1.0</version>
     </dependency>
   </dependencies>
 

From c31a418f07389f462ef76b5aaecd8b03b1ade086 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Wed, 7 Oct 2026 22:22:05 +0200
Subject: [PATCH 2/3] Use mock artifacts in the copy-dependencies-with-conflict
 IT

The test needs two artifacts that share artifactId and version under
different groupIds; which artifacts they are does not matter, so serve
them from the mrm mock repository instead of org.jdom:jdom 1.1.3, which
carries an unfixable Dependabot alert (GHSA-2363-cqg2-863c).
---
 src/it/mrm/repository/conflict-a-1.0.pom      | 30 +++++++++++++++++++
 src/it/mrm/repository/conflict-b-1.0.pom      | 30 +++++++++++++++++++
 .../copy-dependencies-with-conflict/pom.xml   | 12 ++++----
 .../verify.groovy                             | 10 +++----
 4 files changed, 71 insertions(+), 11 deletions(-)
 create mode 100644 src/it/mrm/repository/conflict-a-1.0.pom
 create mode 100644 src/it/mrm/repository/conflict-b-1.0.pom

diff --git a/src/it/mrm/repository/conflict-a-1.0.pom b/src/it/mrm/repository/conflict-a-1.0.pom
new file mode 100644
index 000000000..8a055a513
--- /dev/null
+++ b/src/it/mrm/repository/conflict-a-1.0.pom
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <!-- same artifactId and version as conflict-b-1.0.pom: two artifacts that map to the same file name -->
+  <groupId>org.apache.maven.its.dependency.a</groupId>
+  <artifactId>conflict</artifactId>
+  <version>1.0</version>
+</project>
diff --git a/src/it/mrm/repository/conflict-b-1.0.pom b/src/it/mrm/repository/conflict-b-1.0.pom
new file mode 100644
index 000000000..1416e34df
--- /dev/null
+++ b/src/it/mrm/repository/conflict-b-1.0.pom
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <!-- same artifactId and version as conflict-a-1.0.pom: two artifacts that map to the same file name -->
+  <groupId>org.apache.maven.its.dependency.b</groupId>
+  <artifactId>conflict</artifactId>
+  <version>1.0</version>
+</project>
diff --git a/src/it/projects/copy-dependencies-with-conflict/pom.xml b/src/it/projects/copy-dependencies-with-conflict/pom.xml
index b7c6cf627..bde979a44 100644
--- a/src/it/projects/copy-dependencies-with-conflict/pom.xml
+++ b/src/it/projects/copy-dependencies-with-conflict/pom.xml
@@ -36,14 +36,14 @@
   <dependencies>
   <!-- need two deps that have same version and artifact ID but different group ID -->
     <dependency>
-      <groupId>org.jdom</groupId>
-      <artifactId>jdom</artifactId>
-      <version>1.1.3</version>
+      <groupId>org.apache.maven.its.dependency.a</groupId>
+      <artifactId>conflict</artifactId>
+      <version>1.0</version>
     </dependency>
     <dependency>
-      <groupId>org.lucee</groupId>
-      <artifactId>jdom</artifactId>
-      <version>1.1.3</version>
+      <groupId>org.apache.maven.its.dependency.b</groupId>
+      <artifactId>conflict</artifactId>
+      <version>1.0</version>
     </dependency>
   </dependencies>
 
diff --git a/src/it/projects/copy-dependencies-with-conflict/verify.groovy b/src/it/projects/copy-dependencies-with-conflict/verify.groovy
index b66deb089..5405439d7 100644
--- a/src/it/projects/copy-dependencies-with-conflict/verify.groovy
+++ b/src/it/projects/copy-dependencies-with-conflict/verify.groovy
@@ -22,10 +22,10 @@ assert file.exists()
 
 String buildLog = file.getText( "UTF-8" )
 assert buildLog.contains( '[WARNING] Overwriting ' )
-assert buildLog.contains( '[DEBUG] Copying artifact \'org.jdom:jdom:jar:1.1.3\'' )
-assert buildLog.contains( '[DEBUG] Copying artifact \'org.jdom:jdom:pom:1.1.3\'' )
-assert buildLog.contains( '[DEBUG] Copying artifact \'org.jdom:jdom:jar:1.1.3\'' )
-assert buildLog.contains( '[DEBUG] Copying artifact \'org.lucee:jdom:jar:1.1.3\'' )
-assert buildLog.contains( '[WARNING] Multiple files with the name jdom-1.1.3.jar in the dependency tree.' )
+assert buildLog.contains( '[DEBUG] Copying artifact \'org.apache.maven.its.dependency.a:conflict:jar:1.0\'' )
+assert buildLog.contains( '[DEBUG] Copying artifact \'org.apache.maven.its.dependency.a:conflict:pom:1.0\'' )
+assert buildLog.contains( '[DEBUG] Copying artifact \'org.apache.maven.its.dependency.a:conflict:jar:1.0\'' )
+assert buildLog.contains( '[DEBUG] Copying artifact \'org.apache.maven.its.dependency.b:conflict:jar:1.0\'' )
+assert buildLog.contains( '[WARNING] Multiple files with the name conflict-1.0.jar in the dependency tree.' )
 
 return true

From d00cc6b3ea6040e88b2e36e0655b973a2fb7f12d Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Wed, 7 Oct 2026 22:22:05 +0200
Subject: [PATCH 3/3] Bump batik-bridge to 1.19 in the tree-verbose IT

batik-bridge only supplies the diamond of 'omitted for duplicate' nodes
below maven-project's managed/conflict cases; 1.19 keeps that coverage
and clears GHSA-rwqr-m72q-v6cm, GHSA-53jm-3hc9-fqqc and GHSA-gq5f-xv48-2365.
Goldens regenerated under Maven 3.9.16 (identical on 3.9.0) and 4.0.0-rc-7.
---
 src/it/projects/tree-verbose/expected-v4.txt | 116 ++++++++++---------
 src/it/projects/tree-verbose/expected.txt    | 116 ++++++++++---------
 src/it/projects/tree-verbose/pom.xml         |   2 +-
 3 files changed, 123 insertions(+), 111 deletions(-)

diff --git a/src/it/projects/tree-verbose/expected-v4.txt b/src/it/projects/tree-verbose/expected-v4.txt
index e0095ea97..2942c80a5 100644
--- a/src/it/projects/tree-verbose/expected-v4.txt
+++ b/src/it/projects/tree-verbose/expected-v4.txt
@@ -27,63 +27,69 @@ org.apache.maven.its.dependency:tree-verbose:jar:1.0-SNAPSHOT
 |  \- (org.codehaus.plexus:plexus-container-default:jar:1.0-alpha-9:test - omitted for conflict with 1.0-alpha-9-stable-1)
 +- org.apache.maven:maven-model:jar:2.0.7:runtime
 |  \- (org.codehaus.plexus:plexus-utils:jar:1.4.1:runtime - omitted for duplicate)
-\- org.apache.xmlgraphics:batik-bridge:jar:1.7:compile
-   +- org.apache.xmlgraphics:batik-anim:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-dom:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-parser:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-svg-dom:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
+\- org.apache.xmlgraphics:batik-bridge:jar:1.19:compile
+   +- org.apache.xmlgraphics:batik-anim:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-css:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-dom:jar:1.19:compile - omitted for duplicate)
+   |  +- org.apache.xmlgraphics:batik-ext:jar:1.19:compile
+   |  |  \- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-parser:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-svg-dom:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
    |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-awt-util:jar:1.7:compile
-   |  \- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-css:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-awt-util:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   |  \- (org.apache.xmlgraphics:xmlgraphics-commons:jar:2.11:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-css:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:xmlgraphics-commons:jar:2.11:compile - omitted for duplicate)
    |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-dom:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-css:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-xml:jar:1.7:compile - omitted for duplicate)
-   |  +- (xalan:xalan:jar:2.6.0:compile - omitted for duplicate)
-   |  +- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-dom:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-css:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-xml:jar:1.19:compile - omitted for duplicate)
+   |  +- xml-apis:xml-apis:jar:1.4.01:compile
    |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-ext:jar:1.7:compile
-   |  \- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-gvt:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  \- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-parser:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  \- (org.apache.xmlgraphics:batik-xml:jar:1.7:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-script:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-dom:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-svg-dom:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  +- org.apache.xmlgraphics:batik-js:jar:1.7:compile
-   |  |  \- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
-   |  \- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-svg-dom:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-anim:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-css:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-dom:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-parser:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-gvt:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  \- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-parser:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-xml:jar:1.19:compile - omitted for duplicate)
    |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-util:jar:1.7:compile
-   +- org.apache.xmlgraphics:batik-xml:jar:1.7:compile
-   |  \- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   +- xalan:xalan:jar:2.6.0:compile
-   |  \- (xml-apis:xml-apis:jar:1.0.b2:compile - omitted for conflict with 1.3.04)
-   +- xml-apis:xml-apis:jar:1.3.04:compile
+   +- org.apache.xmlgraphics:batik-script:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-anim:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  \- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile
+   +- org.apache.xmlgraphics:batik-svg-dom:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-css:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-dom:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-parser:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-util:jar:1.19:compile
+   |  +- org.apache.xmlgraphics:batik-constants:jar:1.19:compile
+   |  |  \- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- org.apache.xmlgraphics:batik-i18n:jar:1.19:compile
+   |  |  \- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  \- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-xml:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  \- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:xmlgraphics-commons:jar:2.11:compile
+   |  +- commons-io:commons-io:jar:2.17.0:compile
+   |  \- commons-logging:commons-logging:jar:1.3.0:compile
    \- xml-apis:xml-apis-ext:jar:1.3.04:compile
diff --git a/src/it/projects/tree-verbose/expected.txt b/src/it/projects/tree-verbose/expected.txt
index c272b0044..70f18128d 100644
--- a/src/it/projects/tree-verbose/expected.txt
+++ b/src/it/projects/tree-verbose/expected.txt
@@ -27,63 +27,69 @@ org.apache.maven.its.dependency:tree-verbose:jar:1.0-SNAPSHOT
 |  \- (org.codehaus.plexus:plexus-container-default:jar:1.0-alpha-9:test - omitted for conflict with 1.0-alpha-9-stable-1)
 +- org.apache.maven:maven-model:jar:2.0.7:runtime
 |  \- (org.codehaus.plexus:plexus-utils:jar:1.4.1:runtime - omitted for duplicate)
-\- org.apache.xmlgraphics:batik-bridge:jar:1.7:compile
-   +- org.apache.xmlgraphics:batik-anim:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-dom:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-parser:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-svg-dom:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
+\- org.apache.xmlgraphics:batik-bridge:jar:1.19:compile
+   +- org.apache.xmlgraphics:batik-anim:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-css:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-dom:jar:1.19:compile - omitted for duplicate)
+   |  +- org.apache.xmlgraphics:batik-ext:jar:1.19:compile
+   |  |  \- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-parser:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-svg-dom:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
    |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-awt-util:jar:1.7:compile
-   |  \- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-css:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-awt-util:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   |  \- (org.apache.xmlgraphics:xmlgraphics-commons:jar:2.11:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-css:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:xmlgraphics-commons:jar:2.11:compile - omitted for duplicate)
    |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-dom:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-css:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-xml:jar:1.7:compile - omitted for duplicate)
-   |  +- (xalan:xalan:jar:2.6.0:compile - omitted for duplicate)
-   |  +- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-dom:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-css:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-xml:jar:1.19:compile - omitted for duplicate)
+   |  +- xml-apis:xml-apis:jar:1.4.01:compile
    |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-ext:jar:1.7:compile
-   |  \- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-gvt:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  \- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-parser:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  \- (org.apache.xmlgraphics:batik-xml:jar:1.7:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-script:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-dom:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-svg-dom:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  +- org.apache.xmlgraphics:batik-js:jar:1.7:compile
-   |  |  \- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
-   |  \- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-svg-dom:jar:1.7:compile
-   |  +- (org.apache.xmlgraphics:batik-anim:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-css:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-dom:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-parser:jar:1.7:compile - omitted for duplicate)
-   |  +- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   |  +- (xml-apis:xml-apis:jar:1.3.04:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-gvt:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  \- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-parser:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-xml:jar:1.19:compile - omitted for duplicate)
    |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
-   +- org.apache.xmlgraphics:batik-util:jar:1.7:compile
-   +- org.apache.xmlgraphics:batik-xml:jar:1.7:compile
-   |  \- (org.apache.xmlgraphics:batik-util:jar:1.7:compile - omitted for duplicate)
-   +- xalan:xalan:jar:2.6.0:compile
-   |  \- (xml-apis:xml-apis:jar:1.0.b2:compile - omitted for conflict with 1.3.04)
-   +- xml-apis:xml-apis:jar:1.3.04:compile
+   +- org.apache.xmlgraphics:batik-script:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-anim:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  \- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile
+   +- org.apache.xmlgraphics:batik-svg-dom:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-awt-util:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-css:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-dom:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-ext:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-parser:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-util:jar:1.19:compile
+   |  +- org.apache.xmlgraphics:batik-constants:jar:1.19:compile
+   |  |  \- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  +- org.apache.xmlgraphics:batik-i18n:jar:1.19:compile
+   |  |  \- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  \- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:batik-xml:jar:1.19:compile
+   |  +- (org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile - omitted for duplicate)
+   |  \- (org.apache.xmlgraphics:batik-util:jar:1.19:compile - omitted for duplicate)
+   +- org.apache.xmlgraphics:xmlgraphics-commons:jar:2.11:compile
+   |  +- commons-io:commons-io:jar:2.17.0:compile
+   |  \- commons-logging:commons-logging:jar:1.3.0:compile
    \- xml-apis:xml-apis-ext:jar:1.3.04:compile
diff --git a/src/it/projects/tree-verbose/pom.xml b/src/it/projects/tree-verbose/pom.xml
index ef618b9e3..c3bdc5c1b 100644
--- a/src/it/projects/tree-verbose/pom.xml
+++ b/src/it/projects/tree-verbose/pom.xml
@@ -74,7 +74,7 @@
     <dependency>
       <groupId>org.apache.xmlgraphics</groupId>
       <artifactId>batik-bridge</artifactId>
-      <version>1.7</version>
+      <version>1.19</version>
     </dependency>
   </dependencies>