(maven-scm-publish-plugin) branch master updated: Manage Apache MINA SSHD to 2.20.0

[slachiewicz]

This is an automated email from the ASF dual-hosted git repository.

slachiewicz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/maven-scm-publish-plugin.git


The following commit(s) were added to refs/heads/master by this push:
     new 60da758  Manage Apache MINA SSHD to 2.20.0
60da758 is described below

commit 60da758de79fffe500f7f5271d873a208e59aef7
Author: Sylwester Lachiewicz <slachiew...@apache.org>
AuthorDate: Thu Oct 29 23:23:02 2026 +0000

    Manage Apache MINA SSHD to 2.20.0
---
 pom.xml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pom.xml b/pom.xml
index 5924d55..ff842cc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -67,6 +67,7 @@ under the License.
   <properties>
     <mavenVersion>3.9.16</mavenVersion>
     <scmVersion>2.2.1</scmVersion>
+    <minaSshdVersion>2.20.0</minaSshdVersion>
     
<releasePluginVersion>${version.maven-release-plugin}</releasePluginVersion>
     <sitePluginVersion>${version.maven-site-plugin}</sitePluginVersion>
     <antrunPluginVersion>${version.maven-antrun-plugin}</antrunPluginVersion>
@@ -75,6 +76,22 @@ under the License.
     
<project.build.outputTimestamp>2024-06-16T20:16:56Z</project.build.outputTimestamp>
   </properties>
 
+  <dependencyManagement>
+    <dependencies>
+      <!-- JGit 5.13 (via the maven-scm JGit provider) pulls in Apache MINA 
SSHD 2.7.0, which has known vulnerabilities -->
+      <dependency>
+        <groupId>org.apache.sshd</groupId>
+        <artifactId>sshd-sftp</artifactId>
+        <version>${minaSshdVersion}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.sshd</groupId>
+        <artifactId>sshd-osgi</artifactId>
+        <version>${minaSshdVersion}</version>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
     <dependency>
       <groupId>org.apache.maven.release</groupId>