On Monday, June 3, 2019, Tibor Digana <tibordig...@apache.org> wrote: > > We are the maintainers.
Beware this kind of statements hurt the project and its community. > Do you inherit from this project and you need dom4j as transitive > dependency? More or less yes. M2E embeds maven-archiver and transitive dependencies. We don't want m2e to tweak the dependencies and we want m2e to not ship CVEs. So we think.it's better to fix CVEs upstream and we imagined Maven would be glad welcoming CVE fix contribution like people expect from any serious project. > -- Mickael Istria Eclipse IDE <https://www.eclipse.org/downloads/eclipse-packages/> developer, for Red Hat Developers <https://developers.redhat.com/>
