Re: maven-dependency-plugin fetches all transitive project dependencies into local Maven cache (~/.m2/repository)

2024-06-25 Thread Nils Breunese
Robert Turner wrote: > The "problem" is not that the old log4j gets copied to the output folder, > it's that it is fetched into the local Maven cache / repository, which is > then picked up by security tooling (which of course complains that it is > ancient and has vulnerabilities). There is no

Re: maven-dependency-plugin fetches all transitive project dependencies into local Maven cache (~/.m2/repository)

2024-06-25 Thread Robert Turner
On Tue, Jun 25, 2024 at 9:51 PM Robert Turner wrote: > > On Tue, Jun 25, 2024 at 8:36 PM Karl Heinz Marbaise > wrote: > >> Hi, >> >> I'm not sure if I understand your problem correct, because based on the >> copy-dependencies goal as stated in the docs: >> >> "Goal that copies the project depend

Re: maven-dependency-plugin fetches all transitive project dependencies into local Maven cache (~/.m2/repository)

2024-06-25 Thread Robert Turner
On Tue, Jun 25, 2024 at 8:36 PM Karl Heinz Marbaise wrote: > Hi, > > I'm not sure if I understand your problem correct, because based on the > copy-dependencies goal as stated in the docs: > > "Goal that copies the project dependencies from the repository to a > defined location." > > it copies a

Re: maven-dependency-plugin fetches all transitive project dependencies into local Maven cache (~/.m2/repository)

2024-06-25 Thread Karl Heinz Marbaise
Hi, I'm not sure if I understand your problem correct, because based on the copy-dependencies goal as stated in the docs: "Goal that copies the project dependencies from the repository to a defined location." it copies as stated... The question is what you expect to be copied and furthermore t

[ANN] Apache Maven Daemon 2.0.0-beta-1 released

2024-06-25 Thread Tamás Cservenák
The Apache Maven team is pleased to announce the release of the Apache Maven Daemon version 2.0.0-beta-1 This release provides binaries based on Maven 4.0.0-beta-3. (From now on, Maven Daemon 1.x line will wrap Maven 3.x binaries, while Maven Daemon 2.x will wrap Maven 4.x binaries. Previous rele

per module repository settings

2024-06-25 Thread Delany
The update policy for snapshot artifacts in my project is set to "daily" and this applies to all modules. I would like to apply a different policy to selected modules, since the artifacts they produce are quite big. Is this possible? Its not enough to override the configuration of the selected mod