[ANN] Maven Project Info Reports Plugin 3.6.1 released

2024-06-26 Thread Michael Osipov
The Apache Maven team is pleased to announce the release of the Maven Project Info Reports Plugin version 3.6.1. https://maven.apache.org/plugins/maven-project-info-reports-plugin/ You should specify the version in your project's plugin configuration: org.apache.maven.plugins

Re: maven-dependency-plugin fetches all transitive project dependencies into local Maven cache (~/.m2/repository)

2024-06-26 Thread Robert Turner
On Wed, Jun 26, 2024 at 6:04 AM Tamás Cservenák wrote: > Howdy, > > So here is how one can figure this out: using the "reverse tree" feature. > > Modified your reproducer command like this: > > $ $ rm -rf maven-cache && > MAVEN_ARGS="-Dmaven.repo.local.recordReverseTree=true >

Re: maven-dependency-plugin fetches all transitive project dependencies into local Maven cache (~/.m2/repository)

2024-06-26 Thread Robert Turner
On Wed, Jun 26, 2024 at 5:12 AM Karl Heinz Marbaise wrote: > Hi, > > On 26.06.24 03:51, Robert Turner wrote: > > On Tue, Jun 25, 2024 at 8:36 PM Karl Heinz Marbaise > > wrote: > > > >> Hi, > >> > >> I'm not sure if I understand your problem correct, because based on the > >> copy-dependencies

Re: maven-dependency-plugin fetches all transitive project dependencies into local Maven cache (~/.m2/repository)

2024-06-26 Thread Robert Turner
On Wed, Jun 26, 2024 at 1:36 AM Nils Breunese wrote: > Robert Turner wrote: > > > The "problem" is not that the old log4j gets copied to the output folder, > > it's that it is fetched into the local Maven cache / repository, which is > > then picked up by security tooling (which of course

Re: maven-dependency-plugin fetches all transitive project dependencies into local Maven cache (~/.m2/repository)

2024-06-26 Thread Tamás Cservenák
Howdy, So here is how one can figure this out: using the "reverse tree" feature. Modified your reproducer command like this: $ $ rm -rf maven-cache && MAVEN_ARGS="-Dmaven.repo.local.recordReverseTree=true -Dmaven.repo.local=./maven-cache" mvn -V package after invocation take a peek at recorded

Re: maven-dependency-plugin fetches all transitive project dependencies into local Maven cache (~/.m2/repository)

2024-06-26 Thread Karl Heinz Marbaise
Hi, On 26.06.24 03:51, Robert Turner wrote: On Tue, Jun 25, 2024 at 8:36 PM Karl Heinz Marbaise wrote: Hi, I'm not sure if I understand your problem correct, because based on the copy-dependencies goal as stated in the docs: "Goal that copies the project dependencies from the repository to