maven-clean-plugin and plexus-utils 1.1 (CVE-2017-1000487)

Hi, we are seeing that even with the latest maven-clean-plugin (currently 3.2.0) a plexus-utils-1.1.jar is being downloaded. We think that it is a real issue but we wanted to check in case we are overlooking something. This is reproducible 100% with a simple setup shown below. [1] In theory using

Enforce rules defined outside the pom.xml or its parent

Hello, Is it possible to enforce a set of rules defined outside the pom.xml being built (i.e. not defined in the current pom or in a parent pom)? Ideally, I would like to define maven-enforcer-plugin rules in an external pom.xml and evaluate them over the pom.xml being build in order to not force