Skip to content

Update commons-io to 2.22.0 - #1260

Merged
slachiewicz merged 1 commit into
apache:masterfrom
slachiewicz:agent/update-vulnerable-deps
Oct 30, 2026
Merged

slachiewicz merged 1 commit into
apache:masterfrom
slachiewicz:agent/update-vulnerable-deps

Conversation

@slachiewicz

Copy link
Copy Markdown
Member

Fixes GHSA-78wr-2p64-hpwj. maven-shared-utils 3.4.2, pulled in through maven-reporting-impl, brings commons-io 2.11.0 onto the classpath of maven-plugin-report-plugin at compile scope, so this reaches the published plugin; in maven-plugin-tools-api it is test-only. 2.22.0 is the version already resolved in the other modules.

Verified: mvn verify -Dinvoker.skip → pass

Part of apache/maven#13755

@slachiewicz slachiewicz added the dependencies Pull requests that update a dependency file label Oct 29, 2026
@slachiewicz
slachiewicz marked this pull request as ready for review October 30, 2026 08:05
@slachiewicz
slachiewicz merged commit b21c816 into apache:master Oct 30, 2026
19 checks passed
@slachiewicz
slachiewicz deleted the agent/update-vulnerable-deps branch October 31, 2026 22:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant