gnodet opened a new pull request, #2086: URL: https://github.com/apache/maven-resolver/pull/2086
## Summary Fixes 4 findings from the maven-resolver security audit (scan-maven-resolver-20260811): | Finding | Severity | Description | |---------|----------|-------------| | f031 | MEDIUM | Plaintext `minio+http`/`s3+http` repositories evade `external:http:*` blocking | | f032 | MEDIUM | Default-config Hazelcast member in build JVM accepts unauthenticated LAN peers | | f033 | MEDIUM | Redis lock backend trusted unconditionally over unauthenticated plaintext | | f034 | LOW | Swapped `ConfigUtils.getString` args ignore bucket config, misroute artifacts | **Root cause:** Three opt-in modules place infrastructure that gates local-repository integrity outside every defense the platform otherwise applies: MinIO plaintext evades `external:http:*`, Hazelcast boots with no auth on defaults, Redis accepts any plaintext address. **Fix:** Make enabling insecure backends a loud, deliberate act: refuse plaintext without opt-in, fail fast without explicit config, document trust boundary. ## Test plan - [ ] Existing tests pass - [ ] MinIO plaintext rejection tested - [ ] Hazelcast fail-fast without config tested - [ ] Redis plaintext refusal tested - [ ] ConfigUtils.getString arg order fixed and unit tested 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
