rodwiddowson opened a new issue, #659: URL: https://github.com/apache/maven-war-plugin/issues/659
### New feature, improvement proposal **Note** related case for [maven-assembly-plugin](https://github.com/apache/maven-assembly-plugin/issues/1374) I have been doing an analysis of our dependencies and I discovered that maven-war-plugin version 3.5.1 indirectly imports `io.airlift:aircompressor`. The indirection comes via plexus-archiver. aircompressor is a dead project (superseded by aircompressor3), and if you believe mavenrepository.com has about [8 CVEs against it](https://mvnrepository.com/artifact/io.airlift/aircompressor/0.27), I poked a bit further and it looks like plexus-archiver started using this package in 4.10.0 and moved over to using commons-compress instead in 4.11.0 (commit ffa5935449bc). It would be really cool if you could move your dependency forward to at least 4.11.0 For my test use I pinned maven-war-plugin in our pom to use plexus-archiver 4.14.0 and it seems to work OK. I have also checked out your code, changed the pom, and done a “mvn test” on that project. ```[INFO] Tests run: 63, Failures: 0, Errors: 0, Skipped: 0``` Of course I have no insight into your use. I also don’t know whether plexus-archiver uses semantic versioning so what I am doing may be unsafe. I’d be happy to test a version for you if that makes this easier. Or put together a PR (but that seems heavyweight for a one-line change) Rod -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
