Re: Incoming PRs related to 'tree' enhancements

2025-04-07 Thread Bear Giles
t;;>graphml format. * * @author mailto:jerome.creig...@gmail.com";>Jerome Creignou * @author mailto:bgi...@coyotesong.com";>Bear Giles (3.9) * @since 2.1 */ public class GraphmlDependencyNodeVisitor extends VelocityDependencyNodeVisitor { public static final

Re: Incoming PRs related to 'tree' enhancements

2025-04-06 Thread Bear Giles
ull value. I'll follow up with some links to examples on my forked repo... Bear On Sun, Mar 30, 2025 at 10:38 PM Bear Giles wrote: > My primary motivation is making the `mvn dependency:tree -DoutputType=dot` > output usable. That's why I've been looking at that code - I'v

Re: Incoming PRs related to 'tree' enhancements

2025-03-30 Thread Bear Giles
hich project are you targeting exactly ? > If you're targeting Maven Core, do you think you could target the new API > rather than the resolver one ? > > > https://github.com/apache/maven/blob/master/api/maven-api-core/src/main/java/org/apache/maven/api/Node.java > Or are you t

Re: Incoming PRs related to 'tree' enhancements

2025-03-30 Thread Bear Giles
uld have an empty default implementation. Bear On Sun, Mar 30, 2025 at 11:25 AM Bear Giles wrote: > Here's one proposal I mentioned. It would allow the *caller* to eliminate > all calls to visit() and endVisit() while maintaining existing behavior. > This may allow the callers to

Re: Incoming PRs related to 'tree' enhancements

2025-03-30 Thread Bear Giles
visit(node)) { return Boolean.FALSE; } for (DependencyNode child : node.getChildren()) { if (!apply(child)) { return Boolean.FALSE; } } return endVisit(node); }; } Bear On Sun, Mar 30, 2025 at 11:04 AM Bear

Incoming PRs related to 'tree' enhancements

2025-03-30 Thread Bear Giles
I've taken the time to look around the other 'tree' classes, or more precisely the '*DependencyNodeVisitor" classes, and noticed that most if not all of them follow the anti-pattern of doing more than one thing in each method. More precisely they mix logic ('what to include') and presentation ('wha

Q: does prior contribution to 'archives' also provide jira access for this project?

2025-03-30 Thread Bear Giles
I'm ready to submit some issues + patches and having weird problems with the self-submit process. I have an existing JIRA account, and I've definitely contributed to an Apache project in the past (read-only access to ancient unix backups). When I try to log in it fails but when I try the self-subm

Re: Idea - allow pom to specify expected version for all dependencies in a common single groupId

2025-03-30 Thread Bear Giles
Thanks for the clarification. I'm usually the one pushing for using more plugins in our projects and even I had missed some of these nuances. I was planning to finally revive my blog and one of the ideas was how to improve the CI/CD pipeline. Consistency and avoiding unintentional addition of tran

Idea - allow pom to specify expected version for all dependencies in a common single groupId

2025-03-27 Thread Bear Giles
above. It's not as reliable since people may use different conventions since the plugin has access to the raw pom it can look for any entries in the properties and then check whether that value is used in any dependencies. If so, esp. if it happens more than once, then it can be treated the same as above. Bear Giles

Re: POC for improved DOT output for maven-dependency-plugin

2025-03-27 Thread Bear Giles
ncies is probably unintentional. But what if it's 2 out of 4? It may be better to provide no hints if it's not reliable. Plus may groupId have totally independent versions. Hmm... second email thread... Bear On Thu, Mar 27, 2025 at 10:15 AM Bear Giles wrote: > I noticed there&

Re: POC for improved DOT output for maven-dependency-plugin

2025-03-27 Thread Bear Giles
cros. This isn't a big problem if you're doing something like looking up the text color to use based on the maven scope but it makes it harder to handle some dynamic structural elements. e.g., in dot format the links can use either a "node" or a "node":port (note lack o

Re: POC for improved DOT output for maven-dependency-plugin

2025-03-24 Thread Bear Giles
hare the background you wanted to > visualize it in that way? Did it get some tasks done? > > Regards, > Tomo > > On Mon, Mar 24, 2025 at 19:02 Bear Giles wrote: > > > I should be clear - the glitch is the column of empty boxes above the > root > > dependency. They sh

Re: POC for improved DOT output for maven-dependency-plugin

2025-03-24 Thread Bear Giles
is the "Database Drivers" in the bottom left - that's an experiment specific to this pom - sometimes you might have a group independent dependencies that serve the same role, e.g., database JDBC drivers. Does it make sense to put them into their own cluster? Bear On Mon, Mar 24

Re: Responsibility - was [RE: Simian Plugin (fully documented andready to use)\

2003-06-24 Thread Bear Giles
Rafal Krzewski wrote: Michal Maczka wrote: I second Michal's opinion that we should not put any more plugins into maven repository, and that some of the existing one should move away onto another CVS repo on maven.apache.org or even to the repos of their associated software projects. I haven't had

Re: several security issues with maven

2003-06-12 Thread Bear Giles
Answering one of my own questions (for the archive), the files are unpacked because MavenUtils.getProject() expects a java.io.File argument for a Betwixt parser. I haven't used Betwixt, but I would expect there to be another method that takes an InputStream. This suggests that the classloader

Re: several security issues with maven

2003-06-12 Thread Bear Giles
Florin Vancea wrote: Hello Bear, hello all, IMHO, the final continuous build machine should be anyway a root-only machine (OK, root and the-same-root-person-as-a-common-user). The developer machine is also pretty much a developer-only machine, so there is little concern about some other user fiddl

Re: several security issues with maven

2003-06-11 Thread Bear Giles
Attached is a quickie implementation of a class loader, if it will help. I didn't touch resource URLs, but an approach I've used with a lot of success in the past is to use a form like jar:/path/to/jarfile?file/within/jarfile That's easy to construct, easy to parse, unique, and not easily c

several security issues with maven

2003-06-11 Thread Bear Giles
I've been struggling for the better part of the day to get maven to work... and have identified several critical security issues in the process. N.B., these are so critical that many sysadmins will not only allow maven, they'll disallow anything built with it! (Standard stuff: maven 1.0.b9, binary