Re: [PR] [MNG-8713] SourceRoot.directory() default value should include the module when present [maven]

2025-05-17 Thread via GitHub
desruisseaux commented on code in PR #2278: URL: https://github.com/apache/maven/pull/2278#discussion_r2094235663 ## impl/maven-impl/src/main/java/org/apache/maven/impl/DefaultSourceRoot.java: ## @@ -79,7 +79,12 @@ public DefaultSourceRoot(final Session session, final Path base

Re: [PR] Bump org.apache.maven:maven-archiver from 3.6.2 to 3.6.3 [maven-ejb-plugin]

2025-05-17 Thread via GitHub
slachiewicz merged PR #38: URL: https://github.com/apache/maven-ejb-plugin/pull/38 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@ma

Re: [PR] Bump commons-io:commons-io from 2.16.1 to 2.18.0 [maven-ejb-plugin]

2025-05-17 Thread via GitHub
slachiewicz merged PR #37: URL: https://github.com/apache/maven-ejb-plugin/pull/37 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@ma

Re: [PR] Bump org.codehaus.plexus:plexus-archiver from 4.9.2 to 4.10.0 [maven-ejb-plugin]

2025-05-17 Thread via GitHub
slachiewicz merged PR #34: URL: https://github.com/apache/maven-ejb-plugin/pull/34 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@ma

Re: [PR] [ERROR] High: Found reliance on default encoding in `org.apache.maven.di.tool.DiIndexProcessor.updateFileIfChanged()`: new java.io.InputStreamReader(InputStream) [org.apache.maven.di.tool.DiI

2025-05-17 Thread via GitHub
Pankraz76 closed pull request #2344: [ERROR] High: Found reliance on default encoding in `org.apache.maven.di.tool.DiIndexProcessor.updateFileIfChanged()`: new java.io.InputStreamReader(InputStream) [org.apache.maven.di.tool.DiIndexProcessor] At DiIndexProcessor.java:[line 129] DM_DEFAULT_ENC

[PR] [ERROR] High: Found reliance on default encoding in `org.apache.maven.di.tool.DiIndexProcessor.updateFileIfChanged()`: new java.io.InputStreamReader(InputStream) [org.apache.maven.di.tool.DiIndex

2025-05-17 Thread via GitHub
Pankraz76 opened a new pull request, #2344: URL: https://github.com/apache/maven/pull/2344 fix errors found by spotbugs: - [ERROR] High: Found reliance on default encoding in org.apache.maven.di.tool.DiIndexProcessor.updateFileIfChanged(): new java.io.InputStreamReader(InputStream)

Re: [PR] [ERROR] High: Found reliance on default encoding in `org.apache.maven.di.tool.DiIndexProcessor.updateFileIfChanged()`: new java.io.InputStreamReader(InputStream) [org.apache.maven.di.tool.DiI

2025-05-17 Thread via GitHub
Pankraz76 commented on PR #2344: URL: https://github.com/apache/maven/pull/2344#issuecomment-2888562815 wip -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe,

[jira] [Commented] (SCM-1028) Vulnerability: Clear text password is logged by JGit provider and by gitexe remoteinfo on a ls-remote failure

2025-05-17 Thread ASF GitHub Bot (Jira)
[ https://issues.apache.org/jira/browse/SCM-1028?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17952390#comment-17952390 ] ASF GitHub Bot commented on SCM-1028: - hboutemy commented on PR #237: URL: https://gith

Re: [PR] [SCM-1028] Fix clear password logging vulnerability [maven-scm]

2025-05-17 Thread via GitHub
hboutemy commented on PR #237: URL: https://github.com/apache/maven-scm/pull/237#issuecomment-2888540089 @michael-o it seems @pzygielo 's explanation is right, and it was the case 4 years ago: see #120 PR's commit https://github.com/apache/maven-scm/pull/120/commits is different form mas

[PR] Use shared release-drafter action [maven-pmd-plugin]

2025-05-17 Thread via GitHub
slawekjaranowski opened a new pull request, #203: URL: https://github.com/apache/maven-pmd-plugin/pull/203 Following this checklist to help us incorporate your contribution quickly and easily: - [ ] Make sure there is a [JIRA issue](https://issues.apache.org/jira/browse/MPMD) file

Re: [I] link to "Guide to Using Toolchains" broken [maven-site]

2025-05-17 Thread via GitHub
slawekjaranowski commented on issue #780: URL: https://github.com/apache/maven-site/issues/780#issuecomment-2888463952 generated site contains: ```html See Also Guide to Using Toolchains Toolchains Descriptor ``` acocrding to site descriptor should be:

Re: [I] link to "Guide to Using Toolchains" broken [maven-site]

2025-05-17 Thread via GitHub
slawekjaranowski commented on issue #780: URL: https://github.com/apache/maven-site/issues/780#issuecomment-2888456295 Site https://maven.apache.org/plugins/maven-toolchains-plugin/index.html Is generated as plugin documentation from project: https://github.com/apache/maven-toolchain

Re: [I] link to "Toolchains Descriptor" broken [maven-site]

2025-05-17 Thread via GitHub
slawekjaranowski closed issue #781: link to "Toolchains Descriptor" broken URL: https://github.com/apache/maven-site/issues/781 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment.

Re: [I] link to "Toolchains Descriptor" broken [maven-site]

2025-05-17 Thread via GitHub
slawekjaranowski commented on issue #781: URL: https://github.com/apache/maven-site/issues/781#issuecomment-2888456774 The same source of problem like in: #780 so I close this one as duplicate. -- This is an automated message from the Apache Git Service. To respond to the message, please l

Re: [PR] GitHub issues maven-invoker [maven-site]

2025-05-17 Thread via GitHub
slawekjaranowski merged PR #782: URL: https://github.com/apache/maven-site/pull/782 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@m

Re: [PR] Bump commons-io:commons-io from 2.16.1 to 2.18.0 [maven-ejb-plugin]

2025-05-17 Thread via GitHub
slachiewicz commented on PR #37: URL: https://github.com/apache/maven-ejb-plugin/pull/37#issuecomment-2888445293 @dependabot rebase -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific co

Re: [PR] Bump org.codehaus.plexus:plexus-archiver from 4.9.2 to 4.10.0 [maven-ejb-plugin]

2025-05-17 Thread via GitHub
slachiewicz commented on PR #34: URL: https://github.com/apache/maven-ejb-plugin/pull/34#issuecomment-2888445427 @dependabot rebase -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific co

Re: [PR] Bump org.apache.maven:maven-archiver from 3.6.2 to 3.6.3 [maven-ejb-plugin]

2025-05-17 Thread via GitHub
slachiewicz commented on PR #38: URL: https://github.com/apache/maven-ejb-plugin/pull/38#issuecomment-2888445165 @dependabot rebase -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific co

Re: [PR] Bump org.apache.maven.shared:maven-filtering from 3.3.2 to 3.4.0 [maven-ejb-plugin]

2025-05-17 Thread via GitHub
slachiewicz merged PR #41: URL: https://github.com/apache/maven-ejb-plugin/pull/41 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@ma

Re: [PR] [MNG-5913] Allow defining aliases for existing server configurations in settings.xml [maven]

2025-05-17 Thread via GitHub
slawekjaranowski commented on PR #2333: URL: https://github.com/apache/maven/pull/2333#issuecomment-2888441618 As I see from my testing only unparsable settings.xml break a Maven build at all settings.xml with correct xml syntax, but with unkown tags are processed, all recognized setting

[PR] GitHub issues maven-invoker [maven-site]

2025-05-17 Thread via GitHub
slawekjaranowski opened a new pull request, #782: URL: https://github.com/apache/maven-site/pull/782 Following this checklist to help us incorporate your contribution quickly and easily: - [ ] Your pull request should address just one issue, without pulling in other changes. - [

[jira] [Commented] (SCM-1028) Vulnerability: Clear text password is logged by JGit provider and by gitexe remoteinfo on a ls-remote failure

2025-05-17 Thread ASF GitHub Bot (Jira)
[ https://issues.apache.org/jira/browse/SCM-1028?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17952369#comment-17952369 ] ASF GitHub Bot commented on SCM-1028: - michael-o commented on PR #237: URL: https://git

Re: [PR] [SCM-1028] Fix clear password logging vulnerability [maven-scm]

2025-05-17 Thread via GitHub
michael-o commented on PR #237: URL: https://github.com/apache/maven-scm/pull/237#issuecomment-2888392969 > > any idea from anybody on what magic was adding the "asfgit merged commit" step? = what seems currently broken > > * I think it might be the matter of pushing commit KNOWN

Re: [PR] [MNG-5913] Allow defining aliases for existing server configurations in settings.xml [maven]

2025-05-17 Thread via GitHub
cstamas commented on PR #2333: URL: https://github.com/apache/maven/pull/2333#issuecomment-2888358388 > For older Maven warning will be printed. I am aware of warning, but am unaware what exactly happens when that warning is printed: is whole settings ignored, is only the server (with

Re: [PR] [POC] `rewrite-maven-plugin`: Introduce OpenRewrite by Moderne [maven]

2025-05-17 Thread via GitHub
Pankraz76 commented on PR #2322: URL: https://github.com/apache/maven/pull/2322#issuecomment-2888309850 then checkstyle stack using PMD/spotbugs seems only option. Might use rewrite to fix legacy, by using `old version`. This should be **legal** as in past is **was open source**. With

Re: [PR] [POC] `rewrite-maven-plugin`: Introduce OpenRewrite by Moderne [maven]

2025-05-17 Thread via GitHub
Pankraz76 closed pull request #2322: [POC] `rewrite-maven-plugin`: Introduce OpenRewrite by Moderne URL: https://github.com/apache/maven/pull/2322 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the

Re: [PR] Drop comment from jira integration [maven-invoker]

2025-05-17 Thread via GitHub
slawekjaranowski merged PR #86: URL: https://github.com/apache/maven-invoker/pull/86 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@

Re: [PR] [MNG-5913] Allow defining aliases for existing server configurations in settings.xml [maven]

2025-05-17 Thread via GitHub
slawekjaranowski commented on PR #2333: URL: https://github.com/apache/maven/pull/2333#issuecomment-2888303723 > I am still unconvinced that this change is backward compatible. Or the idea is that whoever uses this feature must use Maven 4 or latest (upcoming) Maven 3.9.10? What happens if

Re: [PR] [POC]: Issue#5735 support `legacy` automating `excludeFromFailureFile` [maven-pmd-plugin]

2025-05-17 Thread via GitHub
Pankraz76 commented on code in PR #202: URL: https://github.com/apache/maven-pmd-plugin/pull/202#discussion_r2094093672 ## src/main/java/org/apache/maven/plugins/pmd/PmdReportRenderer.java: ## @@ -293,6 +293,14 @@ public int compare(Violation o1, Violation o2) { if (fil

Re: [PR] [POC]: Issue#5735 support `legacy` automating `excludeFromFailureFile` [maven-pmd-plugin]

2025-05-17 Thread via GitHub
Pankraz76 commented on code in PR #202: URL: https://github.com/apache/maven-pmd-plugin/pull/202#discussion_r2094093672 ## src/main/java/org/apache/maven/plugins/pmd/PmdReportRenderer.java: ## @@ -293,6 +293,14 @@ public int compare(Violation o1, Violation o2) { if (fil

Re: [PR] [POC]: Issue#5735 support `legacy` automating `excludeFromFailureFile` [maven-pmd-plugin]

2025-05-17 Thread via GitHub
Pankraz76 commented on PR #202: URL: https://github.com/apache/maven-pmd-plugin/pull/202#issuecomment-2888299600 is this any good @oowekyala? A simple log to support manual c&p would fix quick fix. without breaking anything as just logging. Then writing the keys into file could be ne

Re: [PR] [POC]: Issue#5735 support `legacy` automating `excludeFromFailureFile` [maven-pmd-plugin]

2025-05-17 Thread via GitHub
Pankraz76 commented on code in PR #202: URL: https://github.com/apache/maven-pmd-plugin/pull/202#discussion_r2094093672 ## src/main/java/org/apache/maven/plugins/pmd/PmdReportRenderer.java: ## @@ -293,6 +293,14 @@ public int compare(Violation o1, Violation o2) { if (fil

[PR] [POC]: Issue#5735 support `legacy` automating `excludeFromFailureFile` [maven-pmd-plugin]

2025-05-17 Thread via GitHub
Pankraz76 opened a new pull request, #202: URL: https://github.com/apache/maven-pmd-plugin/pull/202 - https://github.com/pmd/pmd/issues/5735 Following this checklist to help us incorporate your contribution quickly and easily: - [ ] Make sure there is a [JIRA issue](htt

[jira] [Commented] (SCM-1028) Vulnerability: Clear text password is logged by JGit provider and by gitexe remoteinfo on a ls-remote failure

2025-05-17 Thread ASF GitHub Bot (Jira)
[ https://issues.apache.org/jira/browse/SCM-1028?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17952355#comment-17952355 ] ASF GitHub Bot commented on SCM-1028: - pzygielo commented on PR #237: URL: https://gith

Re: [PR] [SCM-1028] Fix clear password logging vulnerability [maven-scm]

2025-05-17 Thread via GitHub
pzygielo commented on PR #237: URL: https://github.com/apache/maven-scm/pull/237#issuecomment-2888294863 > any idea from anybody on what magic was adding the "asfgit merged commit" step? = what seems currently broken - I think it might be the matter of pushing commit KNOWN to GitHub i

[jira] [Commented] (SCM-1028) Vulnerability: Clear text password is logged by JGit provider and by gitexe remoteinfo on a ls-remote failure

2025-05-17 Thread ASF GitHub Bot (Jira)
[ https://issues.apache.org/jira/browse/SCM-1028?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17952354#comment-17952354 ] ASF GitHub Bot commented on SCM-1028: - michael-o commented on PR #237: URL: https://git

Re: [PR] [SCM-1028] Fix clear password logging vulnerability [maven-scm]

2025-05-17 Thread via GitHub
michael-o commented on PR #237: URL: https://github.com/apache/maven-scm/pull/237#issuecomment-2888287173 > searching for pointers, I see Jena project seems to have clearly documented the PR merge process via GH or via GitBas = https://cwiki.apache.org/confluence/pages/viewpage.action?pageI

[jira] [Commented] (SCM-1028) Vulnerability: Clear text password is logged by JGit provider and by gitexe remoteinfo on a ls-remote failure

2025-05-17 Thread ASF GitHub Bot (Jira)
[ https://issues.apache.org/jira/browse/SCM-1028?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17952353#comment-17952353 ] ASF GitHub Bot commented on SCM-1028: - hboutemy commented on PR #237: URL: https://gith

Re: [PR] [SCM-1028] Fix clear password logging vulnerability [maven-scm]

2025-05-17 Thread via GitHub
hboutemy commented on PR #237: URL: https://github.com/apache/maven-scm/pull/237#issuecomment-2888282584 searching for pointers, I see Jena project seems to have clearly documented the PR merge process via GH or via GitBas = https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=7

[jira] [Commented] (SCM-1028) Vulnerability: Clear text password is logged by JGit provider and by gitexe remoteinfo on a ls-remote failure

2025-05-17 Thread ASF GitHub Bot (Jira)
[ https://issues.apache.org/jira/browse/SCM-1028?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17952350#comment-17952350 ] ASF GitHub Bot commented on SCM-1028: - hboutemy commented on PR #237: URL: https://gith

Re: [PR] [SCM-1028] Fix clear password logging vulnerability [maven-scm]

2025-05-17 Thread via GitHub
hboutemy commented on PR #237: URL: https://github.com/apache/maven-scm/pull/237#issuecomment-2888281404 any idea from anybody on what magic was adding the "asfgit merged commit" step? = what seems currently broken -- This is an automated message from the Apache Git Service. To respond

[jira] [Commented] (SCM-1028) Vulnerability: Clear text password is logged by JGit provider and by gitexe remoteinfo on a ls-remote failure

2025-05-17 Thread ASF GitHub Bot (Jira)
[ https://issues.apache.org/jira/browse/SCM-1028?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17952345#comment-17952345 ] ASF GitHub Bot commented on SCM-1028: - hboutemy commented on PR #237: URL: https://gith

Re: [PR] [SCM-1028] Fix clear password logging vulnerability [maven-scm]

2025-05-17 Thread via GitHub
hboutemy commented on PR #237: URL: https://github.com/apache/maven-scm/pull/237#issuecomment-2888273629 writing down the factual differences: - in 2022 for #151, there were 2 messages with the expected successful GH PR conclusion: ![image](https://github.com/user-attachments/assets/7

[jira] [Commented] (SCM-1028) Vulnerability: Clear text password is logged by JGit provider and by gitexe remoteinfo on a ls-remote failure

2025-05-17 Thread ASF GitHub Bot (Jira)
[ https://issues.apache.org/jira/browse/SCM-1028?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17952344#comment-17952344 ] ASF GitHub Bot commented on SCM-1028: - michael-o commented on PR #237: URL: https://git

Re: [PR] [SCM-1028] Fix clear password logging vulnerability [maven-scm]

2025-05-17 Thread via GitHub
michael-o commented on PR #237: URL: https://github.com/apache/maven-scm/pull/237#issuecomment-2888270513 > I'm trying to understand the issue and where we should look for solution no idea if the change is at ASF level or at GH level but in the past, it seems that the way @michael-o was mer

[jira] [Commented] (SCM-1028) Vulnerability: Clear text password is logged by JGit provider and by gitexe remoteinfo on a ls-remote failure

2025-05-17 Thread ASF GitHub Bot (Jira)
[ https://issues.apache.org/jira/browse/SCM-1028?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17952340#comment-17952340 ] ASF GitHub Bot commented on SCM-1028: - hboutemy commented on PR #237: URL: https://gith

Re: [PR] [SCM-1028] Fix clear password logging vulnerability [maven-scm]

2025-05-17 Thread via GitHub
hboutemy commented on PR #237: URL: https://github.com/apache/maven-scm/pull/237#issuecomment-2888269800 I'm trying to understand the issue and where we should look for solution no idea if the change is at ASF level or at GH level but in the past, it seems that the way @michael-o was me

Re: [PR] [MNG-5913] Allow defining aliases for existing server configurations in settings.xml [maven]

2025-05-17 Thread via GitHub
cstamas commented on PR #2333: URL: https://github.com/apache/maven/pull/2333#issuecomment-2888265510 I am still unconvinced that this change is backward compatible. Or the idea is that whoever uses this feature must use Maven 4 or latest (upcoming) Maven 3.9.10? What happens if by mistake

Re: [PR] Bump org.apache.maven.plugins:maven-plugins from 43 to 44 [maven-invoker-plugin]

2025-05-17 Thread via GitHub
slawekjaranowski merged PR #282: URL: https://github.com/apache/maven-invoker-plugin/pull/282 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-uns

[PR] Drop comment from jira integration [maven-invoker]

2025-05-17 Thread via GitHub
slawekjaranowski opened a new pull request, #86: URL: https://github.com/apache/maven-invoker/pull/86 Following this checklist to help us incorporate your contribution quickly and easily: - [ ] Your pull request should address just one issue, without pulling in other changes. -

Re: [PR] Enable GitHub Issues [maven-invoker]

2025-05-17 Thread via GitHub
slawekjaranowski merged PR #85: URL: https://github.com/apache/maven-invoker/pull/85 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@

Re: [PR] [MNG-5913] Allow defining aliases for existing server configurations in settings.xml [maven]

2025-05-17 Thread via GitHub
slawekjaranowski commented on PR #2333: URL: https://github.com/apache/maven/pull/2333#issuecomment-2888205461 @gnodet @cstamas any more comments for it? I will cleanups from comments and will be ready. -- This is an automated message from the Apache Git Service. To respond to the m