upgrade common-collections / velocity?

[Cantor, Scott]

On 5/12/17, 11:11 AM, "dev on behalf of Rob Audenaerde" <dev-bounces at shibboleth.net on behalf of rob.audenaerde at gmail.com> wrote:

> I recently started using the owasp maven plugin: dependency-check-maven to check for vulnerabilities in my projects 
> dependencies. OpenSaml 3.3.0 seems to use a version of commons-collections with a security advisory.

There is no distribution of OpenSAML since its only purpose is to support Shibboleth. In that capacity, the parent POM OpenSAML 3.3.0 is pegged to is the one labeled "10" and that parent POM has the right version, thus the IdP distribution starting with 3.3.0 includes the right version.

You're misreading the direct version dependency linkage between the jars as having something to do with what actually ends up in a distribution that you yourself by definition would have to be in control of.

-- Scott