upgrade common-collections / velocity?

[Rob Audenaerde]

Thanks Scott for your quick reply,

Sorry about the misread, I'm a bit confused, I use this dependency in my
project to support SP functionality (WebSSO profile).

<dependency>
    <groupId>org.opensaml</groupId>
    <artifactId>opensaml-saml-impl</artifactId>
    <version>3.3.0</version>
</dependency>

Am I wrong to directly use this in my projects?

-Rob

On Fri, May 12, 2017 at 5:22 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 5/12/17, 11:11 AM, "dev on behalf of Rob Audenaerde" <
> dev-bounces at shibboleth.net on behalf of rob.audenaerde at gmail.com> wrote:
>
> > I recently started using the owasp maven plugin: dependency-check-maven
> to check for vulnerabilities in my projects
> > dependencies. OpenSaml 3.3.0 seems to use a version of
> commons-collections with a security advisory.
>
> There is no distribution of OpenSAML since its only purpose is to support
> Shibboleth. In that capacity, the parent POM OpenSAML 3.3.0 is pegged to is
> the one labeled "10" and that parent POM has the right version, thus the
> IdP distribution starting with 3.3.0 includes the right version.
>
> You're misreading the direct version dependency linkage between the jars
> as having something to do with what actually ends up in a distribution that
> you yourself by definition would have to be in control of.
>
> -- Scott
>
>
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170512/18a4cb80/attachment.html>