upgrade common-collections / velocity?

[Rob Audenaerde]

>I'm no Maven expert but I can pretty much say that if the chain of POM
dependencies is followed, that should be pulling in
commons-collection-3.2.2 by virtue of the opensaml-parent-3.3.0 POM
pointing to the java-parent-project->v3 POM that's tagged 10, which has
that version pegged.

There is a double dependency (directly and via velocity):

https://mvnrepository.com/artifact/net.shibboleth/parent-v3/10

Refers to:

https://mvnrepository.com/artifact/org.apache.velocity/velocity/1.7

Refers to:

https://mvnrepository.com/artifact/commons-collections/commons-collections/3.2.1

And the velocity dependency has no exclusion for the commons-collections.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170512/392ec976/attachment.html>