upgrade common-collections / velocity?

[Cantor, Scott]

On 5/12/17, 3:45 PM, "dev on behalf of Brent Putman" <dev-bounces at shibboleth.net on behalf of putmanb at georgetown.edu> wrote:

> Yes, you are correct.  I see the same thing in a sandbox project.  I belatedly realize why this is.  In all of our own code, we are
> getting the 3.2.2 version by explicitly managing this dependency in our parent POM.  All our projects' POMs derive from this
> parent POM, and so that's what is effective.

I had thought, I guess mistakenly, that it was a given that any dependency on OpenSAML required using our parent POM. And that's what I would do, personally.

> ... I think the best thing you can do right now is to just declare the 3.2.2 version in your own project's POM.  I tested just adding a
> dependency management section like below to my sandbox, and it works for me:

I think that essentially means owning the testing and integration job of all the dependencies. If you wanted to get a system operating as tested and delivered in the only context in which we test and deliver OpenSAML, you'd use our parent POM.

-- Scott