upgrade common-collections / velocity?

[Brent Putman]

On 5/13/17 2:35 PM, Tom Zeller wrote:
>>> Have we ever actually looked in detail at all of our dependencies' dependencies to see that we're
>>> actually getting what we/they think we should?  I personally haven't (b/c we assume it works rationally).
> I casually check the IdP's WEB-INF/lib during a release, but not rigorously (i.e. comparing to what Maven says).

I'm pretty confident that the IdP distribution includes what Maven
*says* to include (what it resolves).  The issue is whether we can
trust it to correctly supply the dependencies that are expected.

What I meant by checking is actually looking at our direct
dependencies' POMs, and seeing if what they intended to say are their
dependencies are the same as what we get when Maven resolves those
transitively through our direct dependencies.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170513/ac1f689d/attachment-0001.html>