Skip to content

[CAMEL-24635] Cleanup of unused maven plugin related dependencies - #26231

Merged
davsclaus merged 1 commit into
apache:mainfrom
nielsbasjes:CleanupAncientMavenPluginDependencies
Sep 9, 2026
Merged

[CAMEL-24635] Cleanup of unused maven plugin related dependencies#26231
davsclaus merged 1 commit into
apache:mainfrom
nielsbasjes:CleanupAncientMavenPluginDependencies

Conversation

@nielsbasjes

Copy link
Copy Markdown
Contributor

Description

Some dependencies mentioned under dependency management are not used, 17 years old and contain CVE's. Better to remove them.

Target

  • I checked that the commit is targeting the correct branch (Camel 4 uses the main branch)

Tracking

Apache Camel coding standards and style

  • I checked that each commit in the pull request has a meaningful subject line and body.
  • I have run mvn clean install -DskipTests locally from root folder and I have committed all auto-generated changes.

AI-assisted contributions

Only manually edited changes

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

  • First-time contributors require MANUAL approval for the GitHub Actions to run
  • You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
  • You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
  • Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

@gnodet gnodet left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — verified that none of these 4 removed managed dependencies (maven-toolchain, maven-artifact-manager, maven-plugin-descriptor, maven-project) are actually used as direct dependencies in any child module. The two references to maven-plugin-descriptor in camel-maven-plugin and camel-csimple-maven-plugin are exclusions on exec-maven-plugin, which work independently of dependency management.

Clean removal of ancient Maven 2.2.1 artifacts with known CVE-2021-26291. 👍

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

🧪 CI tested the following changed modules:

  • parent

⚙️ View full build and test results

@davsclaus davsclaus added this to the 4.23.0 milestone Sep 9, 2026
@davsclaus davsclaus added the task label Sep 9, 2026
@davsclaus
davsclaus merged commit e013579 into apache:main Sep 9, 2026
5 checks passed
@nielsbasjes
nielsbasjes deleted the CleanupAncientMavenPluginDependencies branch September 9, 2026 19:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants