#58 Remove workaround for CVE-2020-8908 (#472)

exasol · Aug 28, 2023 · 0ee1c8e · 0ee1c8e
1 parent 16e18a7
commit 0ee1c8e
Show file tree

Hide file tree

Showing 6 changed files with 7 additions and 44 deletions.
diff --git a/dependencies.md b/dependencies.md
diff --git a/doc/changes/changes_2.9.11.md b/doc/changes/changes_2.9.11.md
@@ -14,6 +14,10 @@ This adds three small improvements:
 
 * #470: Added three small improvements
 
+## Refactoring
+
+* #58: Removed workaround for CVE-2020-8908
+
 ## Dependency Updates
 
 ### Project-Keeper Shared Model Classes

diff --git a/maven-project-crawler/pom.xml b/maven-project-crawler/pom.xml
@@ -93,17 +93,6 @@
                 <artifactId>maven-plugin-plugin</artifactId>
                 <version>3.9.0</version>
             </plugin>
-            <plugin>
-                <groupId>org.sonatype.ossindex.maven</groupId>
-                <artifactId>ossindex-maven-plugin</artifactId>
-                <configuration>
-                    <excludeVulnerabilityIds>
-                        <!-- This issue is fixed in Maven 3.8.1. We need to wait until all developers have upgraded their Maven version.
-                             https://ossindex.sonatype.org/vulnerability/CVE-2021-26291 -->
-                        <exclude>CVE-2021-26291</exclude>
-                    </excludeVulnerabilityIds>
-                </configuration>
-            </plugin>
             <plugin>
                 <groupId>org.basepom.maven</groupId>
                 <artifactId>duplicate-finder-maven-plugin</artifactId>

diff --git a/parent-pom/pom.xml b/parent-pom/pom.xml
@@ -126,13 +126,6 @@
                 <groupId>org.apache.maven</groupId>
                 <artifactId>maven-core</artifactId>
                 <version>${maven.version}</version>
-                <exclusions>
-                    <!-- excluded since it introduces CVE-2020-8908 -->
-                    <exclusion>
-                        <groupId>com.google.guava</groupId>
-                        <artifactId>guava</artifactId>
-                    </exclusion>
-                </exclusions>
                 <scope>provided</scope>
             </dependency>
             <dependency>

diff --git a/pom.xml b/pom.xml
@@ -71,18 +71,6 @@
                     </execution>
                 </executions>
             </plugin>
-            <plugin>
-                <groupId>org.sonatype.ossindex.maven</groupId>
-                <artifactId>ossindex-maven-plugin</artifactId>
-                <version>3.2.0</version>
-                <configuration>
-                    <excludeVulnerabilityIds>
-                        <!-- This issue is fixed in Maven 3.8.1. We need to wait until all developers have upgraded their Maven version.
-                             https://ossindex.sonatype.org/vulnerability/CVE-2021-26291 -->
-                        <exclude>CVE-2021-26291</exclude>
-                    </excludeVulnerabilityIds>
-                </configuration>
-            </plugin>
         </plugins>
     </build>
 </project>
diff --git a/project-keeper-maven-plugin/pom.xml b/project-keeper-maven-plugin/pom.xml
@@ -99,17 +99,6 @@
                     </archive>
                 </configuration>
             </plugin>
-            <plugin>
-                <groupId>org.sonatype.ossindex.maven</groupId>
-                <artifactId>ossindex-maven-plugin</artifactId>
-                <configuration>
-                    <excludeVulnerabilityIds>
-                        <!-- This issue is fixed in Maven 3.8.1. We need to wait until all developers have upgraded their Maven version.
-                             https://ossindex.sonatype.org/vulnerability/CVE-2021-26291 -->
-                        <exclude>CVE-2021-26291</exclude>
-                    </excludeVulnerabilityIds>
-                </configuration>
-            </plugin>
             <plugin>
                 <groupId>org.basepom.maven</groupId>
                 <artifactId>duplicate-finder-maven-plugin</artifactId>