Description
Describe the bug (required)
I've included this amazing plugin in my project, but then immediatly Snyk.io notified me about added new 3 vulnerabilities via transitive dependency of
<dependency>
<groupId>org.sonatype.plexus</groupId>
<artifactId>plexus-build-api</artifactId>
<version>0.0.7</version>
</dependency>
I've wanted to fix that using <dependEncyManagement> by forcing version of that plugin - but it is not possible.
Problem is that they moved from org.sonatype.plexus to org.codehaus.plexus
So i can't override version (or i don't know how to frce-change )
Maybe that is also reason why your automated system didn't noticed that and didn't suggested to upgrade.
So if it is possible - can you change groupId and update to latest plugin version?
Tell us about your plugin configuration (required)
<plugin>
<groupId>io.github.git-commit-id</groupId>
<artifactId>git-commit-id-maven-plugin</artifactId>
</plugin>Tell us about the Plugin version used (required)
8.0.1
Tell us about the Maven version used (required)
Apache Maven 3.8.5
Steps to Reproduce (required)
Use Snyk.io plugin for InteliJIdea or visit mvn repository site
Are there any stacktraces or any error messages? (required)
Vulnerabilities from dependencies:
CVE-2022-4245
CVE-2022-4244
CVE-2017-1000487
Is there a (public) project where this issue can be reproduced? (optional)
No response
Your Environment (optional)
No response
Context (optional)
No response