From 7703560e73045ff255c2999a9401de8a5fbae40b Mon Sep 17 00:00:00 2001
From: KaiNative <github@kaineuhaus.com>
Date: Tue, 8 Aug 2023 09:06:50 +0200
Subject: [PATCH] Updating Maven-Plugin Dependencies  (#16274)

* bugfix-15672 updated mavenplugin dependencies

* bugfix-15672 re-added maven-compat since needed by maven-plugin-testing-harness

* bugfix-15672 explicit dependency of plexus archiver in a new version due to CVEs in version included from maven-plugin-testing-harness (2.2)

---------

Co-authored-by: Kai Neuhaus <kneuhaus@communicode.de>
---
 .../openapi-generator-maven-plugin/pom.xml    | 34 ++++++++++++++-----
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/modules/openapi-generator-maven-plugin/pom.xml b/modules/openapi-generator-maven-plugin/pom.xml
index 63976049c47..70082f5d2ff 100644
--- a/modules/openapi-generator-maven-plugin/pom.xml
+++ b/modules/openapi-generator-maven-plugin/pom.xml
@@ -27,28 +27,31 @@
         <dependency>
             <groupId>org.apache.maven</groupId>
             <artifactId>maven-core</artifactId>
-            <version>3.8.6</version>
+            <version>3.9.4</version>
+            <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.apache.maven</groupId>
             <artifactId>maven-artifact</artifactId>
-            <version>3.8.6</version>
+            <version>3.9.4</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.apache.maven</groupId>
             <artifactId>maven-compat</artifactId>
-            <version>3.8.6</version>
+            <version>3.9.4</version>
+            <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.apache.maven</groupId>
             <artifactId>maven-plugin-api</artifactId>
-            <version>3.8.6</version>
+            <version>3.9.4</version>
+            <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.apache.maven.plugin-tools</groupId>
             <artifactId>maven-plugin-annotations</artifactId>
-            <version>3.6.4</version>
+            <version>3.9.0</version>
         </dependency>
         <dependency>
             <groupId>org.openapitools</groupId>
@@ -72,13 +75,28 @@
             <artifactId>maven-plugin-testing-harness</artifactId>
             <version>3.3.0</version>
             <scope>test</scope>
+            <exclusions>
+                <!-- excludes due to https://devhub.checkmarx.com/cve-details/CVE-2018-1002200 -->
+                <exclusion>
+                    <groupId>org.codehaus.plexus</groupId>
+                    <artifactId>plexus-archiver</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.codehaus.plexus</groupId>
             <artifactId>plexus-utils</artifactId>
-            <version>3.5.0</version>
+            <version>3.5.1</version>
             <scope>test</scope>
         </dependency>
+        <!-- explicit dependency due to https://devhub.checkmarx.com/cve-details/CVE-2018-1002200 (see exclusion in maven-plugin-testing-harness) -->
+        <dependency>
+            <groupId>org.codehaus.plexus</groupId>
+            <artifactId>plexus-archiver</artifactId>
+            <version>4.8.0</version>
+            <scope>test</scope>
+        </dependency>
+
     </dependencies>
     <build>
         <pluginManagement>
@@ -86,7 +104,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-plugin-plugin</artifactId>
-                    <version>3.6.4</version>
+                    <version>3.9.0</version>
                     <configuration>
                         <skipErrorNoDescriptorsFound>true</skipErrorNoDescriptorsFound>
                     </configuration>
@@ -144,7 +162,7 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-invoker-plugin</artifactId>
-                        <version>3.2.2</version>
+                        <version>3.6.0</version>
                         <configuration>
                             <debug>false</debug>
                             <failIfNoProjects>true</failIfNoProjects>