@Godin Should we leave a comment here, why this redundant/explicit dependency has been added?

@marchof dependencyManagement is to explicitly declare version of transitive dependency, so strictly speaking can't say that it is redundant, and some even advice to fully control transivite dependencies and always explicitly declare their versions. And seems that commons-collections uses semantic versioning, so update from 3.2 to 3.2.2 (on its own) seems like a good idea to grab bug-fixes. Commit message and so git blame will anyway be linked with this PR and hence with initial ticket. But also can add link to a ticket as a comment, or you was thinking about some other comment?

@Godin Someone looking at it might ask: why do we care about this version? I was thinking about a in-line comment like:

Avoid transitive dependency on version with security issue CVE-2015-7450

@marchof I still don't believe that serialization can be involved during execution of plugin, and so don't believe that security issue can be exploited here, also because

--- jacoco-maven-plugin.test/pom.xml
+++ jacoco-maven-plugin.test/pom.xml
@@ -31 +31 @@
-    <jacoco.includes>org.jacoco.maven.*</jacoco.includes>
+    <jacoco.includes>*</jacoco.includes>

$ mvn clean install
$ java -jar /tmp/jacoco-0.8.0/lib/jacococli.jar execinfo jacoco-maven-plugin.test/target/jacoco.exec | grep InvokerTransformer | wc -l
0

insecure org/apache/commons/collections/functors/InvokerTransformer is not touched during execution of our tests that IMO quite exhaustive. And so didn't wanted to scare by comment users that browse sources or follow commits (see for example 6a0c097#commitcomment-26640407) 😉 But ok - can add such message and let you handle user questions about where is immediate release to fix security vulnerability 😆 or maybe add such comment just before release to scare users of old versions 😈

BTW latest version of org.apache.maven.reporting:maven-reporting-impl:3.0.0 brings 3.2.1 as transitive dependency, so I'm pretty sure that many Maven plugins do not have 3.2.2.

@Godin After this discussion I feel like we should close #641 as ´Other Project´.

• The only sustainable fix is bumping the dependency in the maven-reporting-impl project.
• There are many other plugins depending on it, so why adding a hack in JaCoCo?
• As you wrote the vulnerable part is not used.
• Builds need excessive local privileges like access to the file system, network etc anyways. So either you trust your build or you run it in a sandboxed environment.