You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi Martijn,
Thanks so much for your feedback. The report is generated in target/site/refactor-first-report.html - I realize now that I should be more clear in the Readme indicating where the report is generated.
Report generation is currently bound to the mvn site lifecycle phase, but it's not currently integrated as a report in the list of site reports.
Unfortunately I had to remove report generation from the Maven Report generation process due to CVE-2020-13936 as detailed in #15 - large organizations with good security hygiene don't allow anything with a CVSS score of greater than 8.0 through their security gates (with good reason!), and that CVE has a vulnerability score of 8.8 and a trivial workaround isn't available that I'm aware of. Unfortunately this is largely out of my control since the version of Velocity is heavily integrated with Maven. I tried to work around it before, but ran into multiple dead-ends. I believe the dependency-check plugin is able to work around it, but not without a significant amount of work.
Would you happen to be aware of a more expedient workaround? It's possible that this issue may be resolved as part of Maven 4
On a scale of 1 (not valuable) - 5 (extremely valuable), how valuable would you find having the RefactorFirst report integrated into a Maven 3.x site generated report?
@jimbethancourt Is that CVE not fixed in the latest Maven 3.9.3 with latest plugins specified? I think it's important in terms of discoverablity in CI/CD platforms but as a dev I can get around it.
Hi @karianna! I'm done coding this up and need to update the Readme.md file. I also need to merge in PR #21 and update JGit and test, but it should be ready soon. I'm keeping an eye on PMD as well for Java 21 support, but this feature is going to happen 🙂
Activity
jimbethancourt commentedon Jun 28, 2023
Hi Martijn,
Thanks so much for your feedback. The report is generated in target/site/refactor-first-report.html - I realize now that I should be more clear in the Readme indicating where the report is generated.
Report generation is currently bound to the mvn site lifecycle phase, but it's not currently integrated as a report in the list of site reports.
Unfortunately I had to remove report generation from the Maven Report generation process due to CVE-2020-13936 as detailed in #15 - large organizations with good security hygiene don't allow anything with a CVSS score of greater than 8.0 through their security gates (with good reason!), and that CVE has a vulnerability score of 8.8 and a trivial workaround isn't available that I'm aware of. Unfortunately this is largely out of my control since the version of Velocity is heavily integrated with Maven. I tried to work around it before, but ran into multiple dead-ends. I believe the dependency-check plugin is able to work around it, but not without a significant amount of work.
Would you happen to be aware of a more expedient workaround? It's possible that this issue may be resolved as part of Maven 4
On a scale of 1 (not valuable) - 5 (extremely valuable), how valuable would you find having the RefactorFirst report integrated into a Maven 3.x site generated report?
Thanks,
Jim
karianna commentedon Jun 30, 2023
@jimbethancourt Is that CVE not fixed in the latest Maven 3.9.3 with latest plugins specified? I think it's important in terms of discoverablity in CI/CD platforms but as a dev I can get around it.
jimbethancourt commentedon Jun 30, 2023
It looks like newer versions of Doxia Site Renderer have been released in the 1.x stream - https://central.sonatype.com/artifact/org.apache.maven.doxia/doxia-site-renderer/1.11.1/versions
I'll investigate soon and see if the CVE is removed in the most recent release.
jimbethancourt commentedon Sep 25, 2023
Hi @karianna! I'm done coding this up and need to update the Readme.md file. I also need to merge in PR #21 and update JGit and test, but it should be ready soon. I'm keeping an eye on PMD as well for Java 21 support, but this feature is going to happen 🙂
#62 Brought the Maven Site report back to life
Merge pull request #71 from jimbethancourt/#62-mvn-site
jimbethancourt commentedon Oct 16, 2023
Fixed in release 0.5.0-M1