Consider updating plexus-archiver to 4.14.0

### New feature, improvement proposal

I have been doing an analysis of our dependencies and I discovered that maven-assembly-plugin version 3.8.0 indirectly imports io.airlift:aircompressor. The indirection comes via plexus-archiver.

aircompressor is a dead project (superseded by aircompressor3), and if you believe mavenrepository.com has about 8 CVEs against it, [1]

I poked a bit further and it looks like plexus-archiver started using this package in 4.10.0 and moved over to using commons-compress instead in 4.11.0 (commit ffa5935449bc).

It would be really cool if you could move your dependency forward to at least 4.11.0

For our use I am currently pinning maven-assembly-plugin in our pom to use plexus-archiver 4.14.0 [2] and it seems to work OK. I have also checked out your code, changed the pom, and done a “mvn test” on that project.

Of course I have no insight into your use. I also don’t know whether plexus-archiver uses semantic versioning so what I am doing may be unsafe.

I’d be happy to test a version for you if that makes this easier. Or put together a PR (but that seems heavyweight for a one-line change)

Rod

[1] https://mvnrepository.com/artifact/io.airlift/aircompressor/0.27
[2] https://codeberg.org/Shibboleth/java-parent-project/commit/bd0a3fd4bab069a4ff76c655ffb4e47cf60e76cf

Start by locating the plexus-archiver dependency declaration in the project's pom.xml and review the surrounding Maven dependency management. Run mvn test after updating it to at least 4.11.0, with 4.14.0 already reported as working; done means the tests pass and the older transitive aircompressor dependency is no longer brought in.

Written by the indexing model from the issue text.