[MCHANGES-455] Freshly released plugin contains CVE-warnings

**[Philipp Ottlinger](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=hugo.hirsch)** opened **[MCHANGES-455](https://issues.apache.org/jira/browse/MCHANGES-455?redirect=false)** and commented

I was happy to find the new RC 3.0.0-M1 ... when I had a look at

https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-changes-plugin/3.0.0-M1

I already saw 2 CVE-warnings. Not sure how easy these can be fixed in the next release cycle.

Thanks for all your work and help

---

**Affects:** 3.0.0-M1

**Issue Links:**
- [MCHANGES-454](https://issues.apache.org/jira/browse/MCHANGES-454) Deprecate Trac integration

Start by inspecting the dependency warnings reported for maven-changes-plugin 3.0.0-M1 on the linked Maven Repository page and compare them with the plugin's release dependency tree. Identify the two CVEs and confirm that a dependency update or exclusion removes them in a subsequent release.

Written by the indexing model from the issue text.