Release
v3.7.3
keelHotfix for a wrong merge request seen on 3.7.2: an unrelated dependency was upgraded and credited with fixing advisories on a coordinate whose pin the same run had just released. The anchor movement probe now resolves the POM planning sees, so a released pin can no longer be mistaken for an anchor's effect.
Highlights
- 01
Anchor probes measure only what the candidate changes
Property-versioned anchors were trialled with a Maven -D override against the POM file on disk while planning ran against the cleaned copy staged after reclaiming stale overrides. When cleanup had just released an exclusion-plus-pin sitting at the new fix version, the probe still saw the pinned version, read it as movement, and accepted the first property anchor tried, whatever it governed. The merge request bumped an unrelated Jackson module for three Tomcat advisories and removed the Tomcat pin in the same diff. The trial now stages the planning POM whenever it differs from the file, so the transitive is fixed on its own coordinate.
Full notes
Added
- REG-236 reproduces the released-pin-at-fix-version shape hermetically and pins the fix on the vulnerable coordinate itself.
Fixed
- The anchor trial probes property-versioned anchors against the planning POM, staging it when it differs from the file on disk, so a pin cleanup released cannot be credited to an unrelated anchor (ADR-015).