Maven

How to replace a Maven package

1. Depending on your project's structure, replace the dependency version with the patched version: In case it's a direct dependency, update the version property for the dependency section of the relevant pom.xml file (the example is [email protected]):

   <dependencies>
     ...
     <dependency>
       <groupId>log4j</groupId>
       <artifactId>log4j</artifactId>
       <version>1.2.17+sp2</version>
     </dependency>
     ...
   </dependencies>

2. In case it's a transitive dependency, update/add the following section in your project's pom.xml file, forcing the transitive dependency to use the sealed version:

   <dependencyManagement>
     <dependencies>
       <dependency>
         <groupId>log4j</groupId>
         <artifactId>log4j</artifactId>
         <version>1.2.17+sp2</version>
         ...
       </dependency>
       ...
     </dependencies>
     ...
   </dependencyManagement>

3. Purge existing dependency from the local repository and re-resolve them:

   mvn dependency:purge-local-repository -Dinclude="log4j:log4j"