fix: document scanning dependency-check with dependency-check

[jeremylong]

• upgrade and exclude dependencies.
• move optional, test dependencies to a profile called test-dependencies.
• document how to run dependency-check on dependency-check by excluding the test-dependencies profile.

[aikebah]

LGTM

Checking the output of mvn dependency:tree -Dincludes=org.apache.maven -DreleaseTesting I did spot a dependency that we currently do not govern by the maven API version that I think we should (it's even more modern at 3.8.6): org.apache.maven:maven-compat:jar:3.8.6:provided

[aikebah]

LGTM

Checking the output of mvn dependency:tree -Dincludes=org.apache.maven -DreleaseTesting I did spot a dependency that we currently do not govern by the maven API version that I think we should (it's even more modern at 3.8.6): org.apache.maven:maven-compat:jar:3.8.6:provided

Given its purpose it would be even better if we could do without it (its a maven 2.x compatibility layer to ease the transition from 2 to 3, nowadays we're close to reaching the 3 to 4 transition)

[aikebah]

LGTM
Checking the output of mvn dependency:tree -Dincludes=org.apache.maven -DreleaseTesting I did spot a dependency that we currently do not govern by the maven API version that I think we should (it's even more modern at 3.8.6): org.apache.maven:maven-compat:jar:3.8.6:provided

Given its purpose it would be even better if we could do without it (its a maven 2.x compatibility layer to ease the transition from 2 to 3, nowadays we're close to reaching the 3 to 4 transition)

According to the maven dependency plugin it appears we can....

[INFO] --- maven-dependency-plugin:3.3.0:analyze (default-cli) @ dependency-check-maven ---
[WARNING] Used undeclared dependencies found:
[WARNING]    org.slf4j:slf4j-api:jar:1.7.36:compile
[WARNING]    org.apache.maven.doxia:doxia-sink-api:jar:1.11.1:compile
[WARNING]    org.hamcrest:hamcrest:jar:2.2:test
[WARNING]    org.apache.maven.resolver:maven-resolver-api:jar:1.6.2:provided
[WARNING]    org.apache.commons:commons-lang3:jar:3.12.0:compile
[WARNING]    com.github.package-url:packageurl-java:jar:1.4.1:compile
[WARNING]    org.apache.maven.shared:maven-common-artifact-filters:jar:3.1.0:compile
[WARNING] Unused declared dependencies found:
[WARNING]    org.apache.maven:maven-model-builder:jar:3.8.1:provided
[WARNING]    org.apache.maven:maven-compat:jar:3.8.6:provided
[WARNING]    org.hamcrest:hamcrest-core:jar:2.2:test
[WARNING]    org.jetbrains:annotations:jar:23.0.0:compile

[jeremylong]

Can we just remove maven-compat?

BTW - I'm planning on releasing 7.4.1 tomorrow (Friday) - and i'll hopefully get the gradle release correct this time.

[aikebah]

@jeremylong I'll run a check today on a build without maven-compat to be fully sure, but fairly certain that it's really unused.

[aikebah]

Awaiting the outcome of a final local test and then I'll file a PR onto this branch for the removal of the obsolete dependencies

[jeremylong]

@aikebah Thanks!