mck

> this is adding test dependencies, so adding test dependencies with test scope to the single pom would let us get rid of this file; that leaves us with parent...

> Is there any reason you want these excluded from a potential unified POM rather than depending on this functionality of the test scope? Encapsulation. Our test dependencies need not...

> From what I can tell, Maven Ant Tasks doesn't directly use the vulnerable components of plexus-utils2 If this is accurate… I think it's important to stress we can ignore...

> it opens the possibility to clean up dependencies with tools like Dependabot (be prepared to even more CVEs from dependencies) Dependency (software supply chain security) analysis against the difference...

> Given all discussion I am in favor of moving forward with this patch. For me, so long as any of the unanswered questions are ok to be left as...

> We need patches against all branches. We start with 3.0 (and forward merge, not back-port) 3.0, 3.11 , 4.0 will need to honour the two existing published POMs. In...

Thanks @eddumelendez I'm new to the autoconfigure, appreciate the quick feedback. Will get this fix today.

fixed in https://github.com/spring-projects/spring-ai/pull/575

are we (and how) dtesting this config too ? (java and python dtests), separate ticket ?

@HadesArchitect