Ricardo L.

If this issue is still open, I’d be happy to give it a try.

Ready for review: https://github.com/aquasecurity/trivy/pull/9159

I’m stepping back from this issue to make room for others to take it further. Thanks to the maintainers for the feedback on my attempt to implement this change! _Please...

I performed a local verification to check whether one of our internal dependencies is now being resolved and reported. This dependency is available only in a private remote repository, as...

Hi @hufon, Thanks for testing it and sharing this case! I didn't do a deep dive yet. But I think I know what is going on. The code iterates only...

> Ok, your solution with adding the central repo in settings works. > > ``` > 2025-07-08T15:43:03+02:00 DEBUG [pom] applyMirrorSettingsForRepositories repositoriesCount=1 mirrorsCount=1 > 2025-07-08T15:43:03+02:00 DEBUG [pom] Checking repository for mirror...

_To come back on https://github.com/aquasecurity/trivy/pull/9159#issuecomment-3048956340._ > The central repository is probably a special case. It’s always available in Maven, even if it’s not explicitly defined. That seems to align with...

After some further consideration, I believe the change I suggested earlier is worth implementing. I’ll convert this PR to a draft while I work on it. If needed, we can...

Refactored the handling of the `central` repository as per https://github.com/aquasecurity/trivy/pull/9159/commits/9c174db40b57b208666599c62eda30434710815a. Now explicitly creating an instance of the `repository` struct in `pom.effectiveRepositories` to ensure the `mirror` configuration is always applied to...

> What is blocking the PR? Hi @hufon, as far as I’m aware, everything should be good from my side. I believe it’s just waiting on a review from the...