NCLSUP-1478 Add a suppressManifestComment option by cunningt · Pull Request #1186 · project-ncl/pom-manipulation-ext

cunningt · 2026-08-24T17:53:22Z

NCLSUP-1478 Add a suppressManifestComment option that will suppress the printing of the footer manifest comment "Modified by POM Manipulation Extension for Maven".

Example

</project>
<!--
Modified by POM Manipulation Extension for Maven 5.6-SNAPSHOT ( SHA: e8a5fe82095d0ca622ab4efd37afd1b8d9ac95c7 )
-->

…he printing of the footer manifest comment "Modified by POM Manipulation Extension for Maven"

cunningt · 2026-08-24T17:53:59Z

@rnc

rnc · 2026-08-25T11:11:40Z

+        this.handler = handler;
        parsePomTemplates = Boolean.parseBoolean(
                handler.getUserProperties().getProperty(PARSE_POM_TEMPLATES, "true"));
    }


Instead of storing the handler, why not just store a boolean like the parsePomTemplates ?

@rnc It doesn't seem to work for me with just the boolean and I am not sure that parsePomTemplates works - I'm trying to verify locally

java -jar /Users/tcunning/src/community/pom-manipulation-ext/cli/target/pom-manipulation-cli-5.6-SNAPSHOT.jar -f /tmp/pme-test/pom.xml -DversionSuffix=redhat-1 -DsuppressManifestComment=true

Without the maven handler, I'm still seeing manifest comments.

Here's what Claude is telling me about that

PomIO is looked up (and constructed) at line 355, before the MavenSession with user properties is set on ManipulationSession at line 402. At construction time, ManipulationSession.mavenSession is null, so getUserProperties() returns an empty Properties — and suppressManifestComment defaults to false.

This is why the original code stored the handler reference and read the property lazily in write() — by that point the session is fully initialized. The parsePomTemplates property has the same bug but nobody notices because its default (true) is the normal desired behavior.

@cunningt Huh, good spot! Bob agrees with you - the creation in the Cli code versus the instantiation of the session later on. And the same applies when its running as an extension for that matter.

parsePomTemplates was added a long time ago and at some point I meant to remove it. Its an undocumented flag that was intended to be removed 4 years ago - feel free to remove it now if it would simplify the code.

rnc · 2026-08-25T15:16:20Z

@cunningt Can you also add a PR to the gh-pages branch to document this please?

cunningt · 2026-08-25T15:43:54Z

@cunningt Can you also add a PR to the gh-pages branch to document this please?

#1188

github-actions · 2026-08-25T15:51:32Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 124 dependencies

Detected 4 vulnerabilities (0 Critical, 2 High, 2 Medium, 0 Low)

+----------+----------------------------+----------------+--------------------------------------------------------------------------------------------+
| SEVERITY |          LIBRARY           |       ID       |                                          TOP FIX                                           |
+----------+----------------------------+----------------+--------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.22.1.jar           | CVE-2026-75140 | N/A                                                                                        |
+----------+----------------------------+----------------+--------------------------------------------------------------------------------------------+
| HIGH     | logback-classic-1.5.37.jar | CVE-2026-19880 | Upgrade to version ch.qos.logback:logback-classic:1.6.3                                    |
+----------+----------------------------+----------------+--------------------------------------------------------------------------------------------+
| MEDIUM   | ivy-2.5.3.jar              | CVE-2026-26032 | Upgrade to version org.apache.ivy:ivy:2.6.0, https://github.com/apache/ant-ivy.git -       |
|          |                            |                | rel/2.6.0                                                                                  |
+----------+----------------------------+----------------+--------------------------------------------------------------------------------------------+
| MEDIUM   | jsoup-1.22.1.jar           | CVE-2026-71497 | Upgrade to version org.jsoup:jsoup:1.23.1, https://github.com/jhy/jsoup.git - jsoup-1.23.1 |
+----------+----------------------------+----------------+--------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

pom-manipulation-cli-5.6-SNAPSHOT.jar
|-- logback-classic-1.5.37.jar [1 HIGH]
|-- ivy-2.5.3.jar [1 MEDIUM]
|-- groovy-xml-3.0.25.jar
	|-- groovy-3.0.25.jar
		|-- ivy-2.5.3.jar [1 MEDIUM]
|-- atlas-identities-1.2.2.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
|-- org.eclipse.sisu.plexus-0.9.0.M4.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
|-- pom-manipulation-common-5.6-SNAPSHOT.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
|-- pom-manipulation-core-5.6-SNAPSHOT.jar
	|-- ivy-2.5.3.jar [1 MEDIUM]
	|-- galley-maven-1.22.jar
		|-- atlas-relationships-api-1.2.2.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
			|-- atlas-bindings-jackson-identities-1.2.2.jar
				|-- logback-classic-1.5.37.jar [1 HIGH]
|-- pom-manipulation-io-5.6-SNAPSHOT.jar
	|-- galley-core-1.22.jar
		|-- weft-1.26.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- galley-transport-httpclient-1.22.jar
		|-- jhttpc-1.17.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
		|-- jsoup-1.22.1.jar [1 HIGH, 1 MEDIUM]
pom-manipulation-core-5.6-SNAPSHOT.jar
|-- atlas-identities-1.2.2.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
|-- galley-maven-1.22.jar
	|-- atlas-relationships-api-1.2.2.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
		|-- atlas-bindings-jackson-identities-1.2.2.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
|-- org.eclipse.sisu.plexus-0.9.0.M4.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
|-- pom-manipulation-common-5.6-SNAPSHOT.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
|-- pom-manipulation-io-5.6-SNAPSHOT.jar
	|-- galley-core-1.22.jar
		|-- weft-1.26.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- galley-transport-httpclient-1.22.jar
		|-- jhttpc-1.17.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
		|-- jsoup-1.22.1.jar [1 HIGH, 1 MEDIUM]
pom-manipulation-coverage-5.6-SNAPSHOT.pom
|-- pom-manipulation-cli-5.6-SNAPSHOT.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- ivy-2.5.3.jar [1 MEDIUM]
|-- pom-manipulation-common-5.6-SNAPSHOT.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
|-- pom-manipulation-core-5.6-SNAPSHOT.jar
	|-- ivy-2.5.3.jar [1 MEDIUM]
	|-- atlas-identities-1.2.2.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- galley-maven-1.22.jar
		|-- atlas-relationships-api-1.2.2.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
			|-- atlas-bindings-jackson-identities-1.2.2.jar
				|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- org.eclipse.sisu.plexus-0.9.0.M4.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
|-- pom-manipulation-ext-5.6-SNAPSHOT.jar
	|-- ivy-2.5.3.jar [1 MEDIUM]
	|-- maven-release-manager-3.3.1.jar
		|-- org.eclipse.sisu.inject-0.9.0.M4.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- galley-core-1.22.jar
		|-- weft-1.26.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- galley-transport-httpclient-1.22.jar
		|-- jhttpc-1.17.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
		|-- jsoup-1.22.1.jar [1 HIGH, 1 MEDIUM]
|-- pom-manipulation-integration-test-5.6-SNAPSHOT.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- groovy-3.0.25.jar
		|-- ivy-2.5.3.jar [1 MEDIUM]
	|-- pom-manipulation-cli-5.6-SNAPSHOT-minimal.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
		|-- ivy-2.5.3.jar [1 MEDIUM]
pom-manipulation-ext-5.6-SNAPSHOT.jar
|-- ivy-2.5.3.jar [1 MEDIUM]
|-- groovy-3.0.25.jar
	|-- ivy-2.5.3.jar [1 MEDIUM]
|-- atlas-identities-1.2.2.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
|-- galley-core-1.22.jar
	|-- weft-1.26.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
|-- galley-maven-1.22.jar
	|-- atlas-relationships-api-1.2.2.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
		|-- atlas-bindings-jackson-identities-1.2.2.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
|-- galley-transport-httpclient-1.22.jar
	|-- jhttpc-1.17.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- jsoup-1.22.1.jar [1 HIGH, 1 MEDIUM]
|-- org.eclipse.sisu.plexus-0.9.0.M4.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
|-- pom-manipulation-common-5.6-SNAPSHOT.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
|-- pom-manipulation-core-5.6-SNAPSHOT.jar
	|-- ivy-2.5.3.jar [1 MEDIUM]
pom-manipulation-integration-test-5.6-SNAPSHOT.jar
|-- logback-classic-1.5.37.jar [1 HIGH]
|-- groovy-3.0.25.jar
	|-- ivy-2.5.3.jar [1 MEDIUM]
|-- pom-manipulation-cli-5.6-SNAPSHOT-minimal.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- ivy-2.5.3.jar [1 MEDIUM]
|-- pom-manipulation-common-5.6-SNAPSHOT.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- atlas-identities-1.2.2.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
|-- pom-manipulation-core-5.6-SNAPSHOT.jar
	|-- ivy-2.5.3.jar [1 MEDIUM]
	|-- org.eclipse.sisu.plexus-0.9.0.M4.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
|-- pom-manipulation-io-5.6-SNAPSHOT.jar
	|-- maven-release-manager-3.3.1.jar
		|-- org.eclipse.sisu.inject-0.9.0.M4.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- galley-core-1.22.jar
		|-- weft-1.26.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- galley-maven-1.22.jar
		|-- atlas-relationships-api-1.2.2.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
			|-- atlas-bindings-jackson-identities-1.2.2.jar
				|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- galley-transport-httpclient-1.22.jar
		|-- jhttpc-1.17.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
		|-- jsoup-1.22.1.jar [1 HIGH, 1 MEDIUM]
pom-manipulation-io-5.6-SNAPSHOT.jar
|-- atlas-identities-1.2.2.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]
|-- galley-core-1.22.jar
	|-- weft-1.26.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
|-- galley-maven-1.22.jar
	|-- atlas-relationships-api-1.2.2.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
		|-- atlas-bindings-jackson-identities-1.2.2.jar
			|-- logback-classic-1.5.37.jar [1 HIGH]
|-- galley-transport-httpclient-1.22.jar
	|-- jhttpc-1.17.jar
		|-- logback-classic-1.5.37.jar [1 HIGH]
	|-- jsoup-1.22.1.jar [1 HIGH, 1 MEDIUM]
|-- pom-manipulation-common-5.6-SNAPSHOT.jar
	|-- logback-classic-1.5.37.jar [1 HIGH]


No Policy violations were detected

Project 'pom-manipulation-ext' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=075c6d5a-0def-4e8c-a0ee-0cec98171bbc
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=72296f38fc25458c9def76cf0806c3197bf21c40d1db4af89c6e80faca013636

Mend AI scan succeeded.

Support Token: 1b38476f3525940678d6a4bca2604d62c1787673035723

SAST scan output

*no findings*

Full logs and artifacts

NCLSUP-1478 Add a suppressManifestComment option that will suppress t…

f13ef92

…he printing of the footer manifest comment "Modified by POM Manipulation Extension for Maven"

rnc reviewed Aug 25, 2026

View reviewed changes

rnc approved these changes Aug 25, 2026

View reviewed changes

rnc merged commit 73b211d into project-ncl:main Aug 25, 2026
12 checks passed

Navigation Menu

Uh oh!

NCLSUP-1478 Add a suppressManifestComment option - #1186

NCLSUP-1478 Add a suppressManifestComment option#1186
rnc merged 1 commit into
project-ncl:mainfrom
cunningt:NCLSUP-1478

cunningt commented Aug 24, 2026 •

edited

Loading

Uh oh!

cunningt commented Aug 24, 2026

Uh oh!

rnc Aug 25, 2026

Uh oh!

cunningt Aug 25, 2026 •

edited

Loading

Uh oh!

rnc Aug 25, 2026

Uh oh!

rnc commented Aug 25, 2026

Uh oh!

cunningt commented Aug 25, 2026

Uh oh!

github-actions Bot commented Aug 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

cunningt commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cunningt commented Aug 24, 2026

Uh oh!

rnc Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

cunningt Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rnc Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

rnc commented Aug 25, 2026

Uh oh!

cunningt commented Aug 25, 2026

Uh oh!

github-actions Bot commented Aug 25, 2026

Mend Scan Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cunningt commented Aug 24, 2026 •

edited

Loading

cunningt Aug 25, 2026 •

edited

Loading