This document formally describes the process of addressing and managing a
reported vulnerability that has been found in the MinIO server code base,
any directly connected ecosystem component or a direct / indirect dependency
of the code base.

## Scope

The vulnerability management policy described in this document covers the
process of investigating, assessing and resolving a vulnerability report

 * <p>
 * Key components include:
 * <ul>
 *   <li>{@link org.apache.maven.api.model.Model} - The root element of a POM file</li>
 *   <li>{@link org.apache.maven.api.model.Dependency} - Represents a project dependency</li>
 *   <li>{@link org.apache.maven.api.model.Plugin} - Represents a Maven plugin configuration</li>
 *   <li>{@link org.apache.maven.api.model.Build} - Contains build configuration information</li>

import java.util.Date;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Properties;
import java.util.TimeZone;

import org.apache.maven.model.Dependency;
import org.apache.maven.model.Model;
import org.apache.maven.model.Resource;
import org.apache.maven.model.building.DefaultModelBuildingRequest;
import org.apache.maven.model.building.ModelBuildingRequest;

            if (data instanceof DependencyRequest request) {
                return "dependency resolution for " + request;
            } else if (data instanceof CollectRequest request) {
                return "dependency collection for " + request;
            } else if (data instanceof CollectStepData stepData) {
                String msg = "dependency collection step for " + stepData.getContext();
                if (detailed) {

    /**
     * Sets the filter used to exclude some dependencies from resolution. Note that this filter only controls the
     * resolution/download of dependency artifacts, not the inclusion of dependency nodes in the resolved dependency
     * graph.
     *
     * @param filter The filter to exclude dependencies from resolution, may be {@code null} to resolve all
     *            dependencies.

     *
     * <h4>Context-sensitive interpretation</h4>
     * A dependency with this path type will not necessarily be placed on the class path.
     * There are two circumstances where the dependency may nevertheless be placed somewhere else:
     *
     * <ul>
     *   <li>If {@link #MODULES} path type is also set, then the dependency can be placed either on the

        </configuration>
      </plugin>
    </plugins>
  </build>

  <dependencies>
    <dependency>
      <groupId>org.apache.maven.its.mng6300</groupId>
      <artifactId>mng6300-lib</artifactId>
      <version>1.0</version>
    </dependency>
  </dependencies>

    <maven.test.skip>true</maven.test.skip>
    <updateReleaseInfo>true</updateReleaseInfo>
  </properties>

  <dependencies>
    <dependency>
      <groupId>org.apache.maven</groupId>
      <artifactId>maven-plugin-api</artifactId>
      <version>2.0</version>
    </dependency>
  </dependencies>

  <build>
    <resources>
      <resource>
        <directory>.</directory>
        <includes>

    <maven.test.skip>true</maven.test.skip>
    <updateReleaseInfo>true</updateReleaseInfo>
  </properties>

  <dependencies>
    <dependency>
      <groupId>org.apache.maven</groupId>
      <artifactId>maven-plugin-api</artifactId>
      <version>2.0</version>
    </dependency>
  </dependencies>

  <build>
    <resources>
      <resource>
        <directory>.</directory>
        <includes>

        assertNotNull(result);
        List<Dependency> deps = new ArrayList<>(result.getDependencies().keySet());
        List<Dependency> deps2 = result.getNodes().stream()
                .map(Node::getDependency)
                .filter(Objects::nonNull)
                .collect(Collectors.toList());
        assertEquals(deps, deps2);
        for (Dependency dep : deps2) {
            dep.getVersion();
        }