outside of the safe formats, etc.) are not treated as vulnerabilities.

### Reporting process

Please use [Google Bug Hunters reporting form](https://g.co/vulnz) to report
security vulnerabilities. Please include the following information along with
your report:

  - A descriptive title
  - Your name and affiliation (if any).

        return onlineRequired;
    }

    /**
     * @return the bound phase name of the Mojo
     */
    public String getPhase() {
        return phase;
    }

    /**
     * @param phase the new bound phase name of the Mojo
     */
    public void setPhase(String phase) {
        this.phase = phase;
    }

    /**
     * @return the version when the Mojo was added to the API

We have a lifecycle mapping for the packaging of *jar* below. You see that for this packaging we have a *default* lifecycle and a list of phases where each phase is a comma separated list of goals to run and they are in the form groupId:artifactId:version.

<configuration>
  <lifecycles>
    <lifecycle>
      <id>default</id>
      <phases>
        <process-resources>org.apache.maven.plugins:maven-resources-plugin:resources</process-resources>

    /**
     * Enables/disables two-phase building. If enabled, the initial invocation of the model builder will only produce an
     * interim result which may be used to analyze inter-model dependencies before the final invocation of the model
     * builder is performed.
     *
     * @param twoPhaseBuilding {@code true} to enable two-phase building, {@code false} if the model should be built in

        </field>
        <field>
          <name>phase</name>
          <version>1.0.0+</version>
          <type>String</type>
          <description>
            Defines a default phase to bind a Mojo execution to if the user does not explicitly set a phase in the POM.

    private final String phase;

    /**
     * The priority of this dynamic phase within the static phase.
     */
    private final int priority;

    /**
     * Parses the phase identifier.
     *
     * @param phase the phase identifier.
     * @return the {@link PhaseId}.
     */
    public static synchronized PhaseId of(String phase) {
        return INSTANCES.computeIfAbsent(phase, PhaseId::new);
    }

    /**

 with its <<<DefaultLifecycleExecutor>>> implementation({{{/xref/org/apache/maven/lifecycle/DefaultLifecycleExecutor.html}source}}), to plan or execute tasks.\
   on plugin goals execution order:

   * <<in a given phase, goals order is not expected to be guaranteed nor finely tuned>>:
     it is just a consequence of the order obtained during {{{../maven-model-builder/}effective model building}},

 {{{./xref/org/apache/maven/model/building/DefaultModelBuilder.html}source}})
 that manages the steps sequence.

 The sequence is divided into 2 phases:

 * phase 1

   ** profile activation: see {{{./apidocs/org/apache/maven/model/profile/activation/package-summary.html}available activators}}.

                List<String> phases = shellContext.lookup.lookup(LifecycleRegistry.class).stream()
                        .flatMap(Lifecycle::allPhases)
                        .map(Lifecycle.Phase::name)
                        .toList();
                // TODO: add goals dynamically
                List<String> goals = List.of("wrapper:wrapper");
                names = Stream.concat(phases.stream(), goals.stream()).toList();

    }

    @Test
    void testSet() {
        LifecyclePhase phase = new LifecyclePhase();
        assertNull(phase.getMojos());

        phase.set("");
        assertNotNull(phase.getMojos());
        assertEquals(0, phase.getMojos().size());

        phase.set("jar:jar, war:war");

        List<LifecycleMojo> mojos = phase.getMojos();
        assertNotNull(mojos);