protobuf-maven-plugin No Longer Maintained

[adambkaplan]

Modelmesh has a dependency on the org.xolstice.maven.plugins:protobuf-maven-plugin, which is no longer maintained. Continued use of this plugin may pose a software supply chain risk to the project.

The plugin also includes mechanisms to download dependencies outside of Maven's standard resolution flows (see here). This makes it difficult for tools to statically compute a full dependency tree for the project.

[spolti]

Hi, can you please share the source of the information? Looking at the project in GitHub, they made a new release 1 day ago.

[adambkaplan]

This is the plugin I was referring to in the POM:

https://github.com/kserve/modelmesh/blob/main/pom.xml#L113-L116

According to Maven Central, the homepage is here, which points to a read-only GitHub repository: https://github.com/xolstice/protobuf-maven-plugin