| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: apache-ivy | Distribution: openSUSE Tumbleweed |
| Version: 2.6.0 | Vendor: openSUSE |
| Release: 1.2 | Build date: Mon Jul 20 12:39:00 2026 |
| Group: Development/Tools/Building | Build host: reproducible |
| Size: 1469068 | Source RPM: apache-ivy-2.6.0-1.2.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://ant.apache.org/ivy/ | |
| Summary: Java-based dependency manager | |
Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies. It is designed as process agnostic and is not tied to any methodology or structure. while available as a standalone tool, Apache Ivy works particularly well with Apache Ant providing a number of powerful Ant tasks ranging from dependency resolution to dependency reporting and publication.
Apache-2.0
* Mon Jul 20 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to 2.6.0
* Security fix
+ CVE-2026-26032, bsc#1271727: Apache Ivy: PackagerResolver path
traversal vulnerability
* Bug fixes
+ the ivy:retrieve task failed when the retrieve pattern
contained some text in parentheses before the first token, for
instance: /jobs/lib (JDK 17)/[artifact].[ext] (IVY-1660)
+ when the ivy:deliver task is configured to replace dynamic
revisions, it now replaces these revisions to the resolved
revision before any conflict resolution was done, which was
the original behavior before Ivy 2.3.0. This way, the
delivered ivy.xml can be used to have reproducible dependency
resolution, especially when multiple configurations are used.
It also fixes issues where the dynamic revisions were replaced
by versions from other configurations. (IVY-1485, IVY-1661)
+ the ivy:deliver task didn’t replace dynamic revision from
inherited dependencies. (IVY-1410)
+ the ivy:install task didn’t take the from resolver into
account when resolving Maven parent modules or
source/javadoc artifacts.
+ the ivy:checkdepsupdate task could suggest a lesser version as
update. (IVY-1665)
+ the ivy:makepom task no longer adds a dependency to the
<dependencyManagement> section. (IVY-1667)
+ the ivy:deliver task didn’t include XML namespaces from a
parent ivy module when merging the descriptors. (IVY-1658)
+ the ivy:checkdepsupdate task no longer shows evicted versions.
(IVY-1662)
* Improvements
+ use Apache Commons Compress for pack200 handling to avoid
issues on Java 14 and later. If pack200 is needed, make sure
to add Apache Commons Compress to your classpath. (IVY-1652)
+ ivy:retrieve and the 'post resolve tasks' now support the
override child element. (IVY-1664)
+ ivy:makepom will now add override elements of the ivy.xml to
the dependencyManagement section of the generated pom.
(IVY-1663)
+ ivy:deliver and ivy:publish now writes inherited dependencies
first to preserve resolve order (IVY-1656)
+ ModuleRevisionId.encodeToString now returns a deterministic
string that doesn’t rely on a implmentation of HashMap
* New feature
+ added a new nearest conflict manager, which handles conflicts
in the same way that Maven does. (IVY-813)
- Removed patch:
* apache-ivy-pack200.patch
+ not needed with this version
- Modified patches:
* apache-ivy-global-settings.patch
* apache-ivy-publication-date.patch
+ rediff and adapt to different line-endings
* Wed Apr 30 2025 Fridrich Strba <fstrba@suse.com>
- Use standalone pack200 implementation and allow wider variety
of Java versions
* Thu Jan 30 2025 Gus Kenion <gus.kenion@suse.com>
- Upgrade to version 2.5.3
* Bugfixes:
+ trying to set safe XML features causes SAXExceptions when
used with certain XML parsers (jira:IVY-1647[])
+ some unit tests failed on Java 8 (jira:IVY-1648[])
+ cached Ivy files were not valid in some scenarios
(jira:IVY-1649[], jira:IVY-1650[])
* Documentation:
+ improved to the documentation regarding the use of patterns
in the resolvers and retrieve task (jira:IVY-1651[])
- Update patch files for compatibility with 2.5.3:
* apache-ivy-global-settings.patch
* apache-ivy-publication-date.patch
* apache-ivy-pack200.patch
* Sun Sep 29 2024 Fridrich Strba <fstrba@suse.com>
- Fix build after removal of the default %%{java_home} define
* Tue Feb 20 2024 Dominique Leuenberger <dimstar@opensuse.org>
- Use %patch -P N instead of deprecated %patchN.
* Mon Oct 30 2023 Fridrich Strba <fstrba@suse.com>
- Added patch:
* apache-ivy-pack200.patch
+ conditionally apply to allow building against standalone
pack200 implementation
* Tue Sep 19 2023 Fridrich Strba <fstrba@suse.com>
- Added patch:
* apache-ivy-publication-date.patch
+ Use SOURCE_DATE_EPOCH for publication date in ivy artifacts
* Mon Aug 21 2023 Fridrich Strba <fstrba@suse.com>
- Upgrade to version 2.5.2 (bsc#1214422)
* Fixes:
+ ivy:retrieve could fail because of a 'NullPointerException'
(jira:IVY-1641[])
+ reading POMs may loose dependencies when multiple Maven
dependencies only differ in 'classifier' (jira:IVY-1642[])
+ CVE-2022-46751: Apache Ivy Is Vulnerable to XML External
Entity Injections
* Mon Nov 07 2022 David Anes <david.anes@suse.com>
- Upgrade to version 2.5.1 (bsc#1205142, bsc#1205138)
* Breaking:
+ Removed old fr\jayasoft\ivy\ant\antlib.xml AntLib definition
file.
* Fixes:
+ CVE-2022-37865 allow create/overwrite any file on the system.
(see https://ant.apache.org/ivy/security.html)
+ CVE-2022-37866 Path traversal in patterns.
(see https://ant.apache.org/ivy/security.html)
+ ResolveEngine resets dictator resolver to null in the global
configuration.
+ ConcurrentModificationException in
MessageLoggerHelper.sumupProblems.
+ useOrigin="true" fails with file-based ibiblio.
+ ivy:retrieve Ant task didn’t create an empty fileset when no
files were retrieved to a non-empty directory.
+ ivy:retrieve Ant task relied on the default HTTP header
"Accept" which caused problems with servers that interpret it
strictly (e.g. AWS CodeArtifact).
* Improvements:
+ Ivy command now accepts a URL for the -settings option.
* Sat Mar 19 2022 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 2.5.0
- Force building with JDK < 14, since it imports statically a class
removed in JDK14
- Change dependencies for the httpclient to httpcomponents-client
instead of apache-commons-httpclient
- Modified patch:
* apache-ivy-global-settings.patch
+ implement the same functionality with a bit of less code
- Removed patches:
* apache-ivy-2.4.0-jdk9.patch
* port-to-bc-1.52.patch
+ not needed with this version
/etc/ant.d/apache-ivy /usr/bin/ivy /usr/share/doc/packages/apache-ivy /usr/share/doc/packages/apache-ivy/README.adoc /usr/share/java/apache-ivy /usr/share/java/apache-ivy/ivy.jar /usr/share/java/ivy.jar /usr/share/licenses/apache-ivy /usr/share/licenses/apache-ivy/LICENSE /usr/share/licenses/apache-ivy/NOTICE /usr/share/man/man1/ivy.1.gz /usr/share/maven-metadata/apache-ivy.xml /usr/share/maven-poms/JPP-ivy.pom
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Aug 2 03:14:27 2026