[ACS-11984]: Review security and quality findings on Alfresco SDK (#765)

plugins/alfresco-maven-plugin/pom.xml

@@ -81,7 +81,7 @@
         <dependency>
             <groupId>org.apache.maven</groupId>
             <artifactId>maven-archiver</artifactId>
-            <version>3.6.0</version>
+            <version>3.6.6</version>
             <exclusions>
                 <exclusion>
                     <artifactId>maven-core</artifactId>
@@ -92,7 +92,7 @@
         <dependency>
             <groupId>org.codehaus.plexus</groupId>
             <artifactId>plexus-archiver</artifactId>
-            <version>4.11.0</version>
+            <version>4.12.0</version>
         </dependency>
         <dependency>
             <groupId>org.apache.maven</groupId>

pom.xml

@@ -449,6 +449,22 @@
         </profile>
     </profiles>
 
+    <!--
+        Date: 12-06-2026
+        Force transitive dependencies to safe versions.
+        Remove this when bumping the "alfresco-repository" 26.2 GA in the future,
+        as the fixed version of plexus-utils will be included in the dependency tree of the project.
+    -->
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.codehaus.plexus</groupId>
+                <artifactId>plexus-utils</artifactId>
+                <version>3.6.1</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <build>
         <pluginManagement>
             <plugins>