From 909c8c0f7b9df12f5d40b5eb0649565433673a94 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Thu, 29 Oct 2026 23:21:32 +0000
Subject: [PATCH] Manage Apache MINA SSHD to 2.20.0

---
 pom.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pom.xml b/pom.xml
index 1db8f940..3118284e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -90,6 +90,7 @@ under the License.
 
   <properties>
     <scmVersion>2.2.1</scmVersion>
+    <minaSshdVersion>2.20.0</minaSshdVersion>
     <mavenVersion>3.9.16</mavenVersion>
     <resolverVersion>1.9.27</resolverVersion>
     <wagonVersion>3.5.3</wagonVersion>
@@ -197,6 +198,17 @@ under the License.
         <scope>test</scope>
       </dependency>
 
+      <!-- JGit 5.13 (via the maven-scm JGit provider) pulls in Apache MINA SSHD 2.7.0, which has known vulnerabilities -->
+      <dependency>
+        <groupId>org.apache.sshd</groupId>
+        <artifactId>sshd-sftp</artifactId>
+        <version>${minaSshdVersion}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.sshd</groupId>
+        <artifactId>sshd-osgi</artifactId>
+        <version>${minaSshdVersion}</version>
+      </dependency>
       <dependency>
         <groupId>org.apache.maven.scm</groupId>
         <artifactId>maven-scm-api</artifactId>