diff --git a/0001-Adapt-mvn-script.patch b/0001-adapt-mvn-script.patch
similarity index 69%
rename from 0001-Adapt-mvn-script.patch
rename to 0001-adapt-mvn-script.patch
index 0b5361b..9f8a75e 100644
--- a/0001-Adapt-mvn-script.patch
+++ b/0001-adapt-mvn-script.patch
@@ -1,14 +1,14 @@
-From 46041685a82b861bc8616bb603e341adb740a302 Mon Sep 17 00:00:00 2001
+From 405e23d53b66a688082ed8c22385c5174e212be4 Mon Sep 17 00:00:00 2001
 From: Michael Simacek <msimacek@redhat.com>
-Date: Wed, 1 Feb 2017 14:54:26 +0100
-Subject: [PATCH 1/3] Adapt mvn script
+Date: Mon, 25 May 2020 12:10:33 +0200
+Subject: [PATCH 1/4] adapt mvn script
 
 ---
- apache-maven/src/bin/mvn | 19 ++++++++++++++++---
- 1 file changed, 16 insertions(+), 3 deletions(-)
+ apache-maven/src/bin/mvn | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
 
 diff --git a/apache-maven/src/bin/mvn b/apache-maven/src/bin/mvn
-index a554c66..818cf70 100755
+index a554c66..0c07ba6 100644
 --- a/apache-maven/src/bin/mvn
 +++ b/apache-maven/src/bin/mvn
 @@ -22,7 +22,7 @@
@@ -55,15 +55,6 @@ index a554c66..818cf70 100755
  
  # make it fully qualified
  MAVEN_HOME=`cd "$MAVEN_HOME" && pwd`
-@@ -102,7 +115,7 @@ if [ ! -x "$JAVACMD" ] ; then
-   exit 1
- fi
- 
--CLASSWORLDS_JAR=`echo "${MAVEN_HOME}"/boot/plexus-classworlds-*.jar`
-+CLASSWORLDS_JAR=`build-classpath plexus-classworlds`
- CLASSWORLDS_LAUNCHER=org.codehaus.plexus.classworlds.launcher.Launcher
- 
- # For Cygwin, switch paths to Windows format before running java
 -- 
-2.17.1
+2.26.2
 
diff --git a/0002-Invoke-logback-via-reflection.patch b/0002-invoke-logback-via-reflection.patch
similarity index 89%
rename from 0002-Invoke-logback-via-reflection.patch
rename to 0002-invoke-logback-via-reflection.patch
index 71d45e6..0570159 100644
--- a/0002-Invoke-logback-via-reflection.patch
+++ b/0002-invoke-logback-via-reflection.patch
@@ -1,53 +1,53 @@
-From 4e1e32e3a96c6876a22cca6743288b8c8df4adb0 Mon Sep 17 00:00:00 2001
+From 3ce790eaafcf42e8720c778b712345f100064f38 Mon Sep 17 00:00:00 2001
 From: Michael Simacek <msimacek@redhat.com>
-Date: Tue, 6 Jun 2017 13:47:43 +0200
-Subject: [PATCH 2/3] Invoke logback via reflection
+Date: Mon, 25 May 2020 12:12:15 +0200
+Subject: [PATCH 2/4] invoke logback via reflection
 
 ---
  .../logging/impl/LogbackConfiguration.java    | 19 ++++++++++++++-----
  1 file changed, 14 insertions(+), 5 deletions(-)
 
 diff --git a/maven-embedder/src/main/java/org/apache/maven/cli/logging/impl/LogbackConfiguration.java b/maven-embedder/src/main/java/org/apache/maven/cli/logging/impl/LogbackConfiguration.java
-index 5d9fab7..ced38cb 100644
+index d16eaa9..51274eb 100644
 --- a/maven-embedder/src/main/java/org/apache/maven/cli/logging/impl/LogbackConfiguration.java
 +++ b/maven-embedder/src/main/java/org/apache/maven/cli/logging/impl/LogbackConfiguration.java
 @@ -35,22 +35,31 @@ public class LogbackConfiguration
-     @Override
-     public void setRootLoggerLevel( Level level )
-     {
--        ch.qos.logback.classic.Level value;
-+        String value;
-         switch ( level )
-         {
-             case DEBUG:
--                value = ch.qos.logback.classic.Level.DEBUG;
-+                value = "DEBUG";
-                 break;
- 
-             case INFO:
--                value = ch.qos.logback.classic.Level.INFO;
-+                value = "INFO";
-                 break;
- 
-             default:
--                value = ch.qos.logback.classic.Level.ERROR;
-+                value = "ERROR";
-                 break;
-         }
--        ( (ch.qos.logback.classic.Logger) LoggerFactory.getLogger( Logger.ROOT_LOGGER_NAME ) ).setLevel( value );
-+        Logger logger = LoggerFactory.getLogger( Logger.ROOT_LOGGER_NAME );
-+        try {
-+            Class<?> levelClass = Class.forName("ch.qos.logback.classic.Level");
-+            Object logbackLevel = levelClass.getField(value).get(null);
-+            Class<?> loggerClass = Class.forName("ch.qos.logback.classic.Logger");
-+            loggerClass.getMethod("setLevel", new Class<?>[] {levelClass})
-+                .invoke(logger, new Object[] {logbackLevel});
-+        } catch (Exception e) {
-+            throw new RuntimeException("Failed to initialize logback configuration", e);
-+        }
-     }
- 
-     @Override
+     @Override
+     public void setRootLoggerLevel( Level level )
+     {
+-        ch.qos.logback.classic.Level value;
++        String value;
+         switch ( level )
+         {
+             case DEBUG:
+-                value = ch.qos.logback.classic.Level.DEBUG;
++                value = "DEBUG";
+                 break;
+ 
+             case INFO:
+-                value = ch.qos.logback.classic.Level.INFO;
++                value = "INFO";
+                 break;
+ 
+             default:
+-                value = ch.qos.logback.classic.Level.ERROR;
++                value = "ERROR";
+                 break;
+         }
+-        ( (ch.qos.logback.classic.Logger) LoggerFactory.getLogger( Logger.ROOT_LOGGER_NAME ) ).setLevel( value );
++        Logger logger = LoggerFactory.getLogger( Logger.ROOT_LOGGER_NAME );
++        try {
++            Class<?> levelClass = Class.forName("ch.qos.logback.classic.Level");
++            Object logbackLevel = levelClass.getField(value).get(null);
++            Class<?> loggerClass = Class.forName("ch.qos.logback.classic.Logger");
++            loggerClass.getMethod("setLevel", new Class<?>[] {levelClass})
++                .invoke(logger, new Object[] {logbackLevel});
++        } catch (Exception e) {
++            throw new RuntimeException("Failed to initialize logback configuration", e);
++        }
+     }
+ 
+     @Override
 -- 
-2.17.1
+2.26.2
 
diff --git a/0003-use-non-shaded-HTTP-wagon.patch b/0003-use-non-shaded-HTTP-wagon.patch
new file mode 100644
index 0000000..b841134
--- /dev/null
+++ b/0003-use-non-shaded-HTTP-wagon.patch
@@ -0,0 +1,51 @@
+From 1a5ab44597d81d4001c70b425736754dc8a6b663 Mon Sep 17 00:00:00 2001
+From: Mikolaj Izdebski <mizdebsk@redhat.com>
+Date: Mon, 25 May 2020 12:13:20 +0200
+Subject: [PATCH 3/4] use non-shaded HTTP wagon
+
+---
+ apache-maven/pom.xml | 15 ---------------
+ pom.xml              |  1 -
+ 2 files changed, 16 deletions(-)
+
+diff --git a/apache-maven/pom.xml b/apache-maven/pom.xml
+index 82e12a3..f02a45e 100644
+--- a/apache-maven/pom.xml
++++ b/apache-maven/pom.xml
+@@ -63,21 +63,6 @@ under the License.
+     <dependency>
+       <groupId>org.apache.maven.wagon</groupId>
+       <artifactId>wagon-http</artifactId>
+-      <classifier>shaded</classifier>
+-      <exclusions>
+-        <exclusion>
+-          <groupId>org.apache.httpcomponents</groupId>
+-          <artifactId>httpclient</artifactId>
+-        </exclusion>
+-        <exclusion>
+-          <groupId>org.apache.httpcomponents</groupId>
+-          <artifactId>httpcore</artifactId>
+-        </exclusion>
+-        <exclusion>
+-          <groupId>org.apache.maven.wagon</groupId>
+-          <artifactId>wagon-http-shared</artifactId>
+-        </exclusion>
+-      </exclusions>
+     </dependency>
+     <dependency>
+       <!-- this is included in Wagon Http
+diff --git a/pom.xml b/pom.xml
+index 44e287a..cdef69c 100644
+--- a/pom.xml
++++ b/pom.xml
+@@ -328,7 +328,6 @@ under the License.
+         <groupId>org.apache.maven.wagon</groupId>
+         <artifactId>wagon-http</artifactId>
+         <version>${wagonVersion}</version>
+-        <classifier>shaded</classifier>
+         <exclusions>
+           <exclusion>
+             <groupId>commons-logging</groupId>
+-- 
+2.26.2
+
diff --git a/0004-remove-dependency-on-powermock.patch b/0004-remove-dependency-on-powermock.patch
new file mode 100644
index 0000000..d3b7855
--- /dev/null
+++ b/0004-remove-dependency-on-powermock.patch
@@ -0,0 +1,96 @@
+From 36e88235cc6cb2bdd335f004cae0356662f2d22b Mon Sep 17 00:00:00 2001
+From: Marian Koncek <mkoncek@redhat.com>
+Date: Mon, 25 May 2020 12:14:29 +0200
+Subject: [PATCH 4/4] remove dependency on powermock
+
+---
+ .../StringSearchModelInterpolatorTest.java    | 66 -------------------
+ 1 file changed, 66 deletions(-)
+
+diff --git a/maven-model-builder/src/test/java/org/apache/maven/model/interpolation/StringSearchModelInterpolatorTest.java b/maven-model-builder/src/test/java/org/apache/maven/model/interpolation/StringSearchModelInterpolatorTest.java
+index 45800d6..fbf3b23 100644
+--- a/maven-model-builder/src/test/java/org/apache/maven/model/interpolation/StringSearchModelInterpolatorTest.java
++++ b/maven-model-builder/src/test/java/org/apache/maven/model/interpolation/StringSearchModelInterpolatorTest.java
+@@ -36,8 +36,6 @@ import java.util.concurrent.FutureTask;
+ import static org.hamcrest.CoreMatchers.anyOf;
+ import static org.hamcrest.CoreMatchers.is;
+ import static org.junit.Assert.assertThat;
+-import static org.powermock.reflect.Whitebox.getField;
+-import static org.powermock.reflect.Whitebox.getInternalState;
+ 
+ /**
+  * @author jdcasey
+@@ -374,70 +372,6 @@ public class StringSearchModelInterpolatorTest
+         ) ) );
+     }
+ 
+-    public void testNotInterpolateObjectWithFile()
+-            throws Exception
+-    {
+-        Model model = new Model();
+-
+-        File baseDir = new File( System.getProperty( "user.dir" ) );
+-
+-        Properties p = new Properties();
+-
+-        ObjectWithNotInterpolatedFile obj = new ObjectWithNotInterpolatedFile( baseDir );
+-
+-        StringSearchModelInterpolator interpolator = (StringSearchModelInterpolator) createInterpolator();
+-
+-        ModelBuildingRequest config = createModelBuildingRequest( p );
+-
+-        SimpleProblemCollector collector = new SimpleProblemCollector();
+-        interpolator.interpolateObject( obj, model, new File( "." ), config, collector );
+-        assertProblemFree( collector );
+-
+-        //noinspection unchecked
+-        Map<Class<?>, ?> cache =
+-                (Map<Class<?>, ?>) getField( StringSearchModelInterpolator.class, "CACHED_ENTRIES" )
+-                        .get( null );
+-
+-        Object objCacheItem = cache.get( Object.class );
+-        Object fileCacheItem = cache.get( File.class );
+-
+-        assertNotNull( objCacheItem );
+-        assertNotNull( fileCacheItem );
+-
+-        assertThat( ( (Object[]) getInternalState( objCacheItem, "fields" ) ).length, is( 0 ) );
+-        assertThat( ( (Object[]) getInternalState( fileCacheItem, "fields" ) ).length, is( 0 ) );
+-    }
+-
+-    public void testNotInterpolateFile()
+-            throws Exception
+-    {
+-        Model model = new Model();
+-
+-        File baseDir = new File( System.getProperty( "user.dir" ) );
+-
+-        Properties p = new Properties();
+-
+-        StringSearchModelInterpolator interpolator = (StringSearchModelInterpolator) createInterpolator();
+-
+-        ModelBuildingRequest config = createModelBuildingRequest( p );
+-
+-        SimpleProblemCollector collector = new SimpleProblemCollector();
+-        interpolator.interpolateObject( baseDir, model, new File( "." ), config, collector );
+-        assertProblemFree( collector );
+-
+-        //noinspection unchecked
+-        Map<Class<?>, ?> cache =
+-                (Map<Class<?>, ?>) getField( StringSearchModelInterpolator.class, "CACHED_ENTRIES" )
+-                        .get( null );
+-
+-        Object fileCacheItem = cache.get( File.class );
+-
+-        assertNotNull( fileCacheItem );
+-
+-        assertThat( ( (Object[]) getInternalState( fileCacheItem, "fields" ) ).length, is( 0 ) );
+-    }
+-
+-
+     public void testConcurrentInterpolation()
+         throws Exception
+     {
+-- 
+2.26.2
+
diff --git a/CVE-2021-26291.patch b/CVE-2021-26291.patch
deleted file mode 100644
index 769c3d6..0000000
--- a/CVE-2021-26291.patch
+++ /dev/null
@@ -1,243 +0,0 @@
-From 046a11e967e31e1be83b72625d40193e9728699a Mon Sep 17 00:00:00 2001
-From: hboutemy@apache.org
-Date: Sat, 13 Mar 2021 18:40:48 +0100
-Subject: [PATCH] [MNG-7116] add support for mirrorOf external:http:*
-         [PATCH] [MNG-7117] add support for blocked mirror
-         [PATCH] [MNG-7118] block HTTP repositories by default
-
----
- .../repository/DefaultMirrorSelector.java     | 49 +++++++++++++++++--
- .../maven/bridge/MavenRepositorySystem.java   | 48 ++++++++++++++++--
- ...DefaultRepositorySystemSessionFactory.java |  4 +-
- maven-settings/pom.xml                        |  2 +-
- maven-settings/src/main/mdo/settings.mdo      | 17 ++++++-
- 5 files changed, 106 insertions(+), 14 deletions(-)
-
-diff --git a/maven-compat/src/main/java/org/apache/maven/repository/DefaultMirrorSelector.java b/maven-compat/src/main/java/org/apache/maven/repository/DefaultMirrorSelector.java
-index 6fa2c55..9ad4f47 100644
---- a/maven-compat/src/main/java/org/apache/maven/repository/DefaultMirrorSelector.java
-+++ b/maven-compat/src/main/java/org/apache/maven/repository/DefaultMirrorSelector.java
-@@ -41,6 +41,8 @@ public class DefaultMirrorSelector
- 
-     private static final String EXTERNAL_WILDCARD = "external:*";
- 
-+    private static final String EXTERNAL_HTTP_WILDCARD = "external:http:*";
-+
-     public Mirror getMirror( ArtifactRepository repository, List<Mirror> mirrors )
-     {
-         String repoId = repository.getId();
-@@ -68,9 +70,14 @@ public class DefaultMirrorSelector
-     }
- 
-     /**
--     * This method checks if the pattern matches the originalRepository. Valid patterns: * =
--     * everything external:* = everything not on the localhost and not file based. repo,repo1 = repo
--     * or repo1 *,!repo1 = everything except repo1
-+     * This method checks if the pattern matches the originalRepository. Valid patterns:
-+     * <ul>
-+     * <li>{@code *} = everything,</li>
-+     * <li>{@code external:*} = everything not on the localhost and not file based,</li>
-+     * <li>{@code external:http:*} = any repository not on the localhost using HTTP,</li>
-+     * <li>{@code repo,repo1} = {@code repo} or {@code repo1},</li>
-+     * <li>{@code *,!repo1} = everything except {@code repo1}.</li>
-+     * </ul>
-      *
-      * @param originalRepository to compare for a match.
-      * @param pattern used for match. Currently only '*' is supported.
-@@ -115,6 +122,12 @@ public class DefaultMirrorSelector
-                     result = true;
-                     // don't stop processing in case a future segment explicitly excludes this repo
-                 }
-+		// check for external:http:*
-+		else if ( EXTERNAL_HTTP_WILDCARD.equals( repo ) && isExternalHttpRepo( originalRepository ) )
-+		{
-+			result = true;
-+			// don't stop processing in case a future segment explicitly excludes this repo
-+                }
-                 else if ( WILDCARD.equals( repo ) )
-                 {
-                     result = true;
-@@ -136,9 +149,35 @@ public class DefaultMirrorSelector
-         try
-         {
-             URL url = new URL( originalRepository.getUrl() );
--            return !( url.getHost().equals( "localhost" ) || url.getHost().equals( "127.0.0.1" )
--                            || url.getProtocol().equals( "file" ) );
-+	    return !( isLocal( url.getHost() ) || url.getProtocol().equals( "file" ) );
-         }
-+	catch ( MalformedURLException e )
-+	{
-+	    // bad url just skip it here. It should have been validated already, but the wagon lookup will deal with it
-+            return false;
-+	}
-+    }
-+
-+    private static boolean isLocal( String host )
-+    {
-+	 return "localhost".equals( host ) || "127.0.0.1".equals( host );
-+    }
-+
-+    /**
-+     * Checks the URL to see if this repository refers to a non-localhost repository using HTTP.
-+     *
-+     * @param originalRepository
-+     * @return true if external.
-+     */
-+    static boolean isExternalHttpRepo( ArtifactRepository originalRepository )
-+    {
-+        try
-+        {
-+	     URL url = new URL( originalRepository.getUrl() );
-+	     return ( "http".equalsIgnoreCase( url.getProtocol() ) || "dav".equalsIgnoreCase( url.getProtocol() )
-+                 || "dav:http".equalsIgnoreCase( url.getProtocol() )
-+		 || "dav+http".equalsIgnoreCase( url.getProtocol() ) ) && !isLocal( url.getHost() );
-+	}
-         catch ( MalformedURLException e )
-         {
-             // bad url just skip it here. It should have been validated already, but the wagon lookup will deal with it
-diff --git a/maven-core/src/main/java/org/apache/maven/bridge/MavenRepositorySystem.java b/maven-core/src/main/java/org/apache/maven/bridge/MavenRepositorySystem.java
-index 84ad93c..1b1c1d5 100644
---- a/maven-core/src/main/java/org/apache/maven/bridge/MavenRepositorySystem.java
-+++ b/maven-core/src/main/java/org/apache/maven/bridge/MavenRepositorySystem.java
-@@ -622,6 +622,8 @@ public class MavenRepositorySystem
- 
-     private static final String EXTERNAL_WILDCARD = "external:*";
- 
-+    private static final String EXTERNAL_HTTP_WILDCARD = "external:http:*";
-+
-     public static Mirror getMirror( ArtifactRepository repository, List<Mirror> mirrors )
-     {
-         String repoId = repository.getId();
-@@ -649,8 +651,14 @@ public class MavenRepositorySystem
-     }
- 
-     /**
--     * This method checks if the pattern matches the originalRepository. Valid patterns: * = everything external:* =
--     * everything not on the localhost and not file based. repo,repo1 = repo or repo1 *,!repo1 = everything except repo1
-+     * This method checks if the pattern matches the originalRepository. Valid patterns:
-+     * <ul>
-+     * <li>{@code *} = everything,</li>
-+     * <li>{@code external:*} = everything not on the localhost and not file based,</li>
-+     * <li>{@code external:http:*} = any repository not on the localhost using HTTP,</li>
-+     * <li>{@code repo,repo1} = {@code repo} or {@code repo1},</li>
-+     * <li>{@code *,!repo1} = everything except {@code repo1}.</li>
-+     * </ul>
-      *
-      * @param originalRepository to compare for a match.
-      * @param pattern used for match. Currently only '*' is supported.
-@@ -694,6 +702,12 @@ public class MavenRepositorySystem
-                     result = true;
-                     // don't stop processing in case a future segment explicitly excludes this repo
-                 }
-+		// check for external:http:*
-+		else if ( EXTERNAL_HTTP_WILDCARD.equals( repo ) && isExternalHttpRepo( originalRepository ) )
-+		{
-+		    result = true;
-+		    // don't stop processing in case a future segment explicitly excludes this repo
-+                }
-                 else if ( WILDCARD.equals( repo ) )
-                 {
-                     result = true;
-@@ -715,8 +729,34 @@ public class MavenRepositorySystem
-         try
-         {
-             URL url = new URL( originalRepository.getUrl() );
--            return !( url.getHost().equals( "localhost" ) || url.getHost().equals( "127.0.0.1" )
--                            || url.getProtocol().equals( "file" ) );
-+	    return !( isLocal( url.getHost() ) || url.getProtocol().equals( "file" ) );
-+	}
-+	catch ( MalformedURLException e )
-+	{
-+            // bad url just skip it here. It should have been validated already, but the wagon lookup will deal with it
-+	    return false;
-+	}
-+     }
-+
-+     private static boolean isLocal( String host )
-+     {
-+	  return "localhost".equals( host ) || "127.0.0.1".equals( host );
-+     }
-+
-+     /**
-+      * Checks the URL to see if this repository refers to a non-localhost repository using HTTP.
-+      *
-+      * @param originalRepository
-+      * @return true if external.
-+      */
-+     static boolean isExternalHttpRepo( ArtifactRepository originalRepository )
-+     {
-+	 try
-+	 {
-+	     URL url = new URL( originalRepository.getUrl() );
-+	     return ( "http".equalsIgnoreCase( url.getProtocol() ) || "dav".equalsIgnoreCase( url.getProtocol() )
-+	         || "dav:http".equalsIgnoreCase( url.getProtocol() )
-+		 || "dav+http".equalsIgnoreCase( url.getProtocol() ) ) && !isLocal( url.getHost() );
-         }
-         catch ( MalformedURLException e )
-         {
-diff --git a/maven-core/src/main/java/org/apache/maven/internal/aether/DefaultRepositorySystemSessionFactory.java b/maven-core/src/main/java/org/apache/maven/internal/aether/DefaultRepositorySystemSessionFactory.java
-index 248a3b6..f262ad2 100644
---- a/maven-core/src/main/java/org/apache/maven/internal/aether/DefaultRepositorySystemSessionFactory.java
-+++ b/maven-core/src/main/java/org/apache/maven/internal/aether/DefaultRepositorySystemSessionFactory.java
-@@ -177,8 +177,8 @@ public class DefaultRepositorySystemSessionFactory
-         DefaultMirrorSelector mirrorSelector = new DefaultMirrorSelector();
-         for ( Mirror mirror : request.getMirrors() )
-         {
--            mirrorSelector.add( mirror.getId(), mirror.getUrl(), mirror.getLayout(), false, mirror.getMirrorOf(),
--                                mirror.getMirrorOfLayouts() );
-+	    mirrorSelector.add( mirror.getId(), mirror.getUrl(), mirror.getLayout(), false, mirror.isBlocked(),
-+			        mirror.getMirrorOf(), mirror.getMirrorOfLayouts() );
-         }
-         session.setMirrorSelector( mirrorSelector );
- 
-diff --git a/maven-settings/pom.xml b/maven-settings/pom.xml
-index c16e823..3242832 100644
---- a/maven-settings/pom.xml
-+++ b/maven-settings/pom.xml
-@@ -46,7 +46,7 @@ under the License.
-         <groupId>org.codehaus.modello</groupId>
-         <artifactId>modello-maven-plugin</artifactId>
-         <configuration>
--          <version>1.1.0</version>
-+          <version>1.2.0</version>
-           <models>
-             <model>src/main/mdo/settings.mdo</model>
-           </models>
-diff --git a/maven-settings/src/main/mdo/settings.mdo b/maven-settings/src/main/mdo/settings.mdo
-index 7547a9c..ca88c3b 100644
---- a/maven-settings/src/main/mdo/settings.mdo
-+++ b/maven-settings/src/main/mdo/settings.mdo
-@@ -632,7 +632,16 @@
-             The layouts of repositories being mirrored. This value can be used to restrict the usage
-             of the mirror to repositories with a matching layout (apart from a matching id). Since Maven 3.
-           </description>
--        </field>
-+         </field>
-+	 <field>
-+	   <name>blocked</name>
-+	   <version>1.2.0+</version>
-+	   <type>boolean</type>
-+	   <defaultValue>false</defaultValue>
-+	   <description>
-+	     Whether this mirror should be blocked from any download request but fail the download process, explaining why.
-+	   </description>
-+	 </field>
-       </fields>
-       <codeSegments>
-         <codeSegment>
-@@ -647,7 +656,11 @@
-         sb.append( "id=" ).append( this.getId() );
-         sb.append( ",mirrorOf=" ).append( mirrorOf );
-         sb.append( ",url=" ).append( this.url );
--        sb.append( ",name=" ).append( this.name );
-+	sb.append( ",name=" ).append( this.name );
-+	if ( isBlocked() )
-+	{
-+	    sb.append( ",blocked" );
-+	}
-         sb.append( "]" );
-         return sb.toString();
-     }
--- 
-2.23.0
-
diff --git a/apache-maven-3.5.4-src.tar.gz b/apache-maven-3.5.4-src.tar.gz
deleted file mode 100644
index 0e211c3..0000000
Binary files a/apache-maven-3.5.4-src.tar.gz and /dev/null differ
diff --git a/apache-maven-3.6.3-src.tar.gz b/apache-maven-3.6.3-src.tar.gz
new file mode 100644
index 0000000..799c1f1
Binary files /dev/null and b/apache-maven-3.6.3-src.tar.gz differ
diff --git a/maven.spec b/maven.spec
index ef11a1e..25c96e6 100644
--- a/maven.spec
+++ b/maven.spec
@@ -4,24 +4,27 @@
 %global confdir %{_sysconfdir}/%{name}%{?maven_version_suffix}
 Name:                maven
 Epoch:               1
-Version:             3.5.4
-Release:             10
+Version:             3.6.3
+Release:             1
 Summary:             Java project management and project comprehension tool
 License:             ASL 2.0 and MIT
 URL:                 http://maven.apache.org/
 Source0:             http://archive.apache.org/dist/maven/maven-3/%{version}/source/apache-maven-%{version}-src.tar.gz
 Source1:             maven-bash-completion
 Source2:             mvn.1
-Patch1:              0001-Adapt-mvn-script.patch
-Patch2:              0002-Invoke-logback-via-reflection.patch
-Patch3:              CVE-2021-26291.patch
-BuildRequires:       maven-local mvn(com.google.guava:guava:20.0)
+Patch1:              0001-adapt-mvn-script.patch
+Patch2:              0002-invoke-logback-via-reflection.patch
+Patch3:              0003-use-non-shaded-HTTP-wagon.patch
+Patch4:              0004-remove-dependency-on-powermock.patch
+
+BuildRequires:       maven-local
 BuildRequires:       mvn(com.google.inject:guice::no_aop:) mvn(commons-cli:commons-cli)
 BuildRequires:       mvn(commons-jxpath:commons-jxpath) mvn(javax.annotation:jsr250-api)
 BuildRequires:       mvn(javax.inject:javax.inject) mvn(junit:junit)
 BuildRequires:       mvn(org.apache.commons:commons-lang3) mvn(org.apache.maven:maven-parent:pom:)
 BuildRequires:       mvn(org.apache.maven.plugins:maven-assembly-plugin)
 BuildRequires:       mvn(org.apache.maven.plugins:maven-dependency-plugin)
+BuildRequires:       mvn(org.apache.maven.plugins:maven-failsafe-plugin)
 BuildRequires:       mvn(org.apache.maven.resolver:maven-resolver-api)
 BuildRequires:       mvn(org.apache.maven.resolver:maven-resolver-connector-basic)
 BuildRequires:       mvn(org.apache.maven.resolver:maven-resolver-impl)
@@ -30,29 +33,31 @@ BuildRequires:       mvn(org.apache.maven.resolver:maven-resolver-transport-wago
 BuildRequires:       mvn(org.apache.maven.resolver:maven-resolver-util)
 BuildRequires:       mvn(org.apache.maven.shared:maven-shared-utils)
 BuildRequires:       mvn(org.apache.maven.wagon:wagon-file)
-BuildRequires:       mvn(org.apache.maven.wagon:wagon-http::shaded:)
+BuildRequires:       mvn(org.apache.maven.wagon:wagon-http)
 BuildRequires:       mvn(org.apache.maven.wagon:wagon-provider-api)
-BuildRequires:       mvn(org.codehaus.modello:modello-maven-plugin)
+BuildRequires:       mvn(org.codehaus.modello:modello-maven-plugin) >= 1.11
 BuildRequires:       mvn(org.codehaus.mojo:build-helper-maven-plugin)
 BuildRequires:       mvn(org.codehaus.plexus:plexus-classworlds)
 BuildRequires:       mvn(org.codehaus.plexus:plexus-component-annotations)
 BuildRequires:       mvn(org.codehaus.plexus:plexus-component-metadata)
 BuildRequires:       mvn(org.codehaus.plexus:plexus-interpolation)
-BuildRequires:       mvn(org.codehaus.plexus:plexus-utils)
+BuildRequires:       mvn(org.codehaus.plexus:plexus-utils) >= 3.2.0
 BuildRequires:       mvn(org.eclipse.sisu:org.eclipse.sisu.inject)
 BuildRequires:       mvn(org.eclipse.sisu:org.eclipse.sisu.plexus)
 BuildRequires:       mvn(org.eclipse.sisu:sisu-maven-plugin) mvn(org.fusesource.jansi:jansi)
+BuildRequires:       mvn(org.hamcrest:hamcrest-library)
+BuildRequires:       mvn(org.jsoup:jsoup)
 BuildRequires:       mvn(org.mockito:mockito-core) >= 2 mvn(org.slf4j:jcl-over-slf4j)
 BuildRequires:       mvn(org.slf4j:slf4j-api) mvn(org.slf4j:slf4j-simple)
 BuildRequires:       mvn(org.sonatype.plexus:plexus-cipher)
-BuildRequires:       mvn(org.sonatype.plexus:plexus-sec-dispatcher) mvn(xmlunit:xmlunit)
+BuildRequires:       mvn(org.sonatype.plexus:plexus-sec-dispatcher) mvn(org.xmlunit:xmlunit-core) mvn(org.xmlunit:xmlunit-matchers)
 BuildRequires:       slf4j-sources = %{bundled_slf4j_version}
 %if %{with logback}
 BuildRequires:       mvn(ch.qos.logback:logback-classic)
 %endif
 Requires:            %{name}-lib = %{epoch}:%{version}-%{release}
-Requires(post): /usr/sbin/update-alternatives
-Requires(postun): /usr/sbin/update-alternatives
+Requires(post):      /usr/sbin/update-alternatives
+Requires(postun):    /usr/sbin/update-alternatives
 Requires:            java-1.8.0-devel
 Requires:            aopalliance apache-commons-cli apache-commons-codec apache-commons-io
 Requires:            apache-commons-lang3 apache-commons-logging atinject cdi-api
@@ -90,9 +95,11 @@ Summary:             API documentation for %{name}
 %setup -q -n apache-%{name}-%{version}
 %patch1 -p1
 %patch3 -p1
+%patch4 -p1
 find -name '*.jar' -not -path '*/test/*' -delete
 find -name '*.class' -delete
 find -name '*.bat' -delete
+%pom_remove_dep -r :powermock-reflect
 sed -i 's:\r::' apache-maven/src/conf/settings.xml
 rm apache-maven/src/main/appended-resources/META-INF/LICENSE.vm
 %pom_remove_plugin -r :animal-sniffer-maven-plugin
@@ -113,6 +120,14 @@ sed -i "
 %endif
 %mvn_alias :maven-resolver-provider :maven-aether-provider
 
+%pom_xpath_inject 'pom:build/pom:plugins' '
+<plugin>
+    <groupId>org.eclipse.sisu</groupId>
+    <artifactId>sisu-maven-plugin</artifactId>
+</plugin>' maven-model-builder/pom.xml
+
+%pom_xpath_set "//pom:dependency[pom:artifactId='jansi']/pom:version" 1.18
+
 %build
 %mvn_build -- -Dproject.build.sourceEncoding=UTF-8
 mkdir m2home
@@ -129,7 +144,7 @@ install -d -m 755 %{buildroot}%{_datadir}/bash-completion/completions/
 cp -a $M2_HOME/{bin,lib,boot} %{buildroot}%{homedir}/
 xmvn-subst -R %{buildroot} -s %{buildroot}%{homedir}
 build-jar-repository -s -p %{buildroot}%{homedir}/lib \
-    commons-{codec,logging} httpcomponents/{httpclient,httpcore} maven-wagon/http-shared
+    httpcomponents/{httpclient,httpcore} maven-wagon/http-shared
 rm %{buildroot}%{homedir}/lib/jboss-interceptors*.jar
 rm %{buildroot}%{homedir}/lib/javax.el-api*.jar
 ln -s %{_jnidir}/jansi-native/jansi-linux.jar %{buildroot}%{homedir}/lib/
@@ -177,6 +192,9 @@ if [[ $1 -eq 0 ]]; then update-alternatives --remove mvn %{homedir}/bin/mvn; fi
 %license LICENSE NOTICE
 
 %changelog
+* Mon Feb 21 2022 Ge Wang <wangge20@huawei.com> - 1:3.6.3-1
+- upgrade to version 3.6.3
+
 * Sat Jul 24 2021 wangyue <wangyue92@huawei.com> - 1:3.5.4-10
 - fix maven downgrade error