Spring/spring-pulsar
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Override commons-compress version to 1.26.1 (#629)

Browse Source 
The `spring-pulsar-test` module has a dependency on
`org.testcontainers:testcontainers:1.19.7` which transitively brings
in `org.apache.commons:commons-compress:1.24.0` with its 2 CVEs.

In order to rid the `spring-pulsar-test` module from these piggy-backed
CVEs, this commit excludes `commons-compress` from the testcontainers
dependencies and includes `commons-compress:1.26.1`.
This commit is contained in:
Chris Bono
2024-04-01 00:37:36 -05:00
committed by GitHub
parent 1eaad53903
commit be2e60c853
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
gradle/libs.versions.toml
View File

@@ -1,6 +1,7 @@
[versions]
# product
caffeine = "3.1.8"
commons-compress = "1.26.1"
jackson = "2.17.0"
jsr305 = "3.0.2"
logback = "1.4.14"
@@ -57,6 +58,7 @@ spring-retry = { module = "org.springframework.retry:spring-retry", version.ref
# Testing libs
assertj-bom = { module = "org.assertj:assertj-bom", version.ref = "assertj" }
awaitility = { module = "org.awaitility:awaitility", version.ref = "awaitility" }
commons-compress = { module = "org.apache.commons:commons-compress", version.ref = "commons-compress" }
json-path = { module = "com.jayway.jsonpath:json-path", version.ref = "json-path" }
junit-bom = { module = "org.junit:junit-bom", version.ref = "junit" }
mockito-bom = { module = "org.mockito:mockito-bom", version.ref = "mockito" }

12
spring-pulsar-test/spring-pulsar-test.gradle
View File

@@ -6,8 +6,16 @@ description = 'Spring Pulsar Test Utilities Module'
dependencies {
implementation 'org.junit.jupiter:junit-jupiter-api'
implementation 'org.testcontainers:pulsar'
implementation 'org.testcontainers:junit-jupiter'
// Testcontainers brings in commons-compress 1.24.0 which has 2 CVEs.
// Exclude and override version to 1.26.0 until TC updates to latest
// commons-compress.
implementation('org.testcontainers:pulsar') {
exclude group: 'org.apache.commons', module: 'commons-compress'
}
implementation('org.testcontainers:junit-jupiter') {
exclude group: 'org.apache.commons', module: 'commons-compress'
}
implementation libs.commons.compress
implementation project(':spring-pulsar')
testImplementation 'org.assertj:assertj-core'
testImplementation 'org.junit.jupiter:junit-jupiter'