From be2e60c853d439cb30835a8ab5f6958fa5426580 Mon Sep 17 00:00:00 2001
From: Chris Bono <chris.bono@gmail.com>
Date: Mon, 1 Apr 2024 00:37:36 -0500
Subject: [PATCH] Override commons-compress version to 1.26.1 (#629)

The `spring-pulsar-test` module has a dependency on
`org.testcontainers:testcontainers:1.19.7` which transitively brings
in `org.apache.commons:commons-compress:1.24.0` with its 2 CVEs.

In order to rid the `spring-pulsar-test` module from these piggy-backed
CVEs, this commit excludes `commons-compress` from the testcontainers
dependencies and includes `commons-compress:1.26.1`.
---
 gradle/libs.versions.toml                    |  2 ++
 spring-pulsar-test/spring-pulsar-test.gradle | 12 ++++++++++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index e8df9183..0476096a 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -1,6 +1,7 @@
 [versions]
 # product
 caffeine = "3.1.8"
+commons-compress = "1.26.1"
 jackson = "2.17.0"
 jsr305 = "3.0.2"
 logback = "1.4.14"
@@ -57,6 +58,7 @@ spring-retry = { module = "org.springframework.retry:spring-retry", version.ref
 # Testing libs
 assertj-bom = { module = "org.assertj:assertj-bom", version.ref = "assertj" }
 awaitility = { module = "org.awaitility:awaitility", version.ref = "awaitility" }
+commons-compress = { module = "org.apache.commons:commons-compress", version.ref = "commons-compress" }
 json-path = { module = "com.jayway.jsonpath:json-path", version.ref = "json-path" }
 junit-bom = { module = "org.junit:junit-bom", version.ref = "junit" }
 mockito-bom = { module = "org.mockito:mockito-bom", version.ref = "mockito" }
diff --git a/spring-pulsar-test/spring-pulsar-test.gradle b/spring-pulsar-test/spring-pulsar-test.gradle
index 9fd1c7c8..d3c989da 100644
--- a/spring-pulsar-test/spring-pulsar-test.gradle
+++ b/spring-pulsar-test/spring-pulsar-test.gradle
@@ -6,8 +6,16 @@ description = 'Spring Pulsar Test Utilities Module'
 
 dependencies {
     implementation 'org.junit.jupiter:junit-jupiter-api'
-    implementation 'org.testcontainers:pulsar'
-    implementation 'org.testcontainers:junit-jupiter'
+	// Testcontainers brings in commons-compress 1.24.0 which has 2 CVEs.
+	// Exclude and override version to 1.26.0 until TC updates to latest
+	// commons-compress.
+    implementation('org.testcontainers:pulsar') {
+		exclude group: 'org.apache.commons', module: 'commons-compress'
+	}
+    implementation('org.testcontainers:junit-jupiter') {
+		exclude group: 'org.apache.commons', module: 'commons-compress'
+	}
+	implementation libs.commons.compress
     implementation project(':spring-pulsar')
     testImplementation 'org.assertj:assertj-core'
     testImplementation 'org.junit.jupiter:junit-jupiter'