cve

Signed-off-by: Adrian Cole <adrian.cole@elastic.co>
openzipkin · Feb 17, 2025 · 154f066 · 154f066
1 parent f9f93b1
commit 154f066
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/collector/kinesis/pom.xml b/collector/kinesis/pom.xml
@@ -25,6 +25,9 @@
     <maven.compiler.source>17</maven.compiler.source>
     <maven.compiler.target>17</maven.compiler.target>
     <maven.compiler.release>17</maven.compiler.release>
+
+    <!-- Avoid CVEs in kinesis deps -->
+    <protobuf.version>3.25.5</protobuf.version>
   </properties>
 
   <dependencies>
@@ -39,6 +42,18 @@
       <groupId>com.amazonaws</groupId>
       <artifactId>amazon-kinesis-client</artifactId>
       <version>1.15.2</version>
+      <exclusions>
+        <exclusion>
+          <groupId>com.google.protobuf</groupId>
+          <artifactId>protobuf-java</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+
+    <dependency>
+      <groupId>com.google.protobuf</groupId>
+      <artifactId>protobuf-java</artifactId>
+      <version>${protobuf.version}</version>
     </dependency>
 
     <dependency>