Fixes #3981 - Set Apache Compress as a direct dependency (#3982)

piranhacloud · Sep 22, 2024 · a5c7f59 · a5c7f59
1 parent 77a69f9
commit a5c7f59
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/pom.xml b/pom.xml
@@ -77,6 +77,7 @@
         <arquillian.version>1.8.0.Final</arquillian.version>
         <bcel.version>6.10.0</bcel.version>
         <checkstyle.version>10.18.1</checkstyle.version>
+        <commons-compress.version>1.26.2</commons-compress.version>
         <commons-fileupload2-jakarta-servlet6.version>2.0.0-M2</commons-fileupload2-jakarta-servlet6.version>
         <crac.version>0.1.3</crac.version>
         <eclipselink.version>5.0.0-B03</eclipselink.version>
@@ -172,6 +173,12 @@
 
     <dependencyManagement>
         <dependencies>
+            <!-- Apache Commons Compress -->
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-compress</artifactId>
+                <version>${commons-compress.version}</version>
+            </dependency>
             <!-- Apache Commons File Upload -->
             <dependency>
                 <groupId>org.apache.commons</groupId>

diff --git a/resource/shrinkwrap/pom.xml b/resource/shrinkwrap/pom.xml
@@ -16,6 +16,12 @@
 
     <dependencies>
         <!-- compile -->
+        <!-- declared as a direct dependency to deal with CVEs -->
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-compress</artifactId>
+            <scope>compile</scope>
+        </dependency>
         <dependency>
             <groupId>org.jboss.shrinkwrap</groupId>
             <artifactId>shrinkwrap-impl-base</artifactId>