Merge pull request #12 from mxfo/pr/dependencies

[dep] upgrade uship, fusion, tomcat and commons-compress
yupiik · Nov 26, 2024 · 6ecd10c · 6ecd10c
2 parents 001bec2 + 303d3be
commit 6ecd10c
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 6 deletions.
diff --git a/pom.xml b/pom.xml
@@ -30,11 +30,14 @@
   <properties>
     <junit5.version>5.10.2</junit5.version>
     <owb.version>2.0.27</owb.version>
-    <uship.version>1.0.17</uship.version>
+    <uship.version>1.0.19</uship.version>
     <yupiik-logging.version>1.0.8</yupiik-logging.version>
-    <fusion.version>1.0.18</fusion.version>
-    <tomcat.version>10.1.24</tomcat.version>
+    <fusion.version>1.0.21</fusion.version>
+    <tomcat.version>10.1.33</tomcat.version>
     <xbean.version>4.24</xbean.version>
+    <commons-compress.version>1.26.2</commons-compress.version>
+    <commons-io.version>2.18.0</commons-io.version>
+    <h2.version>2.2.224</h2.version>
   </properties>
 
   <modules>
@@ -52,7 +55,7 @@
       <dependency>
         <groupId>com.h2database</groupId>
         <artifactId>h2</artifactId>
-        <version>2.2.224</version>
+        <version>${h2.version}</version>
         <scope>test</scope>
       </dependency>
       <dependency>
@@ -63,7 +66,19 @@
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-compress</artifactId>
-        <version>1.26.1</version>
+        <version>${commons-compress.version}</version>
+        <!-- [CVE-2024-47554] in commons-io:commons-io:jar:2.11.0 -->
+        <exclusions>
+          <exclusion>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+      <dependency>
+        <groupId>commons-io</groupId>
+        <artifactId>commons-io</artifactId>
+        <version>${commons-io.version}</version>
       </dependency>
     </dependencies>
   </dependencyManagement>

diff --git a/yupiik-batch-ui/yupiik-batch-ui-backend/pom.xml b/yupiik-batch-ui/yupiik-batch-ui-backend/pom.xml
@@ -41,7 +41,7 @@
     <dependency>
       <groupId>org.apache.tomcat</groupId>
       <artifactId>tomcat-jdbc</artifactId>
-      <version>10.0.27</version>
+      <version>${tomcat.version}</version>
     </dependency>
 
     <!-- we will bundle the front in the server to simplify the deployment -->
@@ -55,6 +55,17 @@
       <groupId>org.apache.openwebbeans</groupId>
       <artifactId>openwebbeans-junit5</artifactId>
       <version>${owb.version}</version>
+      <!-- conflict with jsonrpc-core dependencies -->
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.xbean</groupId>
+          <artifactId>xbean-asm9-shaded</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.xbean</groupId>
+          <artifactId>xbean-finder-shaded</artifactId>
+        </exclusion>
+      </exclusions>
       <classifier>jakarta</classifier>
       <scope>test</scope>
     </dependency>