From 243955ad36a843a7cac4caa587e99bad7f57c0c8 Mon Sep 17 00:00:00 2001
From: Maxime Fontaine <mfontaine@yupiik.com>
Date: Mon, 25 Nov 2024 17:22:17 +0400
Subject: [PATCH 1/2] [dep] upgrade uship, fusion, tomcat and commons-compress

---
 pom.xml                                       | 20 +++++++++++++++----
 .../yupiik-batch-ui-backend/pom.xml           | 13 +++++++++++-
 2 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/pom.xml b/pom.xml
index b4b59f8..82428fc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -30,10 +30,10 @@
   <properties>
     <junit5.version>5.10.2</junit5.version>
     <owb.version>2.0.27</owb.version>
-    <uship.version>1.0.17</uship.version>
+    <uship.version>1.0.19</uship.version>
     <yupiik-logging.version>1.0.8</yupiik-logging.version>
-    <fusion.version>1.0.18</fusion.version>
-    <tomcat.version>10.1.24</tomcat.version>
+    <fusion.version>1.0.21</fusion.version>
+    <tomcat.version>10.1.33</tomcat.version>
     <xbean.version>4.24</xbean.version>
   </properties>
 
@@ -63,7 +63,19 @@
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-compress</artifactId>
-        <version>1.26.1</version>
+        <version>1.26.2</version>
+        <!-- [CVE-2024-47554] in commons-io:commons-io:jar:2.11.0 -->
+        <exclusions>
+          <exclusion>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+      <dependency>
+        <groupId>commons-io</groupId>
+        <artifactId>commons-io</artifactId>
+        <version>2.18.0</version>
       </dependency>
     </dependencies>
   </dependencyManagement>
diff --git a/yupiik-batch-ui/yupiik-batch-ui-backend/pom.xml b/yupiik-batch-ui/yupiik-batch-ui-backend/pom.xml
index 7bd600d..dbd07dd 100644
--- a/yupiik-batch-ui/yupiik-batch-ui-backend/pom.xml
+++ b/yupiik-batch-ui/yupiik-batch-ui-backend/pom.xml
@@ -41,7 +41,7 @@
     <dependency>
       <groupId>org.apache.tomcat</groupId>
       <artifactId>tomcat-jdbc</artifactId>
-      <version>10.0.27</version>
+      <version>${tomcat.version}</version>
     </dependency>
 
     <!-- we will bundle the front in the server to simplify the deployment -->
@@ -55,6 +55,17 @@
       <groupId>org.apache.openwebbeans</groupId>
       <artifactId>openwebbeans-junit5</artifactId>
       <version>${owb.version}</version>
+      <!-- conflict with jsonrpc-core dependencies -->
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.xbean</groupId>
+          <artifactId>xbean-asm9-shaded</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.xbean</groupId>
+          <artifactId>xbean-finder-shaded</artifactId>
+        </exclusion>
+      </exclusions>
       <classifier>jakarta</classifier>
       <scope>test</scope>
     </dependency>

From 303d3be1edfb72d8be4c514b7f1a30d8ad3494b7 Mon Sep 17 00:00:00 2001
From: Maxime Fontaine <mfontaine@yupiik.com>
Date: Mon, 25 Nov 2024 17:40:14 +0400
Subject: [PATCH 2/2] [pom] use properties for dependencies version

---
 pom.xml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index 82428fc..42d7d1b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -35,6 +35,9 @@
     <fusion.version>1.0.21</fusion.version>
     <tomcat.version>10.1.33</tomcat.version>
     <xbean.version>4.24</xbean.version>
+    <commons-compress.version>1.26.2</commons-compress.version>
+    <commons-io.version>2.18.0</commons-io.version>
+    <h2.version>2.2.224</h2.version>
   </properties>
 
   <modules>
@@ -52,7 +55,7 @@
       <dependency>
         <groupId>com.h2database</groupId>
         <artifactId>h2</artifactId>
-        <version>2.2.224</version>
+        <version>${h2.version}</version>
         <scope>test</scope>
       </dependency>
       <dependency>
@@ -63,7 +66,7 @@
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-compress</artifactId>
-        <version>1.26.2</version>
+        <version>${commons-compress.version}</version>
         <!-- [CVE-2024-47554] in commons-io:commons-io:jar:2.11.0 -->
         <exclusions>
           <exclusion>
@@ -75,7 +78,7 @@
       <dependency>
         <groupId>commons-io</groupId>
         <artifactId>commons-io</artifactId>
-        <version>2.18.0</version>
+        <version>${commons-io.version}</version>
       </dependency>
     </dependencies>
   </dependencyManagement>