You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@turbine.apache.org by gk...@apache.org on 2023/10/12 11:33:33 UTC
[turbine-fulcrum-security] 01/02: updatei deps due to owasp dependency-check
This is an automated email from the ASF dual-hosted git repository.
gk pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/turbine-fulcrum-security.git
commit ea45b2c568acbc82684417d408ba98a437f88974
Author: Georg Kallidis <gk...@apache.org>
AuthorDate: Thu Oct 12 13:16:28 2023 +0200
updatei deps due to owasp dependency-check
---
hibernate/pom.xml | 2 +-
pom.xml | 2 +-
torque/pom.xml | 9 ++++++++-
3 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/hibernate/pom.xml b/hibernate/pom.xml
index 62bff34..4872d30 100644
--- a/hibernate/pom.xml
+++ b/hibernate/pom.xml
@@ -94,7 +94,7 @@
<dependency>
<artifactId>hsqldb</artifactId>
<groupId>org.hsqldb</groupId>
- <version>2.7.0</version>
+ <version>2.7.1</version>
<scope>test</scope>
</dependency>
<!-- testing dependencies -->
diff --git a/pom.xml b/pom.xml
index 6298572..4a6bc86 100644
--- a/pom.xml
+++ b/pom.xml
@@ -148,7 +148,7 @@
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
- <version>3.12.0</version>
+ <version>3.13.0</version>
</dependency>
</dependencies>
</dependencyManagement>
diff --git a/torque/pom.xml b/torque/pom.xml
index 5a71a57..301cb91 100644
--- a/torque/pom.xml
+++ b/torque/pom.xml
@@ -88,6 +88,13 @@
<artifactId>torque-runtime</artifactId>
<version>${torque.version}</version>
</dependency>
+ <!-- override transisitve dep in torque-runtime due to CVE-2022-42889 -->
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-text</artifactId>
+ <version>1.10.0</version>
+ </dependency>
+
<dependency>
<groupId>org.apache.fulcrum</groupId>
<artifactId>fulcrum-security-api</artifactId>
@@ -110,7 +117,7 @@
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-dbcp2</artifactId>
- <version>2.9.0</version>
+ <version>2.10.0</version>
</dependency>
<!-- override from torque -->