Merge branch 'master' into OKAPI-1191-timer-NumberFormatException

folio-org · Sep 14, 2024 · 2755bd6 · 2755bd6
2 parents 7217574 + 752cab2
commit 2755bd6
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 1 deletion.
diff --git a/okapi-core/pom.xml b/okapi-core/pom.xml
@@ -127,6 +127,15 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <!-- raml-tester uses vulnerable commons-io 2.2:
+         https://security.snyk.io/package/maven/commons-io:commons-io/2.2
+    -->
+    <dependency>
+      <groupId>commons-io</groupId>
+      <artifactId>commons-io</artifactId>
+      <version>2.16.1</version>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>io.vertx</groupId>
       <artifactId>vertx-hazelcast</artifactId>

diff --git a/pom.xml b/pom.xml
@@ -120,10 +120,36 @@
       <dependency>
         <groupId>org.testcontainers</groupId>
         <artifactId>testcontainers-bom</artifactId>
-        <version>1.19.5</version>
+        <version>1.20.1</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- testcontainers doesn't bump vulnerable commons-compress
+           https://github.com/testcontainers/testcontainers-java/pull/8354#issuecomment-1957345903 -->
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-compress</artifactId>
+        <version>1.27.0</version>
+      </dependency>
+      <!-- testcontainers requires a recent commons-lang3, io.rest-assured:xml-path downgrades it to 3.11 -->
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-lang3</artifactId>
+        <version>3.16.0</version>
+      </dependency>
+      <!-- unmaintained raml-tester doesn't bump vulnerable commons-fileupload
+           https://github.com/nidi3/raml-tester -->
+      <dependency>
+        <groupId>commons-fileupload</groupId>
+        <artifactId>commons-fileupload</artifactId>
+        <version>1.5</version>
+      </dependency>
+      <!-- unmaintained raml-tester uses old commons-io 2.11.0, testcontainers requires a more recent one -->
+      <dependency>
+        <groupId>commons-io</groupId>
+        <artifactId>commons-io</artifactId>
+        <version>2.16.1</version>
+      </dependency>
       <dependency>
         <groupId>org.mockito</groupId>
         <artifactId>mockito-bom</artifactId>