[dep] upgrade uship, fusion, tomcat and commons-compress

yupiik · Nov 25, 2024 · 243955a · 243955a
1 parent 001bec2
commit 243955a
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 5 deletions.
diff --git a/pom.xml b/pom.xml
@@ -30,10 +30,10 @@
   <properties>
     <junit5.version>5.10.2</junit5.version>
     <owb.version>2.0.27</owb.version>
-    <uship.version>1.0.17</uship.version>
+    <uship.version>1.0.19</uship.version>
     <yupiik-logging.version>1.0.8</yupiik-logging.version>
-    <fusion.version>1.0.18</fusion.version>
-    <tomcat.version>10.1.24</tomcat.version>
+    <fusion.version>1.0.21</fusion.version>
+    <tomcat.version>10.1.33</tomcat.version>
     <xbean.version>4.24</xbean.version>
   </properties>
 
@@ -63,7 +63,19 @@
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-compress</artifactId>
-        <version>1.26.1</version>
+        <version>1.26.2</version>
+        <!-- [CVE-2024-47554] in commons-io:commons-io:jar:2.11.0 -->
+        <exclusions>
+          <exclusion>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+      <dependency>
+        <groupId>commons-io</groupId>
+        <artifactId>commons-io</artifactId>
+        <version>2.18.0</version>
       </dependency>
     </dependencies>
   </dependencyManagement>

diff --git a/yupiik-batch-ui/yupiik-batch-ui-backend/pom.xml b/yupiik-batch-ui/yupiik-batch-ui-backend/pom.xml
@@ -41,7 +41,7 @@
     <dependency>
       <groupId>org.apache.tomcat</groupId>
       <artifactId>tomcat-jdbc</artifactId>
-      <version>10.0.27</version>
+      <version>${tomcat.version}</version>
     </dependency>
 
     <!-- we will bundle the front in the server to simplify the deployment -->
@@ -55,6 +55,17 @@
       <groupId>org.apache.openwebbeans</groupId>
       <artifactId>openwebbeans-junit5</artifactId>
       <version>${owb.version}</version>
+      <!-- conflict with jsonrpc-core dependencies -->
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.xbean</groupId>
+          <artifactId>xbean-asm9-shaded</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.xbean</groupId>
+          <artifactId>xbean-finder-shaded</artifactId>
+        </exclusion>
+      </exclusions>
       <classifier>jakarta</classifier>
       <scope>test</scope>
     </dependency>