CODAIT#288. Update dependencies to resolve security issues.

jackson-chris · Jul 2, 2021 · 958df20 · 958df20
1 parent f726f40
commit 958df20
Showing 1 changed file with 21 additions and 2 deletions.
diff --git a/pom.xml b/pom.xml
@@ -65,11 +65,11 @@
         <hadoop.version>2.7.3</hadoop.version>
         <junit.version>4.13.1</junit.version>
         <jackson.version>1.9.13</jackson.version>
-        <httpcomponents.httpcore.version>4.4.11</httpcomponents.httpcore.version>
+        <httpcomponents.httpcore.version>4.4.14</httpcomponents.httpcore.version>
         <httpcomponents.client5.version>5.0.3</httpcomponents.client5.version>
         <powermock.version>2.0.2</powermock.version>
         <mockito.version>2.28.2</mockito.version>
-        <amazon.sdk.version>1.11.596</amazon.sdk.version>
+        <amazon.sdk.version>1.11.1034</amazon.sdk.version>
         <google.guava.version>30.0-jre</google.guava.version>
     </properties>
 
@@ -91,6 +91,10 @@
             <version>${hadoop.version}</version>
             <scope>provided</scope>
             <exclusions>
+               <exclusion>
+                  <groupId>commons-codec</groupId>
+                  <artifactId>commons-codec</artifactId>
+               </exclusion>
                <exclusion>
                    <groupId>javax.servlet</groupId>
                    <artifactId>*</artifactId>
@@ -151,6 +155,10 @@
             <type>test-jar</type>
             <version>${hadoop.version}</version>
             <exclusions>
+               <exclusion>
+                  <groupId>commons-codec</groupId>
+                  <artifactId>commons-codec</artifactId>
+               </exclusion>
                <exclusion>
                    <groupId>javax.servlet</groupId>
                    <artifactId>*</artifactId>
@@ -208,6 +216,17 @@
             <artifactId>httpcore</artifactId>
             <version>${httpcomponents.httpcore.version}</version>
         </dependency>
+        <!-- override transitive dependency versions for security fixes -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.dataformat</groupId>
+            <artifactId>jackson-dataformat-cbor</artifactId>
+            <version>2.12.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+            <version>4.5.13</version>
+        </dependency>
         <!-- Test dependencies -->
         <dependency>
             <groupId>junit</groupId>