Force org.apache.commons:commons-compress version to 1.26.0 or gr…

…eater (#510) * Force `org.apache.commons:commons-compress` version to `1.26.0` or greater
creek-service · Jun 23, 2024 · a2d2396 · a2d2396
1 parent 8ddb6ac
commit a2d2396
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/build.gradle.kts b/build.gradle.kts
@@ -107,6 +107,12 @@ subprojects {
     val mockitoVersion: String by extra
 
     dependencies {
+        constraints {
+            implementation("org.apache.commons:commons-compress:1.26.2") {
+                because("earlier versions have a security vulnerabilities")
+            }
+        }
+
         implementation(platform("com.fasterxml.jackson:jackson-bom:$jacksonVersion"))
 
         testImplementation("org.creekservice:creek-test-util:$creekVersion")

diff --git a/json-serde/build.gradle.kts b/json-serde/build.gradle.kts
@@ -55,7 +55,6 @@ dependencies {
     testImplementation("org.testcontainers:junit-jupiter:$testContainersVersion")
     testImplementation("org.testcontainers:kafka:$testContainersVersion")
     testImplementation("org.creekservice:creek-observability-logging-fixtures:$creekVersion")
-    testImplementation("commons-codec:commons-codec:1.17.0")
 }
 
 // Patch Kafka Testcontainers jar into main test containers module to avoid split packages: