Hi. Due to a recent problem with apache-commons-text (CVE-2022-42889) we were trying to replace the commons-text-1.8 java library in our cas 6.1 deployment. I can get the non-vulnerable 1.10 version to be included in the build with an implementation clause in build.gradle, but the build still insists on copying also the vulnerable 1.8 version into the resulting war file.
If I use the exclude group functionality to prevent the 1.8 from being used, then the build fails because it can't find the 1.8 version. How can I get the commons-text-1.10 to replace the commons-text-1.8 so that the 1.8 is not included in the built war file? Or is this even practical and I should be trying some completely different approach? BR, Otto Myyrä -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscr...@apereo.org. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAAbxnYqOxnh%3D4Q7CPqnqjNA9yBCxRpZy3%3D2HPXEzHxSULr2V2A%40mail.gmail.com.
