This is an automated email from the ASF dual-hosted git repository. slachiewicz pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/maven-build-cache-extension.git
commit 1e7e4ea3cd5a56c7811a2ab8698c5771be9441b3 Author: Sylwester Lachiewicz <[email protected]> AuthorDate: Thu Oct 29 23:40:15 2026 +0000 Update test dependencies with known vulnerabilities --- pom.xml | 33 ++++++++++++++++++++++++++++----- 1 file changed, 28 insertions(+), 5 deletions(-) diff --git a/pom.xml b/pom.xml index e5b5ff90..d6326f47 100644 --- a/pom.xml +++ b/pom.xml @@ -94,12 +94,35 @@ under the License. <type>pom</type> <scope>import</scope> </dependency> - <!-- Testcontainers 2.x requires jackson-annotations >= 2.15 (for JsonFormat.Feature.READ_UNKNOWN_ENUM_VALUES_USING_DEFAULT_VALUE), - but wiremock-jre8 brings in 2.13.x. Force the newer version for the test classpath. --> + <!-- wiremock 3.13.2 brings in jackson 2.20.1, handlebars 4.3.1 and httpcore5 5.3.6, which have known + vulnerabilities. Force newer versions for the test classpath. Testcontainers 2.x also needs + jackson-annotations >= 2.15 (JsonFormat.Feature.READ_UNKNOWN_ENUM_VALUES_USING_DEFAULT_VALUE). --> <dependency> - <groupId>com.fasterxml.jackson.core</groupId> - <artifactId>jackson-annotations</artifactId> - <version>2.22</version> + <groupId>com.fasterxml.jackson</groupId> + <artifactId>jackson-bom</artifactId> + <version>2.22.4</version> + <type>pom</type> + <scope>import</scope> + </dependency> + <dependency> + <groupId>com.github.jknack</groupId> + <artifactId>handlebars</artifactId> + <version>4.5.8</version> + </dependency> + <dependency> + <groupId>com.github.jknack</groupId> + <artifactId>handlebars-helpers</artifactId> + <version>4.5.8</version> + </dependency> + <dependency> + <groupId>org.apache.httpcomponents.core5</groupId> + <artifactId>httpcore5</artifactId> + <version>5.4.4</version> + </dependency> + <dependency> + <groupId>org.apache.httpcomponents.core5</groupId> + <artifactId>httpcore5-h2</artifactId> + <version>5.4.4</version> </dependency> </dependencies> </dependencyManagement>
