Skip to content

Commit c5dde97

Browse files
committed
Updated dependencies to fix CVEs and imports to address build issues
- fixed package imports in AuthenticationHelperImpl,DateUtils - upgraded below dependencies to resolve CVEs - spring-boot-dependencies version to 3.4.9 - spring-boot-maven-plugin version to 3.4.9 - tomcat-embed-core version to 11.0.3 to address CVE-2025-48989 - structured-logging version to 3.0.40 to address CVE-2025-48924 - private-api-sdk-java version to 4.0.350 - api-security-java version to 2.0.13 - commons-lang3 version to 3.18.0 to address CVE-2025-48924 - gson version to 2.13.1 to address CVE-2025-53864
1 parent 67920f2 commit c5dde97

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

pom.xml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
<spring-web.version>6.2.8</spring-web.version>
3333
<spring-security-core.version>6.5.1</spring-security-core.version>
3434
<gson.version>2.13.1</gson.version>
35+
<commons-lang3.version>3.18.0</commons-lang3.version>
3536
<!-- Internal -->
3637
<structured-logging.version>3.0.40</structured-logging.version>
3738
<private-api-sdk-java.version>4.0.350</private-api-sdk-java.version>
@@ -108,22 +109,25 @@
108109
<artifactId>structured-logging</artifactId>
109110
<version>${structured-logging.version}</version>
110111
<exclusions>
112+
<!-- excluding commons-lang3 to address CVE-2025-48924 transitive dependency -->
111113
<exclusion>
112114
<groupId>org.apache.commons</groupId>
113115
<artifactId>commons-lang3</artifactId>
114116
</exclusion>
115117
</exclusions>
116118
</dependency>
119+
<!-- included commons-lang3-3.18.0 to address CVE-2025-48924 -->
117120
<dependency>
118121
<groupId>org.apache.commons</groupId>
119122
<artifactId>commons-lang3</artifactId>
120-
<version>3.18.0</version>
123+
<version>${commons-lang3.version}</version>
121124
</dependency>
122125
<dependency>
123126
<groupId>uk.gov.companieshouse</groupId>
124127
<artifactId>private-api-sdk-java</artifactId>
125128
<version>${private-api-sdk-java.version}</version>
126129
<exclusions>
130+
<!-- Excluding to address CVE-2025-48989 tomcat-embed-core pulled transitively-->
127131
<exclusion>
128132
<groupId>org.apache.tomcat.embed</groupId>
129133
<artifactId>tomcat-embed-core</artifactId>
@@ -145,6 +149,7 @@
145149
<groupId>org.xmlunit</groupId>
146150
<artifactId>xmlunit-core</artifactId>
147151
</exclusion>
152+
<!-- Excluding to address CVE-2025-53864 gson pulled transitively-->
148153
<exclusion>
149154
<groupId>com.google.code.gson</groupId>
150155
<artifactId>gson</artifactId>

0 commit comments

Comments
 (0)