Commit 8de9f57
authored
chore: bump parent v49 -> v50 for plexus-archiver CVE fix (#349)
uportal-portlet-parent:50 patches CVE-2023-37460 (plexus-archiver
Arbitrary File Creation in AbstractUnArchiver, CVSS 8.1 HIGH) by
bumping maven-war-plugin 3.4.0 -> 3.5.1, which bundles the patched
plexus-archiver 4.10.4. Real-world risk for portlet builds is low
(we create WARs, the CVE is in the unarchive path) but the parent
shouldn't ship a known-vulnerable transitive by default.
Changes:
- pom.xml: <parent><version>49</version></> -> <version>50</version>.1 parent 540d168 commit 8de9f57
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
23 | 23 | | |
24 | 24 | | |
25 | 25 | | |
26 | | - | |
| 26 | + | |
27 | 27 | | |
28 | 28 | | |
29 | 29 | | |
| |||
0 commit comments