Skip to content

Commit 8de9f57

Browse files
authored
chore: bump parent v49 -> v50 for plexus-archiver CVE fix (#349)
uportal-portlet-parent:50 patches CVE-2023-37460 (plexus-archiver Arbitrary File Creation in AbstractUnArchiver, CVSS 8.1 HIGH) by bumping maven-war-plugin 3.4.0 -> 3.5.1, which bundles the patched plexus-archiver 4.10.4. Real-world risk for portlet builds is low (we create WARs, the CVE is in the unarchive path) but the parent shouldn't ship a known-vulnerable transitive by default. Changes: - pom.xml: <parent><version>49</version></> -> <version>50</version>.
1 parent 540d168 commit 8de9f57

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
<parent>
2424
<groupId>org.jasig.portlet</groupId>
2525
<artifactId>uportal-portlet-parent</artifactId>
26-
<version>49</version>
26+
<version>50</version>
2727
</parent>
2828

2929
<modelVersion>4.0.0</modelVersion>

0 commit comments

Comments
 (0)