Merge branch '7.3-next' into 8.0-next

Normation · Sep 13, 2023 · 57403d2 · 57403d2
2 parents 6cfb3f6 + 595b57d
commit 57403d2
Showing 1 changed file with 18 additions and 0 deletions.
diff --git a/openscap/pom-template.xml b/openscap/pom-template.xml
@@ -55,6 +55,24 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <!-- Added due to CVE-2022-44729 in batik-css 1.16 that is a dependency of antisamy 1.7.3, remove when antisamy 1.7.4 -->
+    <dependency>
+        <groupId>org.apache.xmlgraphics</groupId>
+        <artifactId>batik-css</artifactId>
+        <version>1.17</version>
+        <exclusions>
+            <!-- exclude this old version of commons-io as newer can be used -->
+            <exclusion>
+                <groupId>commons-io</groupId>
+                <artifactId>commons-io</artifactId>
+            </exclusion>
+            <!-- exclude this as batik-css has a dependency that uses an older commons-logging and we want to eliminate the convergence mismatch -->
+            <exclusion>
+                <groupId>commons-logging</groupId>
+                <artifactId>commons-logging</artifactId>
+            </exclusion>
+        </exclusions>
+    </dependency>
   </dependencies>
 
   <!-- Below is an horrible if/then/else in maven. You shouldn't have anything to change here -->