upgraded vulnerable dependency, marked others with todo

apache · Oct 1, 2023 · 2129c64 · 2129c64
1 parent 41c2bb7
commit 2129c64
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/pom.xml b/pom.xml
@@ -158,6 +158,7 @@
       <artifactId>jmdns</artifactId>
       <version>3.5.7</version>
     </dependency>
+    <!-- TODO upgrade to new versions once they come out -->
     <dependency>
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-vfs2</artifactId>
@@ -208,8 +209,9 @@
     <dependency>
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-configuration2</artifactId>
-      <version>2.7</version>
+      <version>2.9.0</version>
     </dependency>
+    <!-- TODO: Upgrade to next version when it comes out: CVE-2020-15250 -->
     <dependency>
       <groupId>commons-beanutils</groupId>
       <artifactId>commons-beanutils</artifactId>