From ce103be236ae5a580d77572443d344f49b83c50e Mon Sep 17 00:00:00 2001
From: Alex Porcelli <alex@porcelli.me>
Date: Mon, 11 Mar 2024 17:06:21 -0400
Subject: [PATCH 1/2] RHPAM-3709: upgrade maven dependencies to address
 CVE-2021-26291

---
 kie-ci/pom.xml | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/kie-ci/pom.xml b/kie-ci/pom.xml
index a28d49dd87d..3ba4b8f63f9 100644
--- a/kie-ci/pom.xml
+++ b/kie-ci/pom.xml
@@ -90,7 +90,7 @@
     </dependency>
     <dependency>
       <groupId>org.apache.maven</groupId>
-      <artifactId>maven-aether-provider</artifactId>
+      <artifactId>maven-resolver-provider</artifactId>
     </dependency>
     <dependency>
       <groupId>org.apache.maven.wagon</groupId>
@@ -103,7 +103,7 @@
       </exclusions>
     </dependency>
     <dependency>
-      <groupId>org.sonatype.plexus</groupId>
+      <groupId>org.codehaus.plexus</groupId>
       <artifactId>plexus-sec-dispatcher</artifactId>
     </dependency>
     <dependency>
@@ -115,20 +115,20 @@
       <artifactId>plexus-utils</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.eclipse.aether</groupId>
-      <artifactId>aether-api</artifactId>
+      <groupId>org.apache.maven.resolver</groupId>
+      <artifactId>maven-resolver-api</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.eclipse.aether</groupId>
-      <artifactId>aether-impl</artifactId>
+      <groupId>org.apache.maven.resolver</groupId>
+      <artifactId>maven-resolver-impl</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.eclipse.aether</groupId>
-      <artifactId>aether-connector-basic</artifactId>
+      <groupId>org.apache.maven.resolver</groupId>
+      <artifactId>maven-resolver-connector-basic</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.eclipse.aether</groupId>
-      <artifactId>aether-transport-wagon</artifactId>
+      <groupId>org.apache.maven.resolver</groupId>
+      <artifactId>maven-resolver-transport-wagon</artifactId>
     </dependency>
     <dependency>
       <groupId>org.eclipse.sisu</groupId>
@@ -171,7 +171,7 @@
     </dependency>
 
     <dependency>
-      <groupId>org.sonatype.plexus</groupId>
+      <groupId>org.codehaus.plexus</groupId>
       <artifactId>plexus-cipher</artifactId>
     </dependency>
 

From e5e1326a637532923694de8cad75e3418c9cf418 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tibor=20Zim=C3=A1nyi?= <tiborzimanyi@ibm.com>
Date: Fri, 22 Mar 2024 11:05:54 +0100
Subject: [PATCH 2/2] Exclude dependencies from test dependency.

---
 drools-examples-cdi/cdi-example-scopes/pom.xml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drools-examples-cdi/cdi-example-scopes/pom.xml b/drools-examples-cdi/cdi-example-scopes/pom.xml
index 53fa898a209..e08b9e65d01 100644
--- a/drools-examples-cdi/cdi-example-scopes/pom.xml
+++ b/drools-examples-cdi/cdi-example-scopes/pom.xml
@@ -87,6 +87,14 @@
           <groupId>javax.inject</groupId>
           <artifactId>javax.inject</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>org.sonatype.plexus</groupId>
+          <artifactId>plexus-cipher</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.sonatype.plexus</groupId>
+          <artifactId>plexus-sec-dispatcher</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>