[NOID] bump minidev

neo4j-contrib · Mar 7, 2025 · 26aad1d · 26aad1d
1 parent 720f43f
commit 26aad1d
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/LICENSES.txt b/LICENSES.txt
@@ -140,7 +140,7 @@ Apache-2.0
   jnr-ffi-2.1.7.jar
   joda-time-2.12.7.jar
   json-path-2.9.0.jar
-  json-smart-2.5.0.jar
+  json-smart-2.5.2.jar
   jsonschema2pojo-core-1.0.2.jar
   jsr305-3.0.2.jar
   kerb-admin-2.0.3.jar

diff --git a/NOTICE.txt b/NOTICE.txt
@@ -170,7 +170,7 @@ Apache-2.0
   jnr-ffi-2.1.7.jar
   joda-time-2.12.7.jar
   json-path-2.9.0.jar
-  json-smart-2.5.0.jar
+  json-smart-2.5.2.jar
   jsonschema2pojo-core-1.0.2.jar
   jsr305-3.0.2.jar
   kerb-admin-2.0.3.jar

diff --git a/core/build.gradle b/core/build.gradle
@@ -40,6 +40,13 @@ dependencies {
     implementation group: 'com.jayway.jsonpath', name: 'json-path', version: '2.9.0'
     implementation group: 'org.hdrhistogram', name: 'HdrHistogram', version: '2.1.9'
 
+    constraints {
+        // Remove when json-path has updated transitive dependency
+        api('net.minidev:json-smart:2.5.2') {
+            because 'CVE-2024-57699'
+        }
+    }
+
     // compileOnly "org.antlr:antlr4-runtime:4.7.2"
     // testCompile "org.antlr:antlr4-runtime:4.7.2"