[TH2-1156] fixed vulnerability

th2-net · Jul 12, 2024 · 7c86d67 · 7c86d67
1 parent 1f17552
commit 7c86d67
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/.github/workflows/build-sanpshot.yml b/.github/workflows/build-sanpshot.yml
@@ -14,7 +14,6 @@ jobs:
     uses: th2-net/.github/.github/workflows/compound-java-dev.yml@scanner-required
     with:
       build-target: 'Sonatype'
-      strict-scanner: false
     secrets:
       sonatypeUsername: ${{ secrets.SONATYPE_NEXUS_USERNAME }}
       sonatypePassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}

diff --git a/build.gradle b/build.gradle
@@ -161,7 +161,13 @@ dependencies {
     testImplementation "org.junit.jupiter:junit-jupiter:$junitVersion"
     testImplementation "org.mockito.kotlin:mockito-kotlin:5.2.1"
     testImplementation 'org.jetbrains.kotlin:kotlin-test-junit5'
-    testImplementation "org.testcontainers:testcontainers:1.19.6"
+    testImplementation "org.testcontainers:testcontainers:1.19.8"
+    // https://mvnrepository.com/artifact/org.apache.commons/commons-compress
+    testImplementation('org.apache.commons:commons-compress:1.26.2') {
+        because('the commons-compress:1.24.0 transitive dependency of testcontainers:1.19.8 has ' +
+                'vulnerabilities: CVE-2024-25710, CVE-2024-26308')
+    }
+
     testImplementation "org.testcontainers:rabbitmq:1.19.6"
     testImplementation("org.junit-pioneer:junit-pioneer:2.2.0") {
         because("system property tests")