From 85e0fe4c3f06656ded36f4167873422ad26bf5d2 Mon Sep 17 00:00:00 2001
From: Tobias Schneider <Tobias.Schneider@Tobsch.org>
Date: Thu, 19 Sep 2024 14:19:53 +0200
Subject: [PATCH] Update commons-compress to 1.27.1 fixing CVEs

https://github.com/testcontainers/testcontainers-java/issues/8338
https://www.cve.org/CVERecord?id=CVE-2024-25710
https://www.cve.org/CVERecord?id=CVE-2024-26308
---
 pom.xml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pom.xml b/pom.xml
index 943ad02d6b..e9692708ba 100644
--- a/pom.xml
+++ b/pom.xml
@@ -22,6 +22,13 @@
     <uv-extension-api.version>1.2.0</uv-extension-api.version>
     <jollyday.version>0.32.0</jollyday.version>
 
+    <!-- Remove commons-compress dependency when testcontainers ships with commons-compress >= 1.27.1, see
+     https://github.com/testcontainers/testcontainers-java/issues/8338
+     https://www.cve.org/CVERecord?id=CVE-2024-25710
+     https://www.cve.org/CVERecord?id=CVE-2024-26308
+    -->
+    <commons-compress.version>1.27.1</commons-compress.version>
+
     <docker-publish-registry>registry.example.com</docker-publish-registry>
     <docker-publish-registry-path>path/example</docker-publish-registry-path>
     <docker-publish-registry-username>username</docker-publish-registry-username>
@@ -268,6 +275,12 @@
       <artifactId>junit-jupiter</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-compress</artifactId>
+      <version>${commons-compress.version}</version>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>com.tngtech.archunit</groupId>
       <artifactId>archunit-junit5</artifactId>