From f1fb04e43512983e3e4f38f1a98435a2720519dc Mon Sep 17 00:00:00 2001
From: Julian Ladisch <julianladisch@users.noreply.github.com>
Date: Mon, 19 Aug 2024 15:43:10 +0200
Subject: [PATCH] OKAPI-1190: Upgrade testcontainers, commons-*

https://folio-org.atlassian.net/browse/OKAPI-1190

Upgrade testcontainers, commons-compress, commons-lang3, commons-fileupload, commons-io

Currently the dependencies are used for testing only.

However, this may change in future.

Upgrade the dependencies to versions without vulnerabilities.
---
 pom.xml | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 73affe858..09e985ce5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -120,10 +120,36 @@
       <dependency>
         <groupId>org.testcontainers</groupId>
         <artifactId>testcontainers-bom</artifactId>
-        <version>1.19.5</version>
+        <version>1.20.1</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- testcontainers doesn't bump vulnerable commons-compress
+           https://github.com/testcontainers/testcontainers-java/pull/8354#issuecomment-1957345903 -->
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-compress</artifactId>
+        <version>1.27.0</version>
+      </dependency>
+      <!-- testcontainers requires a recent commons-lang3, io.rest-assured:xml-path downgrades it to 3.11 -->
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-lang3</artifactId>
+        <version>3.16.0</version>
+      </dependency>
+      <!-- unmaintained raml-tester doesn't bump vulnerable commons-fileupload
+           https://github.com/nidi3/raml-tester -->
+      <dependency>
+        <groupId>commons-fileupload</groupId>
+        <artifactId>commons-fileupload</artifactId>
+        <version>1.5</version>
+      </dependency>
+      <!-- unmaintained raml-tester uses old commons-io 2.11.0, testcontainers requires a more recent one -->
+      <dependency>
+        <groupId>commons-io</groupId>
+        <artifactId>commons-io</artifactId>
+        <version>2.16.1</version>
+      </dependency>
       <dependency>
         <groupId>org.mockito</groupId>
         <artifactId>mockito-bom</artifactId>