From c84abfc8aa55fad39c1df9412a31b5456a8e6cbb Mon Sep 17 00:00:00 2001
From: Paul Gallagher <paul.gallagher@telicent.io>
Date: Tue, 24 Dec 2024 15:03:23 +0000
Subject: [PATCH] [Minor] Fix CVE-2024-7254 by upgrading logback and add
 exclusion for commons compress.

---
 pom.xml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 12f7f10..dd4a311 100644
--- a/pom.xml
+++ b/pom.xml
@@ -129,7 +129,7 @@
         <dependency.jjwt>0.12.6</dependency.jjwt>
         <dependency.jwt-auth>0.17.5</dependency.jwt-auth>
         <dependency.kafka>3.9.0</dependency.kafka>
-        <dependency.logback>1.5.12</dependency.logback>
+        <dependency.logback>1.5.13</dependency.logback>
         <dependency.lombok>1.18.36</dependency.lombok>
         <dependency.mockito>5.14.2</dependency.mockito>
         <dependency.opentelemetry.agent>1.33.6</dependency.opentelemetry.agent>
@@ -221,6 +221,12 @@
                 <groupId>org.testcontainers</groupId>
                 <artifactId>testcontainers</artifactId>
                 <version>${dependency.testcontainers}</version>
+                <exclusions>
+                    <exclusion>
+                        <groupId>org.apache.commons</groupId>
+                        <artifactId>commons-compress</artifactId>
+                    </exclusion>
+                </exclusions>
             </dependency>
 
             <dependency>