diff --git a/doc/changes/changes_4.3.4.md b/doc/changes/changes_4.3.4.md index 009bdafb..04d0b15e 100644 --- a/doc/changes/changes_4.3.4.md +++ b/doc/changes/changes_4.3.4.md @@ -4,9 +4,7 @@ Code name: Fix vulnerabilities ## Summary -This release fixes vulnerabilities -* CVE-2024-47554 in transitive test dependency `commons-io:commons-io` via `com.exasol:maven-plugin-integration-testing:1.1.2` and `com.jcabi:jcabi-github:1.8.0` -* CVE-2023-7272 in transitive runtime dependency `org.glassfish:javax.json:1.1.4` via `com.jcabi:jcabi-github:1.8.0` +This release fixes vulnerability CVE-2024-47554 in transitive test dependency `commons-io:commons-io` via `com.exasol:maven-plugin-integration-testing:1.1.2` and `com.jcabi:jcabi-github:1.8.0` The release ignores vulnerability CVE-2023-7272 in transitive runtime dependency `org.glassfish:javax.json:1.1.4` via `com.jcabi:jcabi-github:jar:1.9.1` as this is accepted for accessing exasol json documents on GitHub. @@ -14,7 +12,7 @@ The release ignores vulnerability CVE-2023-7272 in transitive runtime dependency * #586: Fixed vulnerability CVE-2024-47554 in test dependency `commons-io:commons-io:2.11.0` * #587: Fixed vulnerability CVE-2024-47554 in test dependency `commons-io:commons-io:2.13.0` -* #588: Fixed vulnerability CVE-2023-7272 in runtime dependency `org.glassfish:javax.json:1.1.4` +* #588: Ignore vulnerability CVE-2023-7272 in runtime dependency `org.glassfish:javax.json:1.1.4` ## Dependency Updates diff --git a/maven-project-crawler/pom.xml b/maven-project-crawler/pom.xml index 126b6a99..8c5c681b 100644 --- a/maven-project-crawler/pom.xml +++ b/maven-project-crawler/pom.xml @@ -115,10 +115,12 @@ + org.codehaus.plexus plexus-utils + org.codehaus.plexus plexus-xml diff --git a/project-keeper-maven-plugin/pom.xml b/project-keeper-maven-plugin/pom.xml index b05891e9..143f6af4 100644 --- a/project-keeper-maven-plugin/pom.xml +++ b/project-keeper-maven-plugin/pom.xml @@ -125,9 +125,18 @@ about.html - - ^org\.codehaus\.plexus\.util\.xml\..* - + + + + org.codehaus.plexus + plexus-utils + + + + org.codehaus.plexus + plexus-xml + +