Fixes #4008 - Set nimbus-jose-jwt as direct dependency (#4019)

piranhacloud · Sep 26, 2024 · 5c94abe · 5c94abe
1 parent b073eba
commit 5c94abe
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/extension/eclipse-soteria/pom.xml b/extension/eclipse-soteria/pom.xml
@@ -18,6 +18,12 @@
             <version>${project.version}</version>
             <scope>compile</scope>
         </dependency>
+        <!-- declared as direct dependency to fix CVE -->
+        <dependency>
+            <groupId>com.nimbusds</groupId>
+            <artifactId>nimbus-jose-jwt</artifactId>
+            <scope>compile</scope>
+        </dependency>
         <dependency>
             <groupId>jakarta.enterprise</groupId>
             <artifactId>jakarta.enterprise.cdi-api</artifactId>

diff --git a/pom.xml b/pom.xml
@@ -111,6 +111,7 @@
         <microprofile-jwt-auth-api.version>2.1</microprofile-jwt-auth-api.version>
         <microprofile-jwt-auth.version>2.0.2</microprofile-jwt-auth.version>
         <mojarra.version>4.0.7</mojarra.version>
+        <nimbus-jose-jwt.version>9.40</nimbus-jose-jwt.version>
         <netty.version>4.1.112.Final</netty.version>
         <omni-mp-config.version>3.0.0</omni-mp-config.version>
         <omnibeans.version>0.3</omnibeans.version>
@@ -503,6 +504,12 @@
                 <artifactId>herring-thread</artifactId>
                 <version>${herring.version}</version>
             </dependency>
+            <!-- Nimbus Jose JWT -->
+            <dependency>
+                <groupId>com.nimbusds</groupId>
+                <artifactId>nimbus-jose-jwt</artifactId>
+                <version>${nimbus-jose-jwt.version}</version>
+            </dependency>
             <!-- Netty -->
             <dependency>
                 <groupId>io.netty</groupId>