[java-identity-provider] branch maint-4.1 updated: IDP-1895 - Patch various library vulnerabilities

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch maint-4.1
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=817001b8051cd293c2944def16504b7be7b0aaf4

The following commit(s) were added to refs/heads/maint-4.1 by this push:
     new 817001b80 IDP-1895 - Patch various library vulnerabilities
817001b80 is described below

commit 817001b8051cd293c2944def16504b7be7b0aaf4
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jan 11 10:25:45 2022 -0500

    IDP-1895 - Patch various library vulnerabilities
    
    https://shibboleth.atlassian.net/browse/IDP-1895
---
 idp-parent/pom.xml | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/idp-parent/pom.xml b/idp-parent/pom.xml
index a73d21197..6a3afad04 100644
--- a/idp-parent/pom.xml
+++ b/idp-parent/pom.xml
@@ -76,6 +76,10 @@
         <spring.version>5.3.14</spring.version>
         <!-- https://jira.qos.ch/browse/LOGBACK-1591 -->
         <logback.version>1.2.10</logback.version>
+        <slf4j.version>1.7.32</slf4j.version>
+        <ant.version>1.10.12</ant.version>
+        <commons.compress.version>1.21</commons.compress.version>
+        <xmlsec.version>2.1.7</xmlsec.version>
         <shibboleth.site.deploy.url>//shibboleth.net/home/javasites/staging/</shibboleth.site.deploy.url>
         <checkstyle.configLocation>${project.basedir}/../idp-parent/resources/checkstyle/checkstyle.xml</checkstyle.configLocation>
         <idp-parent.site.url>${shibboleth.site.deploy.url}java-identity-provider/${project.version}/</idp-parent.site.url>
@@ -104,6 +108,7 @@
         <dependency>
             <groupId>${slf4j.groupId}</groupId>
             <artifactId>slf4j-api</artifactId>
+            <version>${slf4j.version}</version>
         </dependency>
 
         <!-- Provided Dependencies -->
@@ -159,6 +164,12 @@
             </dependency>
 
             <!-- TODO: Remove when parent POM updated. -->
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-compress</artifactId>
+                <version>${commons.compress.version}</version>
+            </dependency>
+
             <!--
             Duplicating all the Spring dependencies seems to be the only
             way to override the Spring version given the parent POM's import
@@ -271,9 +282,34 @@
             </dependency>
 
             <!-- Provided Dependencies -->
+            <!-- TODO: Remove when parent POM updated. -->
+            <dependency>
+                <groupId>org.apache.ant</groupId>
+                <artifactId>ant</artifactId>
+                <version>${ant.version}</version>
+                <scope>provided</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.ant</groupId>
+                <artifactId>ant-launcher</artifactId>
+                <version>${ant.version}</version>
+                <scope>provided</scope>
+            </dependency>
+            <dependency>
+                <groupId>${slf4j.groupId}</groupId>
+                <artifactId>jul-to-slf4j</artifactId>
+                <version>${slf4j.version}</version>
+                <scope>provided</scope>
+            </dependency>
+            <dependency>
+                <groupId>${slf4j.groupId}</groupId>
+                <artifactId>log4j-over-slf4j</artifactId>
+                <version>${slf4j.version}</version>
+                <scope>provided</scope>
+            </dependency>
 
             <!-- Runtime Dependencies -->
-	    <!-- Re add log back as per JVMN-14 -->
+	    <!-- Re add log back as per JMVN-14 -->
 
             <dependency>
                 <groupId>ch.qos.logback</groupId>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.