Jill/r731/appint-35965 (#6510 )

* APPINT-35965 downgrade plexus-io * APPINT-35965 downgrade plexus-io
2023-10-27 18:08:01 +08:00
2 changed files with 19 additions and 1 deletions
--- a/main/plugins/org.talend.designer.maven.tos/resources/build/plugins/karaf-maven-plugin-4-2-7/pom.xml
+++ b/main/plugins/org.talend.designer.maven.tos/resources/build/plugins/karaf-maven-plugin-4-2-7/pom.xml
@@ -116,7 +116,17 @@
 		<dependency>
 			<groupId>org.codehaus.plexus</groupId>
 			<artifactId>plexus-io</artifactId>
-			<version>3.4.1</version>
+			<version>3.2.0</version>
+			<exclusions><!--  fix CVE to plexus-io:3.2.0-->
+				<exclusion>
+				    <groupId>commons-io</groupId>
+				    <artifactId>commons-io</artifactId>
+				</exclusion>
+				<exclusion>
+				    <groupId>junit</groupId>
+				    <artifactId>junit</artifactId>
+				</exclusion>							
+			</exclusions>
 		</dependency>
 		<dependency>
 		    <groupId>org.apache.maven</groupId>
--- a/main/plugins/org.talend.updates.runtime/pom.xml
+++ b/main/plugins/org.talend.updates.runtime/pom.xml
@@ -165,6 +165,14 @@
 									<overWrite>false</overWrite>
 									<outputDirectory>${project.basedir}/tmp/org/apache/maven/maven-bom/4.0.0-alpha-5</outputDirectory>
 								</artifactItem>
+								<artifactItem>
+									<groupId>org.codehaus.plexus</groupId>
+									<artifactId>plexus-io</artifactId>
+									<version>3.2.0</version>
+									<type>jar</type>
+									<overWrite>false</overWrite>
+									<outputDirectory>${project.basedir}/tmp/org/codehaus/plexus/plexus-io/3.2.0</outputDirectory>
+								</artifactItem>
 							</artifactItems>
 							<outputDirectory>${project.basedir}/tmp</outputDirectory>
 						</configuration>