[CXF-8777] cxf-codegen-plugin : 3.5.4 : commons-text :1.9

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.5.4
• Fix Version/s: 3.4.10, 3.5.5
• Component/s: Build system
• Assignee: Colm O hEigeartaigh
• Reporter: srinivasarao sanneboyina
• Created: 27/Oct/22 06:57
• Updated: 18/Sep/23 18:48
• Resolved: 25/Nov/22 08:54

Description

project uses Commons-text package indirectly as shown in below hierarchy with latest versions.

org.apache.cxf :cxf-codegen-plugin : 3.5.4 (latest)

                                |

org.apache.cxf : cxf-tools-wsdlto-frontend-jaxws:3.54 (latest)

                                |

org.apache.cxf: commons-text : 1.9 (removed from maven repo)

 

Issue is, exclude of 1.9 does not work as artifact itself does not exist. Since all older version jar files (till 1.9) are removed for commons-text, Exclude dependency option for 1.9 is not working. It is trying to pull 1.9 first before exclude.

Could you please help on the  above

Issue Links

• duplicates: CXF-8778 Upgrade commons-text to address CVE-2022-42889