[PDFBOX-4281] Replace Apache Wink dependency

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.11
• Fix Version/s: 2.0.12, 3.0.0 PDFBox
• Component/s: Signing
• Assignee: Tilman Hausherr
• Reporter: Tilman Hausherr
• Created: 28/Jul/18 12:14
• Updated: 05/Oct/18 04:53
• Resolved: 28/Jul/18 13:31

Description

I tried this new plugin
https://sonatype.github.io/ossindex-maven/maven-plugin/
and found that our dependency Apache Wink depends on a Spring version with a vulnerability. We use Apache Wink to create a mock http server. Apache Wink has been retired. However we need only a single class so I'll add that one. (I also tried to find other mock http servers, one had issues, another needed a com.sun.* class, another was too complex).