Merge pull request #2229 from Alfresco/feature/PRODSEC-11108-exclude-commons-configuration-1.6

PRODSEC-11108 excluded unused solr/hadoop transitive depependency on vulnerable commons-configuration
This commit is contained in:
Jakub Kochman
2026-01-27 10:55:21 +01:00
committed by GitHub
+20
View File
@@ -82,6 +82,10 @@
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
<exclusion>
<groupId>commons-configuration</groupId>
<artifactId>commons-configuration</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
@@ -130,6 +134,10 @@
<groupId>org.apache.hadoop</groupId>
<artifactId>*</artifactId>
</exclusion>
<exclusion>
<groupId>commons-configuration</groupId>
<artifactId>commons-configuration</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
@@ -206,6 +214,10 @@
<groupId>org.apache.pdfbox</groupId>
<artifactId>*</artifactId>
</exclusion>
<exclusion>
<groupId>commons-configuration</groupId>
<artifactId>commons-configuration</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
@@ -254,6 +266,10 @@
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
<exclusion>
<groupId>commons-configuration</groupId>
<artifactId>commons-configuration</artifactId>
</exclusion>
</exclusions>
</dependency>
<!-- replace simple-xml from solr-clustering with simple-xml-safe -->
@@ -414,6 +430,10 @@
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
<exclusion>
<groupId>commons-configuration</groupId>
<artifactId>commons-configuration</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>