CVE-2022-42889 vulnerability with commons-text-1.9.jar

[rukiataliu]

Hello,

Our security team flagged the commons-text-1.9.jar file (which is in the lib folder of the Norconex committer) with the CVE-2022-42889 vulnerability. Is there a plan to upgrade to a newer, less vulnerable version? Also, we noticed the Norconex collector is currently using commons-text-1.10.0.jar. Is it okay to replace the 1.9 jar file with the 1.10 jar file used by the Collector? Please, let me know your thoughts. Thanks