From 8c994a64ccfd8ef6cf9adb9f36cd63af5ebd07c0 Mon Sep 17 00:00:00 2001
From: James McMullan <jpmcmu@gmail.com>
Date: Tue, 29 Oct 2024 08:52:24 -0400
Subject: [PATCH] HPCC4J-658 Upgrade out-of-date dependencies

- Upgraded commons-io to new version
- Add version overrides for Axis2 deps with vulnerabilities

Signed-off-by: James McMullan James.McMullan@lexisnexis.com
---
 pom.xml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index e34481d74..0f5b59119 100644
--- a/pom.xml
+++ b/pom.xml
@@ -49,7 +49,7 @@
     <antlr.version>4.10.1</antlr.version>
     <javax.mail.version>1.4</javax.mail.version>
     <jsch.version>0.1.54</jsch.version>
-    <commons-io.version>2.7</commons-io.version>
+    <commons-io.version>2.14.0</commons-io.version>
     <junit.version>4.13.1</junit.version>
     <json.version>20231013</json.version>
     <log4j.version>2.17.1</log4j.version>
@@ -65,6 +65,8 @@
     <opentelemetry.bom.version>1.38.0</opentelemetry.bom.version>
     <opentelemetry.semconv.version>1.25.0-alpha</opentelemetry.semconv.version>
     <opentelemetry.instrumentation.annotations.version>2.6.0</opentelemetry.instrumentation.annotations.version>
+    <xalan.version>2.7.3</xalan.version>
+    <commons-fileupload.version>1.5</commons-fileupload.version>
   </properties>
 
   <scm>
@@ -221,6 +223,23 @@
       <artifactId>axis2-jaxws</artifactId>
       <version>${axis2.version}</version>
     </dependency>
+    <!-- Apache Axis2: Out-dated dependency overrides -->
+    <dependency>
+      <groupId>xalan</groupId>
+      <artifactId>xalan</artifactId>
+      <version>${xalan.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>commons-fileupload</groupId>
+      <artifactId>commons-fileupload</artifactId>
+      <version>${commons-fileupload.version}</version>
+    </dependency>
+    <dependency>
+        <groupId>xalan</groupId>
+        <artifactId>serializer</artifactId>
+        <version>${xalan.version}</version>
+    </dependency>
+    <!--  -->
   </dependencies>
 
   <build>