Fix some dependency CVEs

thegridman · May 20, 2024 · 6e800f6 · 6e800f6
1 parent 5975b9f
commit 6e800f6
Show file tree

Hide file tree

Showing 3 changed files with 29 additions and 0 deletions.
diff --git a/bedrock-core/pom.xml b/bedrock-core/pom.xml
@@ -24,6 +24,16 @@
             <groupId>jakarta.el</groupId>
             <artifactId>jakarta.el-api</artifactId>
         </dependency>
+		<dependency>
+			<groupId>org.glassfish</groupId>
+			<artifactId>jakarta.el</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>jakarta.el</groupId>
+                    <artifactId>jakarta.el-api</artifactId>
+                </exclusion>
+            </exclusions>
+		</dependency>
 
         <dependency>
             <groupId>org.hamcrest</groupId>

diff --git a/etc/dependency-check-suppression.xml b/etc/dependency-check-suppression.xml
@@ -24,6 +24,14 @@
        <cpe>cpe:/a:oracle:coherence</cpe>
     </suppress>
 
+    <suppress>
+       <notes><![CDATA[
+       file name: jakarta.el-5.0.0-M1.jar
+       ]]></notes>
+       <packageUrl regex="true">^pkg:maven/org\.glassfish/jakarta\.el@.*$</packageUrl>
+       <cpe>cpe:/a:eclipse:glassfish</cpe>
+    </suppress>
+
     <suppress>
        <notes><![CDATA[
        file name: plexus-cipher-2.0.jar

diff --git a/pom.xml b/pom.xml
@@ -236,6 +236,17 @@
                  <artifactId>jakarta.el-api</artifactId>
                 <version>${jakarta.el.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.glassfish</groupId>
+                <artifactId>jakarta.el</artifactId>
+                <version>${glassfish.el.version}</version>
+                <exclusions>
+                    <exclusion>
+                        <groupId>jakarta.el</groupId>
+                        <artifactId>jakarta.el-api</artifactId>
+                    </exclusion>
+                </exclusions>
+            </dependency>
 
             <dependency>
                 <groupId>com.jcraft</groupId>