Merge pull request #66 from RakenBrian/upgrade-commons-codec

Upgrade commons-codec 1.11 -> 1.22.0 to remediate WS-2019-0379

Author: josiasmontag

pom.xml

@@ -47,6 +47,8 @@
         <httpasyncclient.version>4.1.4</httpasyncclient.version>
         <httpmime.version>4.5.12</httpmime.version>
         <tika-core.version>1.28.3</tika-core.version>
+        <!-- Override the commons-codec 1.11 pulled in transitively by httpclient -->
+        <commons-codec.version>1.22.0</commons-codec.version>
 
         <jackson-databind.version>2.22.1</jackson-databind.version>
 
@@ -158,6 +160,17 @@
         </dependency>
     </dependencies>
 
+    <dependencyManagement>
+        <dependencies>
+            <!-- Force commons-codec above the vulnerable 1.11 that httpclient pulls in transitively -->
+            <dependency>
+                <groupId>commons-codec</groupId>
+                <artifactId>commons-codec</artifactId>
+                <version>${commons-codec.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <profiles>
         <profile>
             <id>unit-tests</id>