[fix][sec] Upgrade commons-compress to 1.26.0

[massakam]

Motivation

commons-compress 1.21 has the following vulnerability and should be upgraded to 1.26.0.
https://nvd.nist.gov/vuln/detail/CVE-2024-25710

Verifying this change

• Make sure that the change passes the CI checks.

Documentation

• doc
• doc-required
• doc-not-needed
• doc-complete

[lhotari]

JavaInstanceDepsTest seems to be failing. Please take a look.

[lhotari]

LGTM

[massakam]

commons-compress v1.21 has no dependencies on other libraries, but v1.26.0 has dependencies on commons-io and commons-lang3, which seems to cause JavaInstanceDepsTest to fail.

[INFO] +- org.apache.commons:commons-compress:jar:1.26.0:compile
[INFO] |  +- commons-io:commons-io:jar:2.15.1:compile
[INFO] |  \- org.apache.commons:commons-lang3:jar:3.14.0:compile

Therefore, I modified JavaInstanceDepsTest so that the test passes even if java-instance.jar includes classes from these libraries. Please let me know if this change is incorrect.

[lhotari]

commons-compress v1.21 has no dependencies on other libraries, but v1.26.0 has dependencies on commons-io and commons-lang3, which seems to cause JavaInstanceDepsTest to fail.

[INFO] +- org.apache.commons:commons-compress:jar:1.26.0:compile
[INFO] |  +- commons-io:commons-io:jar:2.15.1:compile
[INFO] |  \- org.apache.commons:commons-lang3:jar:3.14.0:compile

Therefore, I modified JavaInstanceDepsTest so that the test passes even if java-instance.jar includes classes from these libraries. Please let me know if this change is incorrect.

@massakam Makes sense. Thanks for addressing this.