Version bumps to address CVE documented in issue 101."

e-gineering · Oct 18, 2018 · 08dabc9 · 08dabc9
1 parent ec90523
commit 08dabc9
Showing 1 changed file with 11 additions and 4 deletions.
diff --git a/pom.xml b/pom.xml
@@ -8,7 +8,7 @@
 
     <groupId>com.e-gineering</groupId>
     <artifactId>gitflow-helper-maven-plugin</artifactId>
-    <version>2.1.0</version>
+    <version>2.1.1</version>
 
     <packaging>maven-plugin</packaging>
 
@@ -68,6 +68,13 @@
     </distributionManagement>
 
     <dependencies>
+        <!-- Transitive dependencies include 3.0.10, which contains an injection CVE. -->
+        <dependency>
+            <groupId>org.codehaus.plexus</groupId>
+            <artifactId>plexus-utils</artifactId>
+            <version>3.0.24</version>
+        </dependency>
+
         <dependency>
             <groupId>org.apache.maven</groupId>
             <artifactId>maven-core</artifactId>
@@ -88,17 +95,17 @@
         <dependency>
             <groupId>org.apache.maven.scm</groupId>
             <artifactId>maven-scm-api</artifactId>
-            <version>1.9.5</version>
+            <version>1.11.1</version>
         </dependency>
         <dependency>
             <groupId>org.apache.maven.scm</groupId>
             <artifactId>maven-scm-manager-plexus</artifactId>
-            <version>1.9.5</version>
+            <version>1.11.1</version>
         </dependency>
         <dependency>
             <groupId>org.apache.maven.scm</groupId>
             <artifactId>maven-scm-provider-gitexe</artifactId>
-            <version>1.9.5</version>
+            <version>1.11.1</version>
         </dependency>
         <dependency>
             <groupId>org.apache.maven.plugin-tools</groupId>