Pin httpclient to v4.5.13 (#104)

eclipse-lyo · Jun 6, 2021 · 924ab1b · 924ab1b
1 parent 2d48553
commit 924ab1b
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,7 @@
 - Lyo Validation returns more messages in the reports. _Make sure your code logic scans all messages the report if you are looking for a specific error._
 - Update Eclipse Paho from 1.2.1 to 1.2.5 due to a potential security vulnerability.
 - Force libthrift from 0.13.0 to 0.14.1 due to a [vulnerability](https://snyk.io/vuln/SNYK-JAVA-ORGAPACHETHRIFT-1074898).
+- Force httpclient to 4.5.13 due to a [vulnerability](https://github.com/eclipse/lyo/pull/103).
 
 ### Deprecated
 

diff --git a/pom.xml b/pom.xml
@@ -358,6 +358,12 @@
         <artifactId>libthrift</artifactId>
         <version>0.14.1</version>
       </dependency>
+      <!-- https://github.com/eclipse/lyo/pull/103 -->
+      <dependency>
+          <groupId>org.apache.httpcomponents</groupId>
+          <artifactId>httpclient</artifactId>
+          <version>4.5.13</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>