dependency should be transitive

spacious-team · Apr 15, 2024 · ad9ac1e · ad9ac1e
1 parent 6a630e3
commit ad9ac1e
Showing 1 changed file with 7 additions and 11 deletions.
diff --git a/pom.xml b/pom.xml
@@ -84,17 +84,6 @@
         </repository>
     </repositories>
 
-    <dependencyManagement>
-        <dependencies>
-            <!-- org.apache.poi:poi-ooxml vulnerability fix https://devhub.checkmarx.com/cve-details/CVE-2024-26308/ -->
-            <dependency>
-                <groupId>org.apache.commons</groupId>
-                <artifactId>commons-compress</artifactId>
-                <version>1.26.1</version>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
-
     <dependencies>
         <dependency>
             <groupId>com.github.spacious-team</groupId>
@@ -111,6 +100,13 @@
             <artifactId>poi-ooxml</artifactId>
             <version>${apache-poi.version}</version>
         </dependency>
+        <!-- org.apache.poi:poi-ooxml vulnerability fix https://devhub.checkmarx.com/cve-details/CVE-2024-26308/ -->
+        <!-- Remove after poi-ooxml update -->
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-compress</artifactId>
+            <version>1.26.1</version>
+        </dependency>
         <dependency>
             <groupId>org.projectlombok</groupId>
             <artifactId>lombok</artifactId>