From 513b00b15eb766a821d4c5f1adc968998d546a31 Mon Sep 17 00:00:00 2001
From: Jaro Hartmann <jaro.hartmann@doubleslash.de>
Date: Wed, 10 Apr 2024 11:30:26 +0200
Subject: [PATCH] chore(deps):[#463] Manually update
 org.apache.commons:commons-compress to 1.26.1

---
 irs-testing/pom.xml | 12 ++++++++++++
 pom.xml             |  1 +
 2 files changed, 13 insertions(+)

diff --git a/irs-testing/pom.xml b/irs-testing/pom.xml
index 7370be9eca..1f6821218c 100644
--- a/irs-testing/pom.xml
+++ b/irs-testing/pom.xml
@@ -103,6 +103,18 @@
         <dependency>
             <groupId>org.testcontainers</groupId>
             <artifactId>testcontainers</artifactId>
+            <exclusions>
+                <exclusion>
+                    <artifactId>commons-compress</artifactId>
+                    <groupId>org.apache.commons</groupId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <!-- Update commons-compress manually to avoid vulnerability CVE-2024-26308, CVE-2024-25710; can be removed after testcontainers updates their dependency -->
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-compress</artifactId>
+            <version>${commons-compress.version}</version>
         </dependency>
         <dependency>
             <groupId>org.testcontainers</groupId>
diff --git a/pom.xml b/pom.xml
index ea85514358..da33f6f13c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -123,6 +123,7 @@
         <maven-gpg-plugin.version>3.1.0</maven-gpg-plugin.version>
         <license-tool-plugin.version>1.1.0</license-tool-plugin.version>
         <snappy-java.version>1.1.10.5</snappy-java.version>
+        <commons-compress.version>1.26.1</commons-compress.version>
     </properties>
 
     <dependencyManagement>