Security Vulnerabilities

[blakeghowe]

There are security vulnerabilities with the following transitive dependencies
• Group: org.apache.struts Artifact: struts-core Version: 1.3.8
• Group: org.apache.velocity Artifact: velocity Version: 1.7

Unfortunately, there is no way to override with a higher version of these dependencies since there isn't one available. Is there a suggested workaround so I can avoid using these dependencies?

It looks like to fix the issue, you need to switch to struts2-core and velocity-engine-core.

[dmatej]

That should be reported rather to Maven developers as it is a dependency of Maven project, see https://mvnrepository.com/artifact/org.apache.maven.plugin-tools/maven-plugin-tools-generators/3.6.4
I am not sure if I can just exclude part of the tree without breaking something.

[dmatej]

Both dependencies were excluded - mvn clean install and mvn clean site passed.