Skip to content

Commit 9873255

Browse files
committed
fix: pin jsoup to 1.23.1 to resolve XSS vulnerability
jsoup 1.22.x is pulled in transitively via com.contentstack.sdk:utils and is flagged by Snyk for a Cross-site Scripting (XSS) issue, fixed in 1.23.1. Pin the version in dependencyManagement following the existing pattern used for other contentstack-utils transitive deps.
1 parent 8ddf872 commit 9873255

1 file changed

Lines changed: 6 additions & 0 deletions

File tree

pom.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,12 @@
220220
<artifactId>commons-lang3</artifactId>
221221
<version>3.18.0</version>
222222
</dependency>
223+
<!-- Fix Cross-site Scripting (XSS) in jsoup pulled by contentstack-utils transitive deps -->
224+
<dependency>
225+
<groupId>org.jsoup</groupId>
226+
<artifactId>jsoup</artifactId>
227+
<version>1.23.1</version>
228+
</dependency>
223229
<!-- Fix Spring vulnerabilities from contentstack-utils transitive deps -->
224230
<dependency>
225231
<groupId>org.springframework</groupId>

0 commit comments

Comments
 (0)