GH-5060: use more recent version of zookeeper to fix CVE (#5062)

Signed-off-by: Bart Hanssens <[email protected]>
eclipse-rdf4j · Jul 1, 2024 · 81eb983 · 81eb983
1 parent e0e9868
commit 81eb983
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/core/sail/solr/pom.xml b/core/sail/solr/pom.xml
@@ -12,8 +12,22 @@
 	<properties>
 		<!-- FIXME: Support for embedded Solr server require non-provided Java EE dependencies -->
 		<enforce-javaee-provided.fail>false</enforce-javaee-provided.fail>
+		<!-- use at least 3.7 to fix CVE -->
+		<zookeeper.version>3.7.2</zookeeper.version>
 	</properties>
 	<dependencies>
+		<!-- use at least zookeeper 3.7.2 to fix CVE, can be removed if solr provides a newer version -->
+		<dependency>
+			<groupId>org.apache.zookeeper</groupId>
+			<artifactId>zookeeper</artifactId>
+			<version>${zookeeper.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.zookeeper</groupId>
+			<artifactId>zookeeper-jute</artifactId>
+			<version>${zookeeper.version}</version>
+		</dependency>
+		<!-- -->
 		<dependency>
 			<groupId>${project.groupId}</groupId>
 			<artifactId>rdf4j-sail-lucene-api</artifactId>