RUN-3601: Fix CVE-2025-48924

build.gradle

@@ -45,6 +45,13 @@ subprojects{
             options.addBooleanOption('html5', true)
         }
     }
+
+    // Security fix: Force commons-lang3 to fixed version to address CVE-2025-48924
+    configurations.all {
+        resolutionStrategy {
+            force "org.apache.commons:commons-lang3:${libs.versions.commonsLang3.get()}"
+        }
+    }
 }
 
 /**

gradle/libs.versions.toml

@@ -19,6 +19,8 @@ snakeYaml = "2.0"
 #used for authz lib integration
 rundeck = "4.17.6-20240402"
 testcontainers = "1.21.3"
+commonsCompress = "1.26.0"
+commonsLang3 = "3.18.0"
 
 [libraries]
 
@@ -50,6 +52,9 @@ rundeckAuthzYaml = { module = "org.rundeck:rundeck-authz-yaml", version.ref = "r
 testcontainers = { module = "org.testcontainers:testcontainers", version.ref = "testcontainers" }
 testcontainersSpock = { module = "org.testcontainers:spock", version.ref = "testcontainers" }
 
+commonsCompress = { module = "org.apache.commons:commons-compress", version.ref = "commonsCompress" }
+commonsLang3 = { module = "org.apache.commons:commons-lang3", version.ref = "commonsLang3" }
+
 [bundles]
 
 retrofit = ["retrofitCore", "retrofitJackson", "retrofitJaxb", "okhttpLogging", "okhttpUrlconnection", "jaxb"]

integration-tests/build.gradle

@@ -11,6 +11,8 @@ dependencies {
     testImplementation libs.bundles.retrofit
     testImplementation libs.bundles.test
     testImplementation libs.bundles.testcontainers
+    // Security fix: Explicitly add fixed commons-compress version to override transitive dependency
+    testImplementation libs.commonsCompress
 }
 test {
     //note: this is intentionally commented out