Bump commons-compress

[marcelstoer]

This addresses CVE-2024-25710 and CVE-2024-26308. I know your PR template says to not open PRs to bump dependencies. However, since this is security related it has IMO a higher urgency.

Fixes #8338

[marcelstoer]

@eddumelendez is there any chance this will lead to an immediate release of 1.19.6 once merged?

[eddumelendez]

Hi, thanks for the PR. There is no plan to update the dependency because of a breaking change in the API. See #8169 (comment)

However, you can do it by yourself on your build file.

[marcelstoer]

Yes, I understand that. However, at #8169 (comment) you said

If the upgrade is needed because of other reasons...

I thought that commons-compress having critical vulnerabilities be one of those "other" reasons.

[eddumelendez]

I've tested myself that upgrading independently works perfectly fine. As a library we want to avoid users to do things like described in that thread.

[hailuand]

👋🏾 @eddumelendez How'd you manage this?

I've tested myself that upgrading independently works perfectly fine. As a library we want to avoid users to do things like described in that thread.

When I try to upgrade commons-compress myself, I see a java.lang.NoClassDefFoundError: org/apache/commons/codec/Charsets failure at runtime.

[kkocel]

@eddumelendez, do you have any mid-term plans for this? Like, making this dependency internal and changing Transferable to not have compress related arguments?