[Bug]: Vulnerable dependency commons-compress 1.24.0 about testcontainers-java

[marcelstoer]

Anyone coming across this, please follow the discussion at #8354. The commons-compress dependency won't be updated here for now.

[hailuand]

Apache have released patch version 1.26.1 of commons-compress last week that may address this?

COMPRESS-659: TarArchiveOutputStream should use Commons IO Charsets instead of Commons Codec Charsets.

I was able to successfully upgrade the commons-compress version in a project of mine to 1.26.1 that was previously failing on 1.26.0 with:

java.lang.NoClassDefFoundError: org/apache/commons/codec/Charsets

	at org.apache.commons.compress.archivers.tar.TarArchiveOutputStream.<init>(TarArchiveOutputStream.java:212)
	at org.apache.commons.compress.archivers.tar.TarArchiveOutputStream.<init>(TarArchiveOutputStream.java:157)
	at org.apache.commons.compress.archivers.tar.TarArchiveOutputStream.<init>(TarArchiveOutputStream.java:147)
	at org.testcontainers.containers.ContainerState.copyFileToContainer(ContainerState.java:350)
	at org.testcontainers.containers.ContainerState.copyFileToContainer(ContainerState.java:331)
	at java.base/java.util.LinkedHashMap.forEach(LinkedHashMap.java:986)
	at org.testcontainers.containers.GenericContainer.tryStart(GenericContainer.java:441)

[blommish]

Do I understand this correctly, it will probably not be updated before spring has updated it to 1.26.1?