Updates XStream due to published CVE

[wjglerum]

See GHSA-mw36-7c6c-q4q2

Not sure if Quarkus is impacted though as I'm not aware of the usage. Our build tools reported this one 😄

[wjglerum]

Checked why @dependabot was not updating this library, seems like it was turned of by @famod due to wrong reports, see c02b9ea#diff-dd4fbda47e51f1e35defb9275a9cd9c212ecde0b870cba89ddaaae65c5f3cd28

[sberyozkin]

Probably because it is used for the tests only

[famod]

Thanks for taking care of this! Last time I checked Quarkus only used XStream in the JUnit5 test framework.
And yes, we were getting Dependabot PRs for the -java7 version.

[ghost]

Milestone is already set for some of the items:

• The pull request itself

We haven't automatically updated the milestones for these items.

This message is automatically generated by a bot.

[gsmet]

Thanks!

[wjglerum]

@gsmet no problem, glad I could help. Just noticed after upgrading to Quarkus 1.10.3.Final this evening that 1.4.11 of the xstream library is still present in the quarkus-universe-bom instead of the new 1.4.14. How's that possible? Something missed the release cut off?

Maven Central -> https://search.maven.org/artifact/io.quarkus/quarkus-universe-bom/1.10.3.Final/pom

      <dependency>
        <groupId>com.thoughtworks.xstream</groupId>
        <artifactId>xstream</artifactId>
        <version>1.4.11</version>
      </dependency>

Code at 1.10.3.Final -> https://github.com/quarkusio/quarkus/blob/1.10.3.Final/test-framework/junit5/pom.xml

        <dependency>
            <groupId>com.thoughtworks.xstream</groupId>
            <artifactId>xstream</artifactId>
            <!-- Avoid adding this to the BOM -->
            <version>1.4.14</version>
        </dependency>

[gsmet]

Hmmm, it's not in the core Quarkus BOM, only in the test dependency.

The one in the Quarkus Universe BOM must come from another project we include in the Platform.

/cc @aloubyansky

[aloubyansky]

Looks like this is how it got introduced c2f679e#diff-b88aa07681bc7b1050d16244dcb773cef6c1ec8b66b9e8c90f7ac0ff5ca68760
So, perhaps it's optaplanner that contributes it to the platform.

[aloubyansky]

But if we are using it, we should probably have in our BOM.

[famod]

But if we are using it, we should probably have in our BOM.

#11956 (review) 🤷‍♂️

[aloubyansky]

But if we are using it, we should probably have in our BOM.

#11956 (review)

Yes, it probably makes more sense as just a dependency.