Hi.
Due to a recent problem with apache-commons-text (CVE-2022-42889) we were trying to replace the commons-text-1.8 java library in our cas 6.1 deployment. I can get the non-vulnerable 1.10 version to be included in the build with an implementation clause in build.gradle, but the build still insists on copying also the vulnerable 1.8 version into the resulting war file.
If I use the exclude group functionality to prevent the 1.8 from being used, then the build fails because it can't find the 1.8 version.
How can I get the commons-text-1.10 to replace the commons-text-1.8 so that the 1.8 is not included in the built war file? Or is this even practical and I should be trying some completely different approach?
BR,
Otto Myyrä