Apache commons-text security issues

[Mirza Hadžič]

Hello,

note that commons-text 1.9 used in gwt-user is having security issues,
so please upgrade this library to newer version if possible. This jar is
used by net.sourceforge.htmlunit library.

Cheers,

Mirza

[Colin Alworth]

Thanks for calling this out - however, the gwt-user dependency should never be on your runtime classpath, but only used when you compile/test/debug code for your project, so the scope her is limited.

Oddly, the non-maven build of GWT doesn't appear to include commons-text, I wonder if that is an oversight of the ant build, or if the dependency can simply be excluded.

I've filed https://github.com/gwtproject/gwt/issues/10370 to track this.