From fbc71b95f32cca3deca12874fcdd6b0ce42362e3 Mon Sep 17 00:00:00 2001
From: Damian Ujma <92095156+damianujma@users.noreply.github.com>
Date: Mon, 22 Jul 2024 13:57:50 +0200
Subject: [PATCH] ACS-8298 Bump bouncycastle, commons-io, poi, tika,
 apache-compress, xmlbeans (#2797)

* ACS-8298 Bump bouncycastle, commons-lang3, commons-io, commons-compress, xmlbeans, tika, poi

* ACS-8298 Bump commons-compress to 1.26.2

* ACS-8298 Add commons-compress to tas-restapi

* ACS-8298 Exclude commons-lang3

* ACS-8298 Remove exclusion
---
 data-model/pom.xml                               |  4 ----
 packaging/tests/tas-restapi/pom.xml              |  6 ++++++
 pom.xml                                          | 16 ++++++++--------
 repository/pom.xml                               |  4 ++--
 .../bundle/VirtualNodeServiceExtension.java      |  6 +++---
 5 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/data-model/pom.xml b/data-model/pom.xml
index 8aea4166013..86961070b76 100644
--- a/data-model/pom.xml
+++ b/data-model/pom.xml
@@ -237,10 +237,6 @@
             <artifactId>tika-parsers-standard-package</artifactId>
             <version>${dependency.tika.version}</version>
             <exclusions>
-                <exclusion>
-                    <groupId>org.bouncycastle</groupId>
-                    <artifactId>bcprov-jdk15on</artifactId>
-                </exclusion>
                 <exclusion>
                     <groupId>asm</groupId>
                     <artifactId>asm</artifactId>
diff --git a/packaging/tests/tas-restapi/pom.xml b/packaging/tests/tas-restapi/pom.xml
index 6dffbc554a9..7fd4aa0df0c 100644
--- a/packaging/tests/tas-restapi/pom.xml
+++ b/packaging/tests/tas-restapi/pom.xml
@@ -23,6 +23,7 @@
 
     <properties>
         <suiteXmlFile>${project.basedir}/src/test/resources/restapi-suite.xml</suiteXmlFile>
+        <commons-lang3.version>3.14.0</commons-lang3.version>
     </properties>
 
     <profiles>
@@ -47,6 +48,11 @@
     </profiles>
 
     <dependencies>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>${commons-lang3.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.alfresco.tas</groupId>
             <artifactId>restapi</artifactId>
diff --git a/pom.xml b/pom.xml
index abf68e4df38..68474e35d03 100644
--- a/pom.xml
+++ b/pom.xml
@@ -62,12 +62,12 @@
         <dependency.cxf.version>3.5.5</dependency.cxf.version>
         <dependency.opencmis.version>1.0.0</dependency.opencmis.version>
         <dependency.webscripts.version>8.50</dependency.webscripts.version>
-        <dependency.bouncycastle.version>1.70</dependency.bouncycastle.version>
+        <dependency.bouncycastle.version>1.78.1</dependency.bouncycastle.version>
         <dependency.mockito-core.version>4.6.1</dependency.mockito-core.version>
         <dependency.assertj.version>3.23.1</dependency.assertj.version>
         <dependency.org-json.version>20231013</dependency.org-json.version>
         <dependency.commons-dbcp.version>2.9.0</dependency.commons-dbcp.version>
-        <dependency.commons-io.version>2.11.0</dependency.commons-io.version>
+        <dependency.commons-io.version>2.16.1</dependency.commons-io.version>
         <dependency.gson.version>2.8.9</dependency.gson.version>
         <dependency.guava.version>33.1.0-jre</dependency.guava.version>
         <dependency.httpclient.version>4.5.13</dependency.httpclient.version>
@@ -77,10 +77,10 @@
         <dependency.slf4j.version>2.0.1</dependency.slf4j.version>
         <dependency.gytheio.version>0.17</dependency.gytheio.version>
         <dependency.groovy.version>3.0.12</dependency.groovy.version>
-        <dependency.tika.version>2.4.1</dependency.tika.version>
+        <dependency.tika.version>2.9.2</dependency.tika.version>
         <dependency.spring-security.version>5.8.11</dependency.spring-security.version>
         <dependency.truezip.version>7.7.10</dependency.truezip.version>
-        <dependency.poi.version>5.2.2</dependency.poi.version>
+        <dependency.poi.version>5.2.5</dependency.poi.version>
         <dependency.poi-ooxml-lite.version>5.2.3</dependency.poi-ooxml-lite.version>
         <dependency.keycloak.version>18.0.0</dependency.keycloak.version>
         <dependency.jboss.logging.version>3.5.0.Final</dependency.jboss.logging.version>
@@ -89,7 +89,7 @@
         <dependency.netty.qpid.version>4.1.82.Final</dependency.netty.qpid.version> <!-- must be in sync with camels transitive dependencies: native-unix-common/native-epoll/native-kqueue -->
         <dependency.netty-tcnative.version>2.0.56.Final</dependency.netty-tcnative.version> <!-- must be in sync with camels transitive dependencies -->
         <dependency.activemq.version>5.17.6</dependency.activemq.version>
-        <dependency.apache-compress.version>1.21</dependency.apache-compress.version>
+        <dependency.apache-compress.version>1.26.2</dependency.apache-compress.version>
         <dependency.apache.taglibs.version>1.2.5</dependency.apache.taglibs.version>
         <dependency.awaitility.version>4.2.0</dependency.awaitility.version>
         <dependency.swagger-ui.version>3.38.0</dependency.swagger-ui.version>
@@ -419,7 +419,7 @@
             <dependency>
                 <groupId>org.apache.xmlbeans</groupId>
                 <artifactId>xmlbeans</artifactId>
-                <version>5.1.1</version>
+                <version>5.2.1</version>
             </dependency>
             <dependency>
                 <groupId>org.json</groupId>
@@ -618,12 +618,12 @@
             <!-- Enforce newer version -->
             <dependency>
                 <groupId>org.bouncycastle</groupId>
-                <artifactId>bcprov-jdk15on</artifactId>
+                <artifactId>bcprov-jdk18on</artifactId>
                 <version>${dependency.bouncycastle.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
-                <artifactId>bcmail-jdk15on</artifactId>
+                <artifactId>bcmail-jdk18on</artifactId>
                 <version>${dependency.bouncycastle.version}</version>
             </dependency>
             <dependency>
diff --git a/repository/pom.xml b/repository/pom.xml
index ef7a99b7d25..3c459fea46a 100644
--- a/repository/pom.xml
+++ b/repository/pom.xml
@@ -91,7 +91,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.12.0</version>
+            <version>3.14.0</version>
         </dependency>
         <dependency>
             <groupId>commons-codec</groupId>
@@ -248,7 +248,7 @@
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk15on</artifactId>
+            <artifactId>bcprov-jdk18on</artifactId>
         </dependency>
         <dependency>
             <groupId>net.sf</groupId>
diff --git a/repository/src/main/java/org/alfresco/repo/virtual/bundle/VirtualNodeServiceExtension.java b/repository/src/main/java/org/alfresco/repo/virtual/bundle/VirtualNodeServiceExtension.java
index 1cf368d1f1d..bcf2381326c 100644
--- a/repository/src/main/java/org/alfresco/repo/virtual/bundle/VirtualNodeServiceExtension.java
+++ b/repository/src/main/java/org/alfresco/repo/virtual/bundle/VirtualNodeServiceExtension.java
@@ -26,8 +26,8 @@
 
 package org.alfresco.repo.virtual.bundle;
 
-import java.io.IOException;
 import java.io.Serializable;
+import java.io.UncheckedIOException;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -910,7 +910,7 @@ private List<AssociationRef> getDownloadTargetAssocs(NodeRef sourceNodeRef)
 
             return result;
         }
-        catch (IOException e)
+        catch (UncheckedIOException e)
         {
             throw new VirtualizationException(e);
         }
@@ -968,7 +968,7 @@ private void createDownloadAssociation(NodeRef sourceNodeRef, NodeRef targetRef)
                 }
                 writer.putContent(text);
             }
-            catch (IOException e)
+            catch (UncheckedIOException e)
             {
                 throw new ActualEnvironmentException(e);
             }