From 6d8a8b156eab09e07835f4aea5de49752743a3e1 Mon Sep 17 00:00:00 2001
From: Olivier Lamy <olamy@apache.org>
Date: Fri, 15 Nov 2024 11:37:31 +1000
Subject: [PATCH] Force velocity-engine-core to 2.4 in dptManagement to not
 bring a version depending on commons-io with CVE, even if not reachable at
 least this will make scanner to stop reporting non existing problem...

Signed-off-by: Olivier Lamy <olamy@apache.org>
---
 pom.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pom.xml b/pom.xml
index 4de4d855..f943d708 100644
--- a/pom.xml
+++ b/pom.xml
@@ -277,6 +277,11 @@ under the License.
         <artifactId>xmlsec</artifactId>
         <version>4.0.3</version>
       </dependency>
+      <dependency>
+        <groupId>org.apache.velocity</groupId>
+        <artifactId>velocity-engine-core</artifactId>
+        <version>2.4</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
   <build>