Request for release due to updated commons-io

[joffeoja]

Please make point releases for the at least the *-runtime modules that would fix the vulnerability related to commons-io. I see that the dependabot PR for version 2.11.0->2.14.0 was merged a while back so the code should already be good to go.

Here are two maven links with the vulnerability for reference:

• https://mvnrepository.com/artifact/org.jvnet.jaxb/jaxb-plugins-runtime/4.0.8
• https://mvnrepository.com/artifact/org.jvnet.jaxb/jaxb2-basics-runtime/2.0.14

[laurentschoelens]

Hi @joffeoja

Thanks for the report, we are working on this with @mattrpav

Regards

[mattrpav]

Note: commons-io is used as a test dependency, so the CVE does not apply.

I'll start a set of release to calm down the repo security scan tools anyway.

[laurentschoelens]

4.0.9 release complete

[laurentschoelens]

2.0.15 released too Need to publish releases notes