From 3b532a5b73e46d3b7d6d1a8cb3999c600bd3a186 Mon Sep 17 00:00:00 2001
From: Rene Pfeuffer <rene.pfeuffer@cloudogu.com>
Date: Wed, 11 Mar 2026 13:10:49 +0000
Subject: [PATCH] Bump libraries with CVEs

---
 gradle/changelog/cve.yaml  | 2 ++
 gradle/dependencies.gradle | 2 +-
 scm-webapp/build.gradle    | 6 ++++++
 3 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 gradle/changelog/cve.yaml

diff --git a/gradle/changelog/cve.yaml b/gradle/changelog/cve.yaml
new file mode 100644
index 0000000000..770fd93ef8
--- /dev/null
+++ b/gradle/changelog/cve.yaml
@@ -0,0 +1,2 @@
+- type: fixed
+  description: Updates of libraries with HIGH CVEs
diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
index 01024d00a1..8a58d37405 100644
--- a/gradle/dependencies.gradle
+++ b/gradle/dependencies.gradle
@@ -3,7 +3,7 @@ ext {
   guiceVersion = '7.0.0'
   resteasyVersion = '6.2.15.Final'
 
-  jacksonVersion = '2.21.0'
+  jacksonVersion = '2.21.1'
   jacksonAnnotationsVersion = '2.21'
 
   legmanVersion = '2.0.3'
diff --git a/scm-webapp/build.gradle b/scm-webapp/build.gradle
index 70350e666b..a0be65f617 100644
--- a/scm-webapp/build.gradle
+++ b/scm-webapp/build.gradle
@@ -157,6 +157,12 @@ dependencies {
   // plugin transformer
   implementation 'org.eclipse.transformer:org.eclipse.transformer:1.0.0'
   implementation 'org.eclipse.transformer:org.eclipse.transformer.jakarta:1.0.0'
+
+  constraints {
+    implementation("commons-beanutils:commons-beanutils:1.11.0") {
+      because "previous versions have a CVE-2025-48734"
+    }
+  }
 }
 
 war {