commons-compress 1.21 has 2 CVE security issues

[pjfanning]

• I have searched the issues of this repository and believe that this is not a duplicate.

Ⅰ. Issue Description

incubator-seata/dependencies/pom.xml

Line 72 in 0a66e5b

<commons-compress.version>1.21</commons-compress.version>

https://mvnrepository.com/artifact/org.apache.commons/commons-compress

Ⅱ. Describe what happened

If there is an exception, please attach the exception trace:

Just paste your stack trace here!

Ⅲ. Describe what you expected to happen

Ⅳ. How to reproduce it (as minimally and precisely as possible)

1. xxx
2. xxx
3. xxx

Minimal yet complete reproducer code (or URL to code):

Ⅴ. Anything else we need to know?

Ⅵ. Environment:

• JDK version(e.g. java -version):
• Seata client/server version:
• Database version:
• OS(e.g. uname -a):
• Others:

[slievrly]

@pjfanning thanks for your feedback, I will submit a PR to fix it. Additionally, could you share the methods and tools for checking dependency vulnerabilities?

[pjfanning]

I usually use dependabot but something about this repo confuses dependabot. It is usually pretty good with Maven based builds.

Maybe you could add this maven plugin.

https://jeremylong.github.io/DependencyCheck/dependency-check-maven/

[xingfudeshi]

I usually use dependabot but something about this repo confuses dependabot. It is usually pretty good with Maven based builds.

Maybe you could add this maven plugin.

https://jeremylong.github.io/DependencyCheck/dependency-check-maven/

Thanks for your suggestion, I will take a look at this maven dependency.

[slievrly]

I usually use dependabot but something about this repo confuses dependabot. It is usually pretty good with Maven based builds.

Maybe you could add this maven plugin.

https://jeremylong.github.io/DependencyCheck/dependency-check-maven/

Thank you very much for your sharing! Actually, Dependabot is quite useful, especially for npmjs front-end dependencies. Since Seata joined ASF, a significant number of dependency security fixes have been made, and over 400 issues have been resolved so far.