From 040294ce4a170ba7cabfc4e7958d1d43502ebcad Mon Sep 17 00:00:00 2001
From: Russ Poetker <rpoetke1@jh.edu>
Date: Mon, 6 Apr 2026 14:08:54 -0400
Subject: [PATCH] Update deps for secops

---
 pass-core-main/pom.xml |  6 ------
 pom.xml                | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/pass-core-main/pom.xml b/pass-core-main/pom.xml
index 90742f47..0ea56f3c 100644
--- a/pass-core-main/pom.xml
+++ b/pass-core-main/pom.xml
@@ -114,12 +114,6 @@
     <dependency>
       <groupId>org.apache.activemq</groupId>
       <artifactId>artemis-jakarta-server</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>commons-logging</groupId>
-          <artifactId>commons-logging</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
 
     <dependency>
diff --git a/pom.xml b/pom.xml
index 15b37867..d4127c87 100644
--- a/pom.xml
+++ b/pom.xml
@@ -231,6 +231,42 @@
         <version>3.52.0</version>
       </dependency>
       <!-- End of transitive deps with convergence issues. -->
+
+      <!-- The following deps were declared to resolve CVEs from transitive deps. -->
+      <!-- These should all be checked whenever deps are upgraded. Should be removed if possible once parent -->
+      <!-- dep updates with fixed version. -->
+
+      <!-- CVE-2026-22732 -->
+      <dependency>
+          <groupId>org.springframework.security</groupId>
+          <artifactId>spring-security-web</artifactId>
+          <version>6.5.9</version>
+      </dependency>
+
+      <!-- CVE-2026-27446 -->
+      <dependency>
+          <groupId>org.apache.activemq</groupId>
+          <artifactId>artemis-jakarta-server</artifactId>
+          <version>2.53.0</version>
+          <exclusions>
+              <exclusion>
+                  <groupId>commons-logging</groupId>
+                  <artifactId>commons-logging</artifactId>
+              </exclusion>
+          </exclusions>
+      </dependency>
+      <dependency>
+          <groupId>org.apache.activemq</groupId>
+          <artifactId>artemis-jakarta-client</artifactId>
+          <version>2.53.0</version>
+          <exclusions>
+              <exclusion>
+                  <groupId>commons-logging</groupId>
+                  <artifactId>commons-logging</artifactId>
+              </exclusion>
+          </exclusions>
+      </dependency>
+      <!-- End of transitive deps with CVE issues. -->
     </dependencies>
   </dependencyManagement>