update transitive dep for CVE

Author: puredanger

CHANGELOG.md

@@ -3,6 +3,8 @@ Changelog
 
 *Also see [Tools and installer changelog](https://github.com/clojure/brew-install/blob/1.12.0/CHANGELOG.md)*
 
+* next
+  * Update dependencies
 * 0.24.1529 on Aug 14, 2025
   * TDEPS-259 Improve error reporting on deps.edn spec errors
   * Use latest tools.deps.cli in root deps.edn

deps.edn

@@ -2,7 +2,9 @@
  :deps {
    org.clojure/clojure {:mvn/version "1.12.1"}
    org.apache.maven.resolver/maven-resolver-api {:mvn/version "1.8.2"}
-   org.apache.maven.resolver/maven-resolver-spi {:mvn/version "1.8.2"}
+   org.apache.maven.resolver/maven-resolver-spi {:mvn/version "1.8.2" :exclusions [org.apache.commons/commons-lang3]}
+     ;; override for CVE
+     org.apache.commons/commons-lang3 {:mvn/version "3.18.0"}
    org.apache.maven.resolver/maven-resolver-impl {:mvn/version "1.8.2"}
    org.apache.maven.resolver/maven-resolver-util {:mvn/version "1.8.2"}
    org.apache.maven.resolver/maven-resolver-connector-basic {:mvn/version "1.8.2"}

pom.xml

@@ -38,6 +38,18 @@
       <groupId>org.apache.maven.resolver</groupId>
       <artifactId>maven-resolver-api</artifactId>
       <version>${resolverVersion}</version>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.commons</groupId>
+          <artifactId>commons-lang3</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <!-- override for cve -->
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-lang3</artifactId>
+      <version>3.18.0</version>
     </dependency>
     <dependency>
       <groupId>org.apache.maven.resolver</groupId>