Exclude vulnerable commons-collections 3.2.2 SONATYPE-2024-3350

[Akanksha-kedia]

https://nexus-iq.visa.com/assets/index.html#/vulnerabilities/SONATYPE-2024-3350

[Akanksha-kedia]

@xiangfu0 @Jackie-Jiang please review and help to merge

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.63%. Comparing base (3be9fbe) to head (758d471).
⚠️ Report is 7 commits behind head on master.

❗ There is a different number of reports uploaded between BASE (3be9fbe) and HEAD (758d471). Click for more details.

HEAD has 32 uploads less than BASE

Flag	BASE (3be9fbe)	HEAD (758d471)
java-21	5	1
unittests	4	2
temurin	10	2
java-11	5	1
unittests2	2	0
integration	6	0
integration2	2	0
integration1	2	0
custom-integration1	2	0

Additional details and impacted files

@@             Coverage Diff              @@
##             master   #17393      +/-   ##
============================================
- Coverage     63.28%   55.63%   -7.65%     
+ Complexity     1474      703     -771     
============================================
  Files          3147     2460     -687     
  Lines        187576   138874   -48702     
  Branches      28712    22138    -6574     
============================================
- Hits         118712    77268   -41444     
+ Misses        59663    55104    -4559     
+ Partials       9201     6502    -2699     

Flag	Coverage Δ
custom-integration1	?
integration	?
integration1	?
integration2	?
java-11	55.59% <ø> (-7.62%)	⬇️
java-21	55.59% <ø> (-7.64%)	⬇️
temurin	55.63% <ø> (-7.65%)	⬇️
unittests	55.63% <ø> (-7.65%)	⬇️
unittests1	55.63% <ø> (-0.02%)	⬇️
unittests2	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Jackie-Jiang]

commons-beanutils depends on commons-collections, and we cannot remove it. We'll need to wait until either of them releases a new version

[Akanksha-kedia]

commons-beanutils depends on commons-collections, and we cannot remove it. We'll need to wait until either of them releases a new version

where its being used i guess we use commons-collections4 right ?

[Jackie-Jiang]

commons-beanutils depends on commons-collections, and we cannot remove it. We'll need to wait until either of them releases a new version

where its being used i guess we use commons-collections4 right ?

It is not being used directly, but commons-beanutils could use it indirectly, and cause class not found issue