[BUG] Vulnerability through dependency in the SDK v3.4.0

[qa-fabio-paulus]

In the dependency tree of azure-cosmos:3.4.0 is commons-beanutils:commons-beanutils:jar:1.9.2 (through commons-validator:commons-validator:jar:1.6).

commons-beanutils in version 1.9.2 has the following vulnerability:
https://nvd.nist.gov/vuln/detail/CVE-2019-10086

Could you update the dependency-tree such that the vulnerability is not part of it anymore?

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @kushagraThapar @srinathnarayanan @southpolesteve @shurd

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @kushagraThapar @srinathnarayanan @southpolesteve @shurd

[maggiepint]

Want to ping @joshfree on this in addition for Java vulnerability.

[kirankumarkolli]

@kushagraThapar please check if its in common POM, if so transfer to the right owner.
Otherwise cosmos team needs to address it.

[kushagraThapar]

@f-paulus We are using latest version of commons-validator - which is 1.6.
Cosmosdb SDK doesn't use commons-beanutils.

We can work on excluding the dependency from our side, meanwhile we will suggest that you should exclude it on your end.