Re: Cayenne-velocity depends on vulnerable velocity component

2025-06-25 Thread Andrus Adamchik
Hi Kelly, Thanks for reporting this. Opening a Jira at https://issues.apache.org/jira/projects/CAY/ would help. I'd normally also say a pull request would help, but bumping up a version is trivial, so you may skip that. Regarding the recommendation to not use "cayenne-velocity"... Without Velo

Re: Cayenne-velocity depends on vulnerable velocity component

2025-06-25 Thread Michael Gentry
Hi Kelly, For now, can you try overriding the velocity version in your project's pom.xml? Maven will use the version you specify instead of the one Cayenne specifies as a dependency. Assuming Velocity 2.4 is largely compatible with 2.3, there shouldn't be any issues with this approach. Thanks, mr