Upgrade commons-text-1.9.jar

Describe the bug The VScode extension pivotal.vscode-spring-boot-1.40.0 includes the file language-server\BOOT-INF\lib\commons-text-1.9.jar. A critical security issue is reported as CVE-2022-42889 for this release. This error has been fixed in releases 1.10.0 and higher.

Please update the dependency to one not vulnerable.

To Reproduce

• Install the current extension “Pivotal Spring Boot Tools” on VScode.
• Inspect the contents of the path %HOME%\.vscode\extensions\pivotal.vscode-spring-boot-1.40.0\language-server\BOOT-INF\lib to find the vulnerable jar file.

[martinlippert]

rewrite-maven as well as rewrite-java have been updated to commons-text version 1.10.0, so we are not shipping version 1.9.0 of commons-text anymore. This will ship as part of the next release (in Spring Tools Extension for VSCode 1.41.0, as part of the broader Spring Tools 4.17.0 release)

[datenimperator]

@BoykoAlex @martinlippert thx for responding so quickly, really appreciated. Personally, I do not assume that this is so much of an actual issue, given the way how the lib is used. But this warning comes up if your computer is scanned for vulnerabilities, and many organizations (like my employer) will perform such scans. I think its safe to assume that this warning has been seen already by lots of users. Once your PC has been on a “vulnerable computers” list for some days, it doesn’t take too long until emails from top-execs come flying in…

So, for the sake of you helping me to get rid of our sec guy telling me to update, I eagerly await the next release 😃