From 50116417895f9f409dddba60300f5cd9af0ce460 Mon Sep 17 00:00:00 2001
From: Avgustin Marinov <Avgustin.Marinov@bosch.com>
Date: Tue, 18 Nov 2025 11:13:14 +0200
Subject: [PATCH] Improve commons-fileupload override method (#2815)

Signed-off-by: Avgustin Marinov <Avgustin.Marinov@bosch.com>
---
 hawkbit-sdk/hawkbit-sdk-commons/pom.xml | 11 -----------
 pom.xml                                 | 10 ++++++++++
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/hawkbit-sdk/hawkbit-sdk-commons/pom.xml b/hawkbit-sdk/hawkbit-sdk-commons/pom.xml
index ab0a64b11..36b4898af 100644
--- a/hawkbit-sdk/hawkbit-sdk-commons/pom.xml
+++ b/hawkbit-sdk/hawkbit-sdk-commons/pom.xml
@@ -24,18 +24,7 @@
     <name>hawkBit :: SDK :: Commons</name>
     <description>SDK commons</description>
 
-    <properties>
-        <commons.fileupload.version>1.6.0</commons.fileupload.version>
-    </properties>
-
     <dependencies>
-        <!-- Override vulnerable feign-form-spring dependency on commons-fileupload -->
-        <dependency>
-            <groupId>commons-fileupload</groupId>
-            <artifactId>commons-fileupload</artifactId>
-            <version>${commons.fileupload.version}</version>
-        </dependency>
-
         <dependency>
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-starter-openfeign</artifactId>
diff --git a/pom.xml b/pom.xml
index 253eb26c9..3f1e4805f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -48,6 +48,9 @@
         as libraries in other projects might be compiled with a different, lower, java version. -->
         <java.client.version>17</java.client.version>
 
+        <!-- Override vulnerable commons-fileupload used by feign-form-spring (via spring-cloud-starter-openfeign) -->
+        <commons-fileupload.version>1.6.0</commons-fileupload.version>
+
         <!-- must be the same as the parent version -->
         <spring.boot.version>3.5.7</spring.boot.version>
         <spring.cloud.version>2025.0.0</spring.cloud.version>
@@ -198,6 +201,13 @@
 
     <dependencyManagement>
         <dependencies>
+            <!-- Override vulnerable commons-fileupload used by feign-form-spring (via spring-cloud-starter-openfeign) -->
+            <dependency>
+                <groupId>commons-fileupload</groupId>
+                <artifactId>commons-fileupload</artifactId>
+                <version>${commons-fileupload.version}</version>
+            </dependency>
+
             <!-- Misc -->
             <dependency>
                 <groupId>com.rabbitmq</groupId>