From a135e82ec000fc247e5fc3eb861ef4648e0eb605 Mon Sep 17 00:00:00 2001
From: jameswsullivan <81947235+jameswsullivan@users.noreply.github.com>
Date: Tue, 17 Feb 2026 00:47:07 +0000
Subject: [PATCH] mitigate vulns

---
 pom.xml                                       | 36 +++++++++++++------
 ...ltiRemoteDSpaceRepositoryHandlePlugin.java |  2 +-
 2 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/pom.xml b/pom.xml
index 5dfea2e..9902d0c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -42,37 +42,53 @@
 
     <properties>
         <encoding>UTF-8</encoding>
-        <maven.compiler.source>1.7</maven.compiler.source>
-        <maven.compiler.target>1.7</maven.compiler.target>
     </properties>
 
     <dependencies>
         <dependency>
             <groupId>net.handle</groupId>
             <artifactId>handle</artifactId>
-            <version>9.3.0</version>
+            <version>9.3.2</version>
             <type>jar</type>
             <scope>provided</scope>
         </dependency>
         <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
-            <version>2.6</version>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.20.0</version>
         </dependency>
         <dependency>
-            <groupId>log4j</groupId>
-            <artifactId>log4j</artifactId>
-            <version>1.2.17</version>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-1.2-api</artifactId>
+            <version>2.25.3</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
+            <version>2.25.3</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-api</artifactId>
+            <version>2.25.3</version>
         </dependency>
         <dependency>
             <groupId>com.google.code.gson</groupId>
             <artifactId>gson</artifactId>
-            <version>2.8.6</version>
+            <version>2.13.2</version>
         </dependency>
     </dependencies>
 
     <build>
         <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.11.0</version>
+                <configuration>
+                    <release>21</release>
+                </configuration>
+            </plugin>
             <plugin>
                 <groupId>com.mycila</groupId>
                 <artifactId>license-maven-plugin</artifactId>
diff --git a/src/main/java/org/dspace/handle/MultiRemoteDSpaceRepositoryHandlePlugin.java b/src/main/java/org/dspace/handle/MultiRemoteDSpaceRepositoryHandlePlugin.java
index f0fd604..428f36b 100644
--- a/src/main/java/org/dspace/handle/MultiRemoteDSpaceRepositoryHandlePlugin.java
+++ b/src/main/java/org/dspace/handle/MultiRemoteDSpaceRepositoryHandlePlugin.java
@@ -33,7 +33,7 @@
 import net.handle.hdllib.Util;
 import net.cnri.util.StreamTable;
 
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.log4j.Logger;
 
 import com.google.gson.JsonElement;