Upgrade to Commons Compress 1.25.0

[MohammadIqbalAD]

[wilkinsona]

What are you looking for here? Spring Boot doesn't manage the version of Commons Compress used by an application so it's not clear why you've made this request. We do manage the version of Commons Compress for use by our build plugins but its usage there is not vulnerable to CVE-2023-42503 as it isn't exposed to untrusted tar input.

[MohammadIqbalAD]

Thanks for the quick reply.

This CVE was raised by Dependabot and Spring Boot was identified as having the affected Commons Compress version. This ticket was created using a similar format to previous requests for Commons Compress version updates, with the additional reference to the CVE.

Your confirmation of its innocuousness in this context means we'll just ignore the warning :).