My project relies on several dependencies that transitively depend on Apache Commons Collections 3.2.2. IntelliJ warns me about a CVE in this library, which curiously is not visible on maven repository. For example Apache Commons BeanUtils 1.9.4, despite being on the last available version still uses that old version of commons-collections, which apparently has this annoying CVE. And a LOT of librairies use beanutils

Now, if I want to get rid of this CVE, how to proceed? I already pushed every dependency I could to the last available one and even used DependenciesManagement to handle the versions of transitive dependencies. But as for commons-collections, they changed their pakcages to commons-collections4 starting with the 4.0 version so it is quite troublesome to exclude/update dependencies in this case.

Maybe bridging proxy from commons-collections to commons-collections4 would do the trick. I can’t think of anything else what do you think?