From 10e7f62a59729c2ee96374a2a65f19c80198268e Mon Sep 17 00:00:00 2001
From: Juan Luis Rodriguez Ponce <juanluisrp@gmail.com>
Date: Sat, 15 Aug 2026 12:16:14 +0200
Subject: [PATCH] Update commons-beanutils to 1.11.0

commons-beanutils enters the build transitively through three
introducers: net.sf.json-lib (1.8.0), commons-digester (1.6) and
less4j (1.8.3). Resolution therefore varied from module to module,
with most modules landing on 1.6 through Maven nearest-wins.

Pin the version in the root dependencyManagement so that every module
resolves 1.11.0, the current release. commons-digester stays at 1.6:
it is needed by jzkit-service, whose published pom declares no
dependencies at all, so GeoNetwork has to supply it by hand.

The direct PropertyUtils.getProperty callers in XslUtil and the
json-lib code paths were checked to behave identically under 1.8.0
and 1.11.0, and the JZKit Spring context still initialises, which
exercises commons-digester 1.6 against the newer beanutils.
---
 pom.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pom.xml b/pom.xml
index 0f363f65791..26847176b03 100644
--- a/pom.xml
+++ b/pom.xml
@@ -501,6 +501,11 @@
         <artifactId>commons-digester</artifactId>
         <version>1.6</version>
       </dependency>
+      <dependency>
+        <groupId>commons-beanutils</groupId>
+        <artifactId>commons-beanutils</artifactId>
+        <version>1.11.0</version>
+      </dependency>
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-dbcp2</artifactId>