How can I remove the old vulnerable Apache commons collection version dependency from my project's maven dependency tree?

Question

My Java app project is being managed by Maven.

My project has a few library dependencies depending again on Apache commons collection 3.2.1 which is vulnerable - e.g. Apache commons configuration, velocity, etc.

(I can see it is being used by running mvn dependency:tree command.)

I did neither write any line of codes using Apache commons collection directly nor defined the dependency of it, but it's being used.

What could I do to remove its dependency and to force to use safe version - 3.2.2, 4.1.

For your information: JIRA Bug - Arbitrary remote code execution with InvokerTransformer

Here is the part of my pom.xml, and I guess there's nothing remarkable.

...
<dependency>
    <groupId>commons-configuration</groupId>
    <artifactId>commons-configuration</artifactId>
    <version>1.6</version>
</dependency>
<dependency>
    <groupId>org.apache.velocity</groupId>
    <artifactId>velocity</artifactId>
    <version>1.7</version>
</dependency>
...

Answer 1

Unless I am missing something obvious, just specifying dependency in your POM ought to be sufficient:

<dependencies>
  <dependency>
    <groupId>commons-collections</groupId>
    <artifactId>commons-collections</artifactId>
    <version>3.2.2</version>
  </dependency>
  ...
</dependencies>

If you specify it a the top of your <dependencies> section, it will override any other transitive inclusion of commons-collections.

Of course, you may wind up with incompatibilities where other dependencies depend on the other version, but that's what unit tests are for, right? ;-)