From 86a072f2e35e86cb49222fdb0af073c420527929 Mon Sep 17 00:00:00 2001
From: Jay McNallie <jay.mcnallie@decisivellc.us>
Date: Sat, 10 Oct 2026 18:47:28 -0700
Subject: [PATCH] Pin jsoup and junrar in the Tika bundle

---
 pom.xml                 |  1 +
 thirdparty/tika/pom.xml | 18 +++++++++++++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index de6de1b50a2..13248cdb37c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -238,6 +238,7 @@
         <jsoup.version>1.23.2</jsoup.version>
         <jsr305.version>3.0.2</jsr305.version>
         <jsr305.bundle.version>${jsr305.version}_1</jsr305.bundle.version>
+        <junrar.version>7.6.1</junrar.version>
         <jts.version>1.20.0</jts.version>
         <jts.spatial4j.version>1.18.0</jts.spatial4j.version>
         <jvnet-ogc.version>2.6.1</jvnet-ogc.version>
diff --git a/thirdparty/tika/pom.xml b/thirdparty/tika/pom.xml
index 7aa7e8b098f..6e84c588bec 100644
--- a/thirdparty/tika/pom.xml
+++ b/thirdparty/tika/pom.xml
@@ -22,7 +22,23 @@
 
     <artifactId>tika</artifactId>
     <packaging>bundle</packaging>
-    
+
+    <!-- Override parser transitives that Tika pins below their CVE fix versions. -->
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.jsoup</groupId>
+                <artifactId>jsoup</artifactId>
+                <version>${jsoup.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>com.github.junrar</groupId>
+                <artifactId>junrar</artifactId>
+                <version>${junrar.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <dependencies>
         <dependency>
             <groupId>org.apache.tika</groupId>