For pom.xml dependency of Java_Client 8.5.0 or 8.5.1, transitive vulnerable dependency maven:commons-collections:commons-collections:3.2.2 is shown

[vnuta9]

I am working on an appium ver2.0.0-beta77, JDK 17.0.7, TestNG 7.12.1, Java_client 8.5.1, maven 3.8.3 project.
Around Java_Client, dependency, I am getting an yellow shade in the pom.xml with a pop up saying

transitive vulnerable dependency maven:commons-collections:commons-collections:3.2.2, See below picture.

I tried 8.5.0 version too, no use.

Please help me how to resolve this, which is a show stopper for me.

My complete pom.xml file is here...

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.zimperium</groupId>
    <artifactId>zMTD</artifactId>
    <version>1.0-SNAPSHOT</version>
    <properties>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
        <jvm.options>--add-opens java.base/java.lang=ALL-UNNAMED</jvm.options>
    </properties>
    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.11.0</version>
                    <configuration>
                        <source>17</source>
                        <target>17</target>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>3.1.0</version>
                    <configuration>
                            <argLine>${jvm.options}</argLine>
                        <suiteXmlFiles>
                            <suiteXmlFile>testng.xml</suiteXmlFile>
                        </suiteXmlFiles>
                    </configuration>
                </plugin>
            </plugins>
        </pluginManagement>
    </build>

       <dependencies>
                   <dependency>
                       <groupId>io.cucumber</groupId>
                       <artifactId>cucumber-java</artifactId>
                       <version>7.0.0</version>
                   </dependency>

                   <dependency>
                       <groupId>io.appium</groupId>
                       <artifactId>java-client</artifactId>
                       <version>8.5.0</version>
                   </dependency>

                              <dependency>
                                  <groupId>org.json</groupId>
                                  <artifactId>json</artifactId>
                                  <version>20230227</version>
                              </dependency>

                                        <dependency>
                                            <groupId>org.apache.logging.log4j</groupId>
                                            <artifactId>log4j-core</artifactId>
                                            <version>2.20.0</version>
                                        </dependency>

                                                   <dependency>
                                                       <groupId>org.apache.logging.log4j</groupId>
                                                       <artifactId>log4j-api</artifactId>
                                                       <version>2.20.0</version>
                                                   </dependency>

                                                   <dependency>
                                                       <groupId>io.cucumber</groupId>
                                                       <artifactId>cucumber-testng</artifactId>
                                                       <version>7.12.1</version>
                                                   </dependency>
           
                                                             <dependency>
                                                                 <groupId>commons-codec</groupId>
                                                                 <artifactId>commons-codec</artifactId>
                                                                 <version>1.15</version>
                                                             </dependency>

                                                             <dependency>
                                                                 <groupId>io.rest-assured</groupId>
                                                                 <artifactId>rest-assured</artifactId>
                                                                 <version>5.1.1</version>
                                                                 <scope>test</scope>
                                                             </dependency>

                                                             <dependency>
                                                                 <groupId>io.rest-assured</groupId>
                                                                 <artifactId>json-path</artifactId>
                                                                 <version>5.1.1</version>
                                                                 <scope>test</scope>
                                                             </dependency>

                                                             <dependency>
                                                                 <groupId>org.glassfish</groupId>
                                                                 <artifactId>javax.json</artifactId>
                                                                 <version>1.1.4</version>
                                                             </dependency>

                                                             <dependency>
                                                                 <groupId>com.google.zxing</groupId>
                                                                 <artifactId>core</artifactId>
                                                                 <version>3.5.0</version>
                                                             </dependency>

                                                             <dependency>
                                                                 <groupId>com.google.zxing</groupId>
                                                                 <artifactId>javase</artifactId>
                                                                 <version>3.5.0</version>
                                                             </dependency>

                                                             <dependency>
                                                                 <groupId>me.jvt.cucumber</groupId>
                                                                 <artifactId>reporting-plugin</artifactId>
                                                                 <version>7.11.0</version>
                                                             </dependency>

                                                             <dependency>
                                                                 <groupId>org.seleniumhq.selenium</groupId>
                                                                 <artifactId>selenium-server</artifactId>
                                                                 <version>3.141.59</version>
                                                             </dependency>

                                                             <dependency>
                                                                 <groupId>org.seleniumhq.selenium</groupId>
                                                                 <artifactId>selenium-java</artifactId>
                                                                 <version>4.9.1</version>
                                                             </dependency>
                                                             <dependency>
                                                                 <groupId>org.openjfx</groupId>
                                                                 <artifactId>javafx-controls</artifactId>
                                                                 <version>19</version>
                                                             </dependency>
                                                             <dependency>
                                                                 <groupId>org.testng</groupId>
                                                                 <artifactId>testng</artifactId>
                                                                 <version>7.8.0</version>
                                                                 <scope>test</scope>
                                                             </dependency>

                                                             <dependency>
                                                                 <groupId>org.yaml</groupId>
                                                                 <artifactId>snakeyaml</artifactId>
                                                                 <version>2.0</version>
                                                             </dependency>
                                                            
    </dependencies>

</project>

[vnuta9]

I found the solution, which is self evident(Argghhh...)until I thought about it.
The IDE warning pop up is saying "Provides transitive vulnerable dependency maven:commons-collections:commons-collections:3.2.2". Then search for dependency version greater than maven:commons-collections:commons-collections:3.2.2 (incidentally there is none as of now, but for other cases, it is available), and add that dependency until you can update the original dependency to a higher version which is having no such transitive vulnerable dependency.
Your pom.xml warning yellow color shade will go away.