Steps to Reproduce

load ZK 9.6.3 jars

Current Result

commons fileupload 1.4 is loaded transitively by zk.jar

Expected Result

commons fileupload 1.5 (current latest security release) is loaded instead

Debug Information

https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-3326457

Workaround

Use maven dependency management or direct dependency declaration to load the latest commons fileupload dependency instead.

	<dependencyManagement>
		<dependencies>
			<dependency>
				<groupId>commons-fileupload</groupId>
				<artifactId>commons-fileupload</artifactId>
				<version>1.5</version>
			</dependency>
		</dependencies>
	</dependencyManagement>