# Planned Platform Third Party Dependency Upgrades

**URL:** <https://forum.inductiveautomation.com/t/planned-platform-third-party-dependency-upgrades/74650>\
**Category:** Module Development\
**Created:** [June 6, 2023, 5:22pm UTC](https://forum.inductiveautomation.com/t/planned-platform-third-party-dependency-upgrades/74650 "2023-06-06T17:22:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [June 6, 2023, 5:22pm UTC](https://forum.inductiveautomation.com/t/planned-platform-third-party-dependency-upgrades/74650/1 "2023-06-06T17:22:00Z")

</div>

IA is queueing up a number of updates to the Platform's third party dependencies to address CVEs in those dependencies. Most of these are distributed as transitives in the SDK and most of these have some breaking changes from the upgrade.

If you are an author of a third party module and you depend on these transitives, pay close attention to which dependencies we've upgraded and determine if your module is impacted. You may need to release a new version of your module which is compatible with the new version of the transitive dependency.

Planned Near-Term Upgrades:

| Name | Old Version | New Version | Ignition SDK Library |
| --- | --- | --- | --- |
| [Apache Commons Compress](https://commons.apache.org/proper/commons-compress/) | 1.19 | 1.23.0 | ignition-common |
| [Apache Commons IO](https://commons.apache.org/proper/commons-io/) | 2.2 | 2.11.0 | ignition-common |
| [Apache Commons Fileupload](https://commons.apache.org/proper/commons-fileupload/) | 1.4 | 1.5 | gateway-api |
| [Apache Xalan](https://xalan.apache.org/) | 2.7.2 | Removed | client-api |
| [Apache XML Graphics Commons](https://xmlgraphics.apache.org/commons/) | 2.3 | 2.8 | client-api |
| [IA's Fork](https://github.com/inductiveautomation/gson) of [Gson](https://github.com/google/gson) | 2.8.5 | 2.10.1 | ignition-common |
| [Guava](https://guava.dev/) | 26.0 | 32.0.0 | ignition-common |
| [Protobuf](https://protobuf.dev/) | 3.8.0 | 3.23.2 | gateway-api |

Tomorrow's early access build of 8.1 will include a dependency upgrade of Apache Commons Compress. Keep an eye out for the [8.1 Early Access Build Change Logs](https://forum.inductiveautomation.com/t/nightly-8-1-changelogs-2023) in the coming days / weeks for the other upgrades mentioned above.

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [June 6, 2023, 5:22pm UTC](https://forum.inductiveautomation.com/t/planned-platform-third-party-dependency-upgrades/74650/2 "2023-06-06T17:22:20Z")

</div>



---

<div class="post-metadata">

**Author:** ![PerryAJ](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/perryaj/32/3281_2.png) [@PerryAJ](https://forum.inductiveautomation.com/u/PerryAJ)\
**Post date:** [June 12, 2023, 8:30pm UTC](https://forum.inductiveautomation.com/t/planned-platform-third-party-dependency-upgrades/74650/3 "2023-06-12T20:30:22Z")

</div>

We continue to generally publish nightly snapshots of the SDK artifacts, including the current 8.1.29-SNAPSHOT with these changes implemented. Those looking to test their modules against these pending changes will want to target the appropriate versions, and make sure you have the snapshot repository as an artifact source.

For convenience, the following repos are hosted by IA for resolving Ignition SDK artifacts:

[https://nexus.inductiveautomation.com/repository/inductiveautomation-snapshots/](https://nexus.inductiveautomation.com/repository/inductiveautomation-snapshots/)  
[https://nexus.inductiveautomation.com/repository/inductiveautomation-releases/](https://nexus.inductiveautomation.com/repository/inductiveautomation-releases/)  
[https://nexus.inductiveautomation.com/repository/inductiveautomation-thirdparty/](https://nexus.inductiveautomation.com/repository/inductiveautomation-thirdparty/)

Some clients/build tools can use the group repository, which proxies the repos noted above:

[https://nexus.inductiveautomation.com/repository/public/](https://nexus.inductiveautomation.com/repository/public/)

> Note - if you see failures attempting to resolve snapshots through the group url and are using maven, you'll probably need to fall back to declaring each repo above independently, specifying which are snapshot repos - see the [Ignition SDK Examples](https://github.com/inductiveautomation/ignition-sdk-examples) repository for examples).