Work around CVE-2025-48924 for Checkstyle as well

Author: marcphilipp

gradle/libs.versions.toml

@@ -14,7 +14,6 @@ junit4 = "4.13.2"
 junit4Min = "4.12"
 ktlint = "1.7.0"
 log4j = "2.25.1"
-logback = "1.5.18"
 opentest4j = "1.3.0"
 openTestReporting = "0.2.4"
 snapshotTests = "1.11.0"
@@ -82,7 +81,6 @@ eclipse-platform = { module = "org.eclipse.platform:org.eclipse.platform", versi
 jacoco = { module = "org.jacoco:jacoco", version.ref = "jacoco" }
 junit4-latest = { module = "junit:junit", version.ref = "junit4" }
 junit4-bundle = { module = "org.apache.servicemix.bundles:org.apache.servicemix.bundles.junit", version = "4.13.2_1" }
-logback-core = { module = "ch.qos.logback:logback-core", version.ref = "logback" }
 ktlint-cli = { module = "com.pinterest.ktlint:ktlint-cli", version.ref = "ktlint" }
 
 [bundles]

gradle/plugins/common/src/main/kotlin/junitbuild.checkstyle-conventions.gradle.kts

@@ -5,6 +5,17 @@ plugins {
 	checkstyle
 }
 
+dependencies {
+	constraints {
+		checkstyle("org.apache.commons:commons-lang3") {
+			version {
+				require("3.18.0")
+			}
+			because("Workaround for CVE-2025-48924")
+		}
+	}
+}
+
 checkstyle {
 	toolVersion = requiredVersionFromLibs("checkstyle")
 	configDirectory = rootProject.layout.projectDirectory.dir("gradle/config/checkstyle")

gradle/plugins/common/src/main/kotlin/junitbuild.checkstyle-nohttp.gradle.kts

@@ -7,19 +7,17 @@ plugins {
 
 dependencies {
 	checkstyle(dependencyFromLibs("nohttp-checkstyle"))
-}
-
-configurations.checkstyle {
-	resolutionStrategy {
-		eachDependency {
-			// Workaround for CVE-2024-12798 and CVE-2024-12801
-			if (requested.group == "ch.qos.logback") {
-				useVersion(requiredVersionFromLibs("logback"))
+	constraints {
+		checkstyle("com.puppycrawl.tools:checkstyle") {
+			version {
+				require(requiredVersionFromLibs("checkstyle"))
 			}
-			// Workaround for CVE-2025-48734
-			if (requested.group == "commons-beanutils") {
-				useVersion("1.11.0")
+		}
+		checkstyle("ch.qos.logback:logback-classic") {
+			version {
+				require("1.5.18")
 			}
+			because("Workaround for CVE-2024-12798 and CVE-2024-12801")
 		}
 	}
 }