Update to 2.10.0 for fix CVE-2025-27553 and CVE-2025-30474

(cherry picked from commit 096989e9552af1118a066227d3ca1200aeeb73c9)

apache-commons-vfs.spec

@@ -3,13 +3,12 @@
 %bcond_without ssh
 
 Name:           apache-commons-vfs
-Version:        2.1
-Release:        15
+Version:        2.10.0
+Release:        1
 Summary:        Commons Virtual File System
 License:        ASL 2.0
-Url:            http://commons.apache.org/vfs/
+Url:            https://commons.apache.org/proper/commons-vfs/
 Source0:        https://archive.apache.org/dist/commons/vfs/source/commons-vfs-%{version}-src.tar.gz
-
 BuildRequires:  maven-local mvn(commons-httpclient:commons-httpclient) mvn(commons-logging:commons-logging)
 BuildRequires:  mvn(commons-net:commons-net) mvn(org.apache.ant:ant) mvn(org.apache.commons:commons-collections4)
 BuildRequires:  mvn(org.apache.commons:commons-compress) mvn(org.apache.commons:commons-parent:pom:)
@@ -23,6 +22,8 @@ BuildRequires:  mvn(com.jcraft:jsch)
 %if %{with ftp}
 BuildRequires:  mvn(org.apache.ftpserver:ftpserver-core)
 %endif
+BuildRequires:  mvn(org.apache.httpcomponents:httpcore)
+BuildRequires:  mvn(org.jacoco:jacoco-maven-plugin)
 
 BuildArch:      noarch
 Provides:       %{name}2 = %{version}-%{release} %{name}-project = %{version}-%{release}
@@ -64,14 +65,13 @@ This package contains javadoc for %{name}.
 
 %pom_remove_plugin :apache-rat-plugin
 
-sed -i.orig 's|\r||g' LICENSE.txt NOTICE.txt README.txt RELEASE-NOTES.txt
+sed -i.orig 's|\r||g' LICENSE.txt NOTICE.txt README.md RELEASE-NOTES.txt
 touch -r LICENSE.txt.orig LICENSE.txt
 touch -r NOTICE.txt.orig NOTICE.txt
-touch -r README.txt.orig README.txt
+touch -r README.md.orig README.md
 touch -r RELEASE-NOTES.txt.orig RELEASE-NOTES.txt
-rm LICENSE.txt.orig NOTICE.txt.orig README.txt.orig RELEASE-NOTES.txt.orig
+rm LICENSE.txt.orig NOTICE.txt.orig README.md.orig RELEASE-NOTES.txt.orig
 
-%pom_disable_module dist
 %pom_change_dep -r :ant org.apache.ant:
 %pom_change_dep -r :bcprov-jdk16 :bcprov-jdk15on
 %pom_remove_dep -r org.apache.jackrabbit:
@@ -82,11 +82,10 @@ rm -rf core/src/{main,test}/java/org/apache/commons/vfs2/provider/webdav
 
 %if %{without hadoop}
 %pom_remove_dep -r org.apache.hadoop
-rm -r core/src/{main,test}/java/org/apache/commons/vfs2/provider/hdfs
+rm -r commons-vfs2-hdfs/src/{main,test}/java/org/apache/commons/vfs2/provider/hdfs
 %endif
 
 %pom_remove_plugin :maven-checkstyle-plugin
-%pom_remove_plugin :findbugs-maven-plugin
 
 %if %{without ssh}
 %pom_remove_dep -r :jsch
@@ -99,6 +98,17 @@ rm examples/src/main/java/org/apache/commons/vfs2/libcheck/SftpCheck.java
 rm -r core/src/{main,test}/java/org/apache/commons/vfs2/provider/ftps
 %endif
 
+%pom_remove_dep -r :junit-bom
+%pom_remove_dep -r :log4j-bom
+
+%pom_change_dep -r org.apache.httpcomponents.core5:httpcore5 org.apache.httpcomponents:httpcore
+%pom_remove_dep -r org.apache.httpcomponents.client5:httpclient5
+rm -r commons-vfs2/src/{main,test}/java/org/apache/commons/vfs2/provider/http5
+rm -r commons-vfs2/src/{main,test}/java/org/apache/commons/vfs2/provider/http5s
+%pom_disable_module commons-vfs2-jackrabbit1
+%pom_disable_module commons-vfs2-jackrabbit2
+%pom_remove_plugin -r :japicmp-maven-plugin
+%pom_remove_plugin -r :spotbugs-maven-plugin
 
 %mvn_file :commons-vfs2 %{name}
 %mvn_file :commons-vfs2 %{name}2
@@ -122,8 +132,8 @@ mkdir -p %{buildroot}%{_sysconfdir}/ant.d
 echo "ant commons-logging commons-vfs" > commons-vfs
 install -p -m 644 commons-vfs %{buildroot}%{_sysconfdir}/ant.d/commons-vfs
 
-%files          -f .mfiles-commons-vfs2 -f .mfiles-commons-vfs2-project
-%doc README.txt RELEASE-NOTES.txt
+%files          -f .mfiles-commons-vfs2 -f .mfiles-commons-vfs2-project -f .mfiles-commons-vfs2-ant -f .mfiles-commons-vfs2-bom -f .mfiles-commons-vfs2-distribution -f .mfiles-commons-vfs2-hdfs
+%doc README.md RELEASE-NOTES.txt
 %license LICENSE.txt NOTICE.txt
 
 %files          devel -f .mfiles-commons-vfs2-examples
@@ -134,6 +144,12 @@ install -p -m 644 commons-vfs %{buildroot}%{_sysconfdir}/ant.d/commons-vfs
 %license NOTICE.txt
 
 %changelog
+* Thu Mar 27 2025 Ge Wang <wang__ge@126.com> - 2.10.0-1
+- Update to verion 2.10.0
+
+* Thu Nov 14 2024 shaojiansong <shaojiansong@kylinos.cn> - 2.1-16
+- Fix read return wrong value when reading 0xFF
+
 * Wed Sep 02 2020 chengzihan <chengzihan2@huawei.com> - 2.1-15
 - disable hadoop dependance option.