in version 2.0b5.  We want to resolve version 2.0b6.  The conflict ensures org.apache-extras.beanshell is selected, so we get 2.0b6.  If
            we don't do this, we get 2.0b4, which is not present in our verification-metadata.xml file and causes a build failure.
        """.trimMargin())
    }

        api(libs.bouncycastlePkix)      { version { strictly(bouncycastleVersion) }}
        api(libs.bouncycastleProvider)  { version { strictly(bouncycastleVersion) }}
        api(libs.bsh)                   { version { strictly("2.0b6") }}
        api(libs.commonsCodec)          { version { strictly("1.16.1") } }
        api(libs.commonsCompress)       { version { strictly("1.26.1") } }
        api(libs.commonsHttpclient)     { version { strictly("4.5.14") } }

This version includes several upgrades of third-party dependencies:

 * jackson: 2.6.6 -> 2.8.9
 * plexus-utils: 2.0.6 -> 2.1
 * xercesImpl: 2.9.1 -> 2.11.0
 * bsh: 2.0b4 -> 2.0b6
 * bouncycastle: 1.57 -> 1.58

This fix the following security issues:

 * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7525[CVE-2017-7525] (critical)
 * SONATYPE-2017-0359 (critical)