SpringBoot Dependency convergence error for org.ow2.asm:asm:5.0.4

Hello folks,

We're facing dependency convergence error when using spring-boot-starter-test and spring-cloud-starter-contract-verifier.

I have checked json-path:2.4.0 and it was released ages ago, so no coincidence old asm:5.0.4 is used.

Can you please advise what is the best way dealing with it?

Thanks

Dependency convergence error for org.ow2.asm:asm:5.0.4 paths to dependency are:
  +-org.springframework.boot:spring-boot-starter-test:2.3.1.RELEASE
    +-com.jayway.jsonpath:json-path:2.4.0
      +-net.minidev:json-smart:2.3
        +-net.minidev:accessors-smart:1.2
          +-org.ow2.asm:asm:5.0.4
and
  +-org.springframework.cloud:spring-cloud-starter-contract-verifier:2.2.3.RELEASE
    +-cglib:cglib:3.2.9
      +-org.ow2.asm:asm:7.0

Comment From: wilkinsona

Generally speaking Spring projects should use the CGLib that's bundled in spring-core rather than pulling it in as a dependency for exactly this sort of reason. Can you please raise this with the Spring Cloud Contract team so that they can explore making that switch?

Comment From: onobc

@wilkinsona I believe we need to exclude the old version of asm from jsonpath lib that is pulled in by spring-boot-starter-test. I have done the same in spring-cloud-contract. I will submit a proposal here as well shortly.