diff --git a/pom.xml b/pom.xml
index 58b8f9f..31826d5 100755
--- a/pom.xml
+++ b/pom.xml
@@ -174,7 +174,7 @@
     <dependency>
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-compress</artifactId>
-      <version>1.17</version>
+      <version>1.18</version>
     </dependency>
     <dependency>
       <groupId>org.apache.maven.plugin-testing</groupId>
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index a64857a..7ac8938 100755
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -29,6 +29,7 @@
       <action type="update" dev="ggregory">Better error message when files cannot be checked in to the SCM.</action>
       <action type="fix" dev="ggregory">Check the result of checking out files from the SCM.</action>
       <action issue="COMMONSSITE-120" type="update" dev="ggregory">[release-plugin] Use SHA-256 and SHA-512, not MD5, not SHA-1.</action>
+      <action type="update" dev="ggregory">Update Apache Commons Compress from 1.17 to 1.18.</action>
     </release>
 
     <release version="1.3" date="2018-06-15" description="Version 1.3">