fix(sec): upgrade org.bouncycastle:bcprov-ext-jdk15on to 1.69#13235
fix(sec): upgrade org.bouncycastle:bcprov-ext-jdk15on to 1.69#13235zhoumengyks wants to merge 1 commit intoapache:masterfrom
Conversation
|
The version is not updated in the licenses.yaml file, I'm curious that why doesn't the license check report error? Is it because the scope of this dependency is declared as 'runtime'? Do you know that @xvrl |
| <groupId>org.bouncycastle</groupId> | ||
| <artifactId>bcprov-ext-jdk15on</artifactId> | ||
| <version>1.68</version> | ||
| <version>1.69</version> |
There was a problem hiding this comment.
why are we only updating bcprov-ext-jdk15on and not bcprov-jdk15on ?
We should also move to 1.70 since that is out already
|
@FrankChen021 good question, we'd have to remove the runtime scope to see if that makes a difference. I also wonder if the fact that we still have 1.68 for bcprov-jdk15on somehow causes the license check to be confused? |
|
This pull request has been marked as stale due to 60 days of inactivity. |
|
This pull request/issue has been closed due to lack of activity. If you think that |
3 participants
What happened？
There are 1 security vulnerabilities found in org.bouncycastle:bcprov-ext-jdk15on 1.68
What did I do？
Upgrade org.bouncycastle:bcprov-ext-jdk15on from 1.68 to 1.69 for vulnerability fix
What did you expect to happen？
Ideally, no insecure libs should be used.
The specification of the pull request
PR Specification from OSCS