Skip to content

Audit Operational risks: Transitive Dependencies#118

Merged
PujaDeshmukh17 merged 30 commits intodevelopfrom
TransitiveDependency_PR
Feb 24, 2025
Merged

Audit Operational risks: Transitive Dependencies#118
PujaDeshmukh17 merged 30 commits intodevelopfrom
TransitiveDependency_PR

Conversation

@PujaDeshmukh17
Copy link
Copy Markdown
Contributor

@PujaDeshmukh17 PujaDeshmukh17 commented Feb 24, 2025

This PR is intended to resolve the operational risks caused by some transitive libraries.
The approach which is used is as mentioned below:

  1. Try to upgrade the parent lib and check if vulnerability is resolved.
  2. Try to exclude the lib causing risk from parent lib and check if compilation & integration tests are successfull.
  3. Some of the libraries which still showed vulnerability after following this approach would be marked in the scan.

Jira BL: https://jira.tools.sap/browse/SDMEXT-985

Wiki: https://wiki.one.int.sap/wiki/display/sapecm/Operational+Risks+Transitive+Dependency

Dev Testing:
Successful integration tests
Screenshot 2025-02-24 at 10 17 54 AM

Libraries to be marked
Screenshot 2025-02-24 at 2 02 28 PM

@PujaDeshmukh17 PujaDeshmukh17 merged commit 975b8cd into develop Feb 24, 2025
8 checks passed
@PujaDeshmukh17 PujaDeshmukh17 deleted the TransitiveDependency_PR branch February 24, 2025 09:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants