Skip to content

HERESUP-27616 IAM-6079 Fix dependency vulnerabilities#112

Merged
ashishKhushiKumar merged 1 commit intomasterfrom
IAM-6079
Jul 16, 2025
Merged

HERESUP-27616 IAM-6079 Fix dependency vulnerabilities#112
ashishKhushiKumar merged 1 commit intomasterfrom
IAM-6079

Conversation

@ashishKhushiKumar
Copy link
Member

…figuration2

@ashishKhushiKumar ashishKhushiKumar force-pushed the IAM-6079 branch 4 times, most recently from 8018a91 to 38b6790 Compare June 26, 2025 12:31
@ashishKhushiKumar ashishKhushiKumar force-pushed the IAM-6079 branch 7 times, most recently from 4667f61 to 1308d6f Compare July 7, 2025 23:07
@ashishKhushiKumar ashishKhushiKumar marked this pull request as ready for review July 7, 2025 23:10
@ashishKhushiKumar ashishKhushiKumar changed the title HERESUP-27616 IAM-6079 Replace ini4j dependency to apache commons-con… HERESUP-27616 IAM-6079 Fix dependency vulnerabilities Jul 7, 2025
@ashishKhushiKumar
Copy link
Member Author

ashishKhushiKumar commented Jul 7, 2025

Addressing the vulnerabilities mentioned https://github.com/heremaps/here-aaa-java-sdk/security/dependabot in the pull request -

  1. ini4j
  2. jackson-databind
  3. async-http-client

Copy link
Member

@spaltis spaltis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you pls store the updated library in local maven repo and import it into authz sdk and run tests locally?

@ashishKhushiKumar
Copy link
Member Author

CC: @spaltis @owenkellett I have raised the final revision with the following changes -

  1. Replaced org.ini4j with org.apache.commons.commons-configuration2 to handle INI files parsing.
  2. Replaced com.ning with org.asynchttpclient with version 2.12.4 which is the latest in 2.x series.
  3. Upgraded jackson-databind version from 2.13.3. to 2.19.1.

Signed-off-by: ashikuma <ashish.kumar@here.com>
@ashishKhushiKumar ashishKhushiKumar merged commit 8d4dfc8 into master Jul 16, 2025
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants