Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Override a number of libraries to ensure we clear vulnerablities #365

Merged
merged 6 commits into from
Oct 17, 2021
Merged

Override a number of libraries to ensure we clear vulnerablities #365

merged 6 commits into from
Oct 17, 2021

Commits on Oct 17, 2021

  1. [pom] Change version number to allow for patches since this wraps spo… 

    …tbugs

While spotbugs uses semantic versioning, us doing the same does not allow for any patches.  Using this style with one extra position allows us to patch.  It will most often be .0 but in this first case, I need to release a patch to patch vulnerable library usage.
    @hazendaz
    hazendaz committed Oct 17, 2021
    Configuration menu
    Copy the full SHA
    4bfe64e View commit details
    Browse the repository at this point in the history

  2. [pom] Require maven 3.3.9 

    This most likely actually requires even newer, but still stating 3.2.5 which is extremely old is not ideal.  No one really should use less than 3.8.1 due to vulnerabilities anyways.  So this is not exactly what we want yet but is moving it forwards to block attempted old usage we don't even test for.
    @hazendaz
    hazendaz committed Oct 17, 2021
    Configuration menu
    Copy the full SHA
    6a0fd8b View commit details
    Browse the repository at this point in the history

  3. [pom] Override maven-common-artifact-filters to 3.2.0

    @hazendaz
    hazendaz committed Oct 17, 2021
    Configuration menu
    Copy the full SHA
    95176c4 View commit details
    Browse the repository at this point in the history

  4. [pom] Override commons lang2 to 2.6

    @hazendaz
    hazendaz committed Oct 17, 2021
    Configuration menu
    Copy the full SHA
    06a2e8b View commit details
    Browse the repository at this point in the history

  5. [pom] Override maven shared utils to 3.3.4 

    others are vulnerable.
    @hazendaz
    hazendaz committed Oct 17, 2021
    Configuration menu
    Copy the full SHA
    bc67d6b View commit details
    Browse the repository at this point in the history

  6. [pom] Formatting

    @hazendaz
    hazendaz committed Oct 17, 2021
    Configuration menu
    Copy the full SHA
    9e23681 View commit details
    Browse the repository at this point in the history