Repository navigation
Are there any plan for 2.0.6? (docker-java-transport-zerodep related pain) #12134
jpmartins-ca
started this conversation in
General
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
I came across a vulnerable transitive dependency that is blocking the CI security scan pipeline for projects that expose Testcontainers as a compile-scope dependency. While Testcontainers is typically used with test scope, some modules export shared testing utilities and therefore depend on it at compile time.
The issue appears to be present in the latest version (3.7.1) of docker-java-transport-zerodep, which includes a shaded version of httpcore5:5.3.6 affected by CVE-2026-54399 and CVE-2026-54428.
The related upstream issues, #2672 and #2651, are currently open. In addition, PR #2669 upgrades httpclient5 to 5.6.4, which may ultimately address these vulnerabilities once a new docker-java-transport-zerodep release is published.
In the meantime, is there any plan for a testcontainers-mysql 2.0.6 release? If the upstream fixes become available, it might make sense to include them.
Thanks.
All reactions