Migrated to th2 gradle plugin: 0.2.4 (bom: 4.11.0) #1
Conversation
src/main/kotlin/com/exactpro/th2/test/extension/Th2CommonFactoryExtension.kt
Show resolved
Hide resolved
Nikita-Smirnov-Exactpro
changed the title
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
Test Results11 tests 11 ✅ 7s ⏱️ Results for commit 03ad292. |
| api(libs.commons.compress) { | ||
| because("'1.24.0' version has CVE-2024-25710, CVE-2024-26308 vulnerabilities") | ||
| } |
There was a problem hiding this comment.
question: Where does this dependency come from? Can we update the original dependency?
There was a problem hiding this comment.
This dependency is a part for org.testcontainers:testcontainers:1.20.6 and we can't update it now because 1.20.6 is the last version
+--- org.testcontainers:rabbitmq -> 1.20.6
| \--- org.testcontainers:testcontainers:1.20.6
| +--- junit:junit:4.13.2
| | \--- org.hamcrest:hamcrest-core:1.3
| +--- org.slf4j:slf4j-api:1.7.36 -> 2.0.17
| +--- org.apache.commons:commons-compress:1.24.0 -> 1.27.1
| ktlint(libs.logback.core) { | ||
| because("'1.3.5' version has CVE-2023-6378, CVE-2024-12798, CVE-2024-12801 vulnerabilities") | ||
| } | ||
| ktlint(libs.logback.classic) { | ||
| because("'1.3.5' version has CVE-2023-6378 vulnerability") | ||
| } |
There was a problem hiding this comment.
note: honestly, I don't understand why there would be a need to update dependencies in the linter... It does not go into production or even as a transitive dependency. We can simply exclude ktlint configuration from vulnerabilities verification
There was a problem hiding this comment.
I would like to see existed vulnerabilities
Nikita-Smirnov-Exactpro
added
the
dependencies
No description provided.