Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unresolved CVE on JGit 5.x. Possible to move to JGit 6.x? #177

Closed
greenbird-chr opened this issue Jan 26, 2024 · 3 comments
Closed

Unresolved CVE on JGit 5.x. Possible to move to JGit 6.x? #177

greenbird-chr opened this issue Jan 26, 2024 · 3 comments

Comments

@greenbird-chr
Copy link

Hi.

This project currently depends on JGit 5.13.1.202206130422-r which is associated with CVE-2023-4759.

This prevents projects that perform vulnerability scanning from building with a dependency to git-changelog-lib.

The CVE is resolved in JGit releases newer than 6.6.0.202305301015-r.

Regards
Christian
tomasbjerre added a commit that referenced this issue Jan 26, 2024
@tomasbjerre
breaking: JGit major version from 5 to 6 (refs #177)
6aad293
tomasbjerre added a commit that referenced this issue Jan 26, 2024
@tomasbjerre
feat: stepping JGit and JsonPath dependencies
2a10f78 
BREAKING CHANGE: JGit major version from 5 to 6 and require Java 11 (refs #177)
tomasbjerre added a commit that referenced this issue Jan 26, 2024
@tomasbjerre
feat: stepping JGit and JsonPath dependencies
06b3618 
BREAKING CHANGE: JGit major version from 5 to 6 and require Java 11 (refs #177)
@tomasbjerre tomasbjerre mentioned this issue Jan 26, 2024
Merged
tomasbjerre added a commit that referenced this issue Jan 26, 2024
@tomasbjerre
feat: stepping JGit and JsonPath dependencies
be8d523 
BREAKING CHANGE: JGit major version from 5 to 6 and require Java 11 (refs #177)
@tomasbjerre
Copy link
Owner

It would mean dropping Java 8 support but I think it is time for that anyway.

tomasbjerre added a commit that referenced this issue Jan 27, 2024
@tomasbjerre
feat: stepping JGit and JsonPath dependencies (#179)
cc817d6 
BREAKING CHANGE: JGit major version from 5 to 6 and require Java 11 (refs #177)
@tomasbjerre
Copy link
Owner

This is released now, open issue again if any problems.

@greenbird-chr
Copy link
Author

Thanks for the quick turnaround on this :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@tomasbjerre @greenbird-chr