Update library dependencies#459
Conversation
|
Build is failing because guava 23 was the last version to support Java 7, unless switching to the |
|
https://github.com/google/guava/wiki/CVE-2018-10237
Nice to get to 23 but still in the cve range. Java 7 is now EOL for the public since 2015 (2022? for people still paying and is still supported in Spring Framework 4.3.x until June 2020) |
thinkingserious
left a comment
There was a problem hiding this comment.
Thank you for the PR @duttonw!
Issues found and libraries updated to latest versions: guava-18.0: CVE-2018-10237 jackson-databind-2.9.8: CVE-2019-12086, Ignored CVE-2019-12814 until 2.9.9.1 or 2.9.10 is published
|
Have ignored CVE-2019-12814 due to no release being out to fix this yet. Have included comments as what we are waiting on in the ignore owasp file. |
|
Having to think outside the box to get the owasp checker to run on all versions of Java except 1.7 was interesting. |
* Update library dependencies Issues found and libraries updated to latest versions: guava-18.0: CVE-2018-10237 jackson-databind-2.9.8: CVE-2019-12086, Ignored CVE-2019-12814 until 2.9.9.1 or 2.9.10 is published * Disable owasp for jdk 1.7 builds
* Update library dependencies Issues found and libraries updated to latest versions: guava-18.0: CVE-2018-10237 jackson-databind-2.9.8: CVE-2019-12086, Ignored CVE-2019-12814 until 2.9.9.1 or 2.9.10 is published * Disable owasp for jdk 1.7 builds
Issues found and libraries updated to latest versions:
guava-18.0: CVE-2018-10237
jackson-databind-2.9.8: CVE-2019-12086
Fixes issue #451
Contributing to Twilio