Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Several project dependencies are outdated #131

Closed
binkley opened this issue Aug 28, 2021 · 1 comment
Closed

Several project dependencies are outdated #131

binkley opened this issue Aug 28, 2021 · 1 comment

Comments

@binkley
Copy link
Contributor

binkley commented Aug 28, 2021 •
edited
Loading

I ran into an issue with CVE dependency scanning for Gradle counterpart to this plugin which depends on this project.

Transitively, there is a dependency here on a crufty version of plexus-utils that has an XML injection security bug. I filled against the Gradle plugin project here:

andygoossens/gradle-modernizer-plugin#1

Reviewing pom.xml for the plugin, I see many or most dependencies our outdated. A refresh to latest or near latest versions would likely address the CVE, as well as pick up any dependency bug fixes that have happened along the way. It's not sexy work, but is good craftsmanship.

When I gain some roundtuits, I may try updating myself, and see how it goes.
@binkley binkley changed the title Several project dependencies our outdated Several project dependencies are outdated Aug 28, 2021
@gaul
Copy link
Owner

gaul commented Aug 28, 2021 •
edited
Loading

I can't process an issue that boils down to, "old versions, lolz!". If you have something specific you want to fix please submit a PR. Note that some dependencies are pinned due to supporting older Java versions.

@gaul gaul closed this as completed Aug 28, 2021
gaul pushed a commit that referenced this issue Aug 28, 2021
@binkley @boxleytw
Address CVE by excluding plexus-utils
f64b9d6 
The plexus-utils dependency is upstream in this project, and triggers
a CVE for XML injection.  I was unable to find ill effect from excluding
plexus-utils as a transitive dependency.

See https://nvd.nist.gov/vuln/detail/CVE-2017-1000487

Fixes andygoossens/gradle-modernizer-plugin#1.  References #131.

Co-authored-by: Brian Oxley <boxley@thoughtworks.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@binkley @gaul