-
Notifications
You must be signed in to change notification settings - Fork 436
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update library dependencies #459
Conversation
Build is failing because guava 23 was the last version to support Java 7, unless switching to the |
https://github.com/google/guava/wiki/CVE-2018-10237
Nice to get to 23 but still in the cve range. Java 7 is now EOL for the public since 2015 (2022? for people still paying and is still supported in Spring Framework 4.3.x until June 2020) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for the PR @duttonw!
Issues found and libraries updated to latest versions: guava-18.0: CVE-2018-10237 jackson-databind-2.9.8: CVE-2019-12086, Ignored CVE-2019-12814 until 2.9.9.1 or 2.9.10 is published
Have ignored CVE-2019-12814 due to no release being out to fix this yet. Have included comments as what we are waiting on in the ignore owasp file. |
Having to think outside the box to get the owasp checker to run on all versions of Java except 1.7 was interesting. |
* Update library dependencies Issues found and libraries updated to latest versions: guava-18.0: CVE-2018-10237 jackson-databind-2.9.8: CVE-2019-12086, Ignored CVE-2019-12814 until 2.9.9.1 or 2.9.10 is published * Disable owasp for jdk 1.7 builds
* Update library dependencies Issues found and libraries updated to latest versions: guava-18.0: CVE-2018-10237 jackson-databind-2.9.8: CVE-2019-12086, Ignored CVE-2019-12814 until 2.9.9.1 or 2.9.10 is published * Disable owasp for jdk 1.7 builds
Issues found and libraries updated to latest versions:
guava-18.0: CVE-2018-10237
jackson-databind-2.9.8: CVE-2019-12086
Fixes issue #451
Contributing to Twilio