Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security upgrade org.tmatesoft.svnkit:svnkit from 1.10.9 to 1.10.11 #7017

Merged
merged 2 commits into from
Apr 24, 2023
Merged

Security upgrade org.tmatesoft.svnkit:svnkit from 1.10.9 to 1.10.11 #7017

merged 2 commits into from
Apr 24, 2023

Conversation

juanluisrp
Copy link
Contributor

@juanluisrp juanluisrp commented Apr 21, 2023 •
edited
Loading

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • pom.xml

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Deserialization of Untrusted Data
SNYK-JAVA-ORGAPACHESSHD-3121053		 org.tmatesoft.svnkit:svnkit:
1.10.9 -> 1.10.11
No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

@sonarqubecloud
Copy link

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

@juanluisrp juanluisrp changed the title [Snyk] Security upgrade org.tmatesoft.svnkit:svnkit from 1.10.9 to 1.10.11 Security upgrade org.tmatesoft.svnkit:svnkit from 1.10.9 to 1.10.11 Apr 21, 2023
@fxprunayre fxprunayre added this to the 4.2.4 milestone Apr 24, 2023
fxprunayre
fxprunayre approved these changes Apr 24, 2023
View reviewed changes
Copy link
Member

@fxprunayre fxprunayre left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, subversion repo is still created fine and the the Jeeves API is not really working as before. At some point we may drop SVN support completely.

@fxprunayre fxprunayre merged commit 68b32ce into main Apr 24, 2023
@fxprunayre fxprunayre deleted the snyk-fix-d82dbde73db11b35e166b0f24131d5f6 branch April 24, 2023 11:02
@fxprunayre fxprunayre mentioned this pull request Apr 25, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fxprunayre fxprunayre fxprunayre approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
4.2.4
Development

Successfully merging this pull request may close these issues.
3 participants
@juanluisrp @fxprunayre @snyk-bot