The library org.yaml:snakeyaml version 1.32 detected
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 151
- Forks
- 183
- Avg merge
- 14m
- Merged PRs (30d)
- 2
Description
Expected behavior
The library org.yaml:snakeyaml version should be 2.0 per PR https://github.com/OHDSI/WebAPI/pull/2237. It does not seem to update newer version, are there any additional configuration to force the version 2.0? please advise.
Actual behavior
The library org.yaml:snakeyaml version 1.32 was detected in Maven library manager located at /WebAPI.war. reference: https://github.com/advisories/GHSA-mjmj-j48q-9wg2
Steps to reproduce behavior
The latest 2.13.0.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the Maven dependency declarations and the resolved dependency tree for org.yaml:snakeyaml, then compare them with PR 2237. Confirm that the built WebAPI.war contains version 2.0 and that the detected 1.32 dependency is no longer present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100