feignclient transitive dependency vulnerability issue apache commons fileupload 1.4 in gradle
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.8k
- Forks
- 1.9k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 41
Description
In one of the project, I am using spring cloud starter openfeign 3.1.2 which is internally using apache commons fileupload version 1.4. Blackduck is raising vulnerability issue with apache commmons fileupload version 1.4, so I need to use apache commons fileupload version 1.5. How can I use spring cloud starter openfeign 3.1.2 with apache commons fileupload 1.5 or is there any version of spring cloud starter openfeign which is using apache commmons fileupload version 1.5?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the Gradle dependency graph for Spring Cloud Starter OpenFeign 3.1.2 and its Apache Commons FileUpload 1.4 transitive dependency. Verify whether version 1.5 is compatible or whether a supported OpenFeign version resolves the vulnerability; done means documenting a confirmed dependency resolution or supported upgrade path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100