[CURATOR-631] Upgrade Jersey to 2.35 or later and upgrade resteasy-jaxrs to a newer and compatible version
- Dominant language
- Java
- Stars
- 3.2k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
Curator is pulling in resteasy-jaxrs 2.3.5 which is affected by multiple CVEs inlcuding CVE-2016-9606 and CVE-2014-3490.
2.3.5 is also deprecated and needs to be upgraded.
Curator is also pulling jersey 1.19.4 which is an old version and needs to be upgraded to 2.35 or later (3.0.4).
resteasy-jaxrs dependency cannot be higher than 2.x for compatibility with Jersey 1.x, this is why they need to be upgraded together.
---
Originally reported by dora.horvath, imported from: Upgrade Jersey to 2.35 or later and upgrade resteasy-jaxrs to a newer and compatible version
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the dependency declarations and resolved dependency tree for Jersey and resteasy-jaxrs. Check the project’s existing build and test commands after selecting compatible versions. Done means both dependencies are upgraded together, compatibility is preserved, and the reported vulnerable versions are no longer pulled in.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100