apache / apache/maven-checkstyle-plugin
Update dependencies.
- Dominant language
- Java
- Stars
- 97
- Forks
- 67
- Avg merge
- 14h 50m
- Merged PRs (30d)
- 6
Description
### Affected version
Latest
### Bug description
The dependencies need to be bumped to newer versions to resolve CVE warnings.
In particular, org.apache.rat:apache-rat-plugin needs to have its version explicitly specified (latest is 0.17) rather than relying on the parent version (currently at 0.16.1), as the latter has a CVE in transitive dependency org.apache.commons:commons-text at version 1.3.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the Maven dependency declaration for org.apache.rat:apache-rat-plugin and inspect how its version is inherited. Set the explicit version to 0.17, then verify the dependency tree no longer resolves org.apache.commons:commons-text at the vulnerable version and that the Maven plugin build still passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100