Dependency to com.squareup.wire:wire-runtime:2.2.0 with CVEs

Dependency Security Scans of our project indicate that through org.cloudfoundry:cloudfoundry-client:5.6.0-RELEASE (most recent version as of writing) the dependency com.squareup.wire:wire-runtime:2.2.0 is declared.
This version is known to be subject to (at least) 3 CVEs (evidence):

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15250
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10237

The most current version of wire-runtime is 4.0.1, dating from December 2021, which apparently has these CVEs fixed.

Is it possible for the project to bump to a newer version to resolve the associated security risks?

Inizia dalla dichiarazione della dipendenza cloudfoundry-client collegata nell’issue e verifica come viene risolto wire-runtime 2.2.0 nel progetto Java. Controlla se una versione più recente di wire-runtime è compatibile con il client, quindi verifica che la build e i test esistenti vengano superati; il lavoro è completato quando la versione indicata interessata dal CVE non viene più utilizzata.