influxdata / influxdata/influxdb-java
influxdb-java.git/pom.xml references no longer maintained com.dkanejs.maven.plugins
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.2k
- Forks
- 469
- PR merge metrics
- No merged PRs in 30d
Description
Recent [security research](https://blog.oversecured.com/Introducing-MavenGate-a-supply-chain-attack-method-for-Java-and-Android-applications) discussed problems in the maven ecosystem where the DNS of a no longer maintained project expires and is taken over. https://github.com/mathieucarbou/license-maven-plugin/issues/715 discussed some specifics around maven central which make this less of a problem since they use a formal process for transfers, which `influxdb-java` seems to be using.
All said, I'm filing this less as a security problem and more for awareness that a component is being used that is no longer maintained.
```
$ whois dkanejs.com # shows it is expired
No match for domain "DKANEJS.COM".
>>> Last update of whois database: 2024-02-16T15:50:52Z <<<
NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.
...
$ grep -r com.dkanejs ./influxdb-java.git
./pom.xml: com.dkanejs.maven.plugins
```
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading pom.xml and run the grep command shown in the issue to inspect the com.dkanejs.maven.plugins reference. The issue does not specify a replacement, removal, test, or other completion condition, so confirm the intended change before proceeding.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100