jenkinsci / jenkinsci/java-client-api
Please release a new version.
- Lenguaje dominante
- Java
- Estrellas
- 913
- Forks
- 466
- Métricas de merge de PR
- Sin PR fusionados en 30 d
Descripción
First off thanks for all the work that has gone into this library! Currently, the latest release of `java-client-api` is `0.3.8`. It depends on `com.fasterxml.jackson.core:jackson-databind:2.3.4`, which has several vulnerabilities – see the [GitHub Advisory Database](https://github.com/advisories?query=%22jackson-databind%22) I expect that most, if not all, vulnerabilities are irrelevant in context of `java-client-api`. But nevertheless I would like to ask you to release a new version of `java-client-api`, which depends on a newer version of `com.fasterxml.jackson.core:jackson-databind`. I see that the current pom.xml references `com.fasterxml.jackson.core:jackson-databind:2.9.9`, which has much less vulnerabilities, and there is [PR #450](https://github.com/jenkinsci/java-client-api/pull/450), which suggests to bump `jackson-databind.version` to `2.10.3`. At work, we are using OWASP Dependency Check to scan Java projects to identify the use of known vulnerable components. It reports that one of my projects uses a component that has known critical vulnerabilities. The reason for that is that the respective project depends on `java-client-api:0.3.8`, which depends on `com.fasterxml.jackson.core:jackson-databind:2.3.4`. I saw that [Milestone 0.4.0](https://github.com/jenkinsci/java-client-api/milestone/11) is 79% complete. Is it necessary to close of all of the remaining open issues? Which ones are the most important ones?
Guía de contribución
Línea de trabajo
Empieza revisando pom.xml y el PR #450; después, comprueba el trabajo restante en el hito 0.4.0. Confirma qué versión de jackson-databind debe publicarse e identifica los requisitos previos para la publicación; se considera terminado cuando una nueva versión de java-client-api ya no depende de 2.3.4.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- java
- Área
- release, security
- Tipo de issue
- Nueva funcionalidad
- Dificultad
- 3/5
- Tiempo estimado
- 1-2 días
- Estado de actividad
- Estancado
- Claridad
- Bastante claro
- Aptitud para principiantes
- 30/100