jenkinsci / jenkinsci/java-client-api

Please release a new version.

Abierto
#454 6 comentarios 7 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Java
Estrellas
913
Forks
466
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

First off thanks for all the work that has gone into this library! Currently, the latest release of `java-client-api` is `0.3.8`. It depends on `com.fasterxml.jackson.core:jackson-databind:2.3.4`, which has several vulnerabilities – see the [GitHub Advisory Database](https://github.com/advisories?query=%22jackson-databind%22) I expect that most, if not all, vulnerabilities are irrelevant in context of `java-client-api`. But nevertheless I would like to ask you to release a new version of `java-client-api`, which depends on a newer version of `com.fasterxml.jackson.core:jackson-databind`. I see that the current pom.xml references `com.fasterxml.jackson.core:jackson-databind:2.9.9`, which has much less vulnerabilities, and there is [PR #450](https://github.com/jenkinsci/java-client-api/pull/450), which suggests to bump `jackson-databind.version` to `2.10.3`. At work, we are using OWASP Dependency Check to scan Java projects to identify the use of known vulnerable components. It reports that one of my projects uses a component that has known critical vulnerabilities. The reason for that is that the respective project depends on `java-client-api:0.3.8`, which depends on `com.fasterxml.jackson.core:jackson-databind:2.3.4`. I saw that [Milestone 0.4.0](https://github.com/jenkinsci/java-client-api/milestone/11) is 79% complete. Is it necessary to close of all of the remaining open issues? Which ones are the most important ones?

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Empieza revisando pom.xml y el PR #450; después, comprueba el trabajo restante en el hito 0.4.0. Confirma qué versión de jackson-databind debe publicarse e identifica los requisitos previos para la publicación; se considera terminado cuando una nueva versión de java-client-api ya no depende de 2.3.4.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
java
Área
release, security
Tipo de issue
Nueva funcionalidad
Dificultad
3/5
Tiempo estimado
1-2 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
30/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.