ktorio / ktorio/ktor

Transitive vulnerability gives a warning in ktor-server-test-host-jvm

Open
#4,701 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Kotlin
Stars
14.5k
Forks
1.3k
Avg merge
2d 13h
Merged PRs (30d)
49

Description

Hi,
In `ktor-server-test-host-jvm:3.1.0` Intellij raises a warning owing to a transitive vulnerability in Apache commons-codec before `1.13-RC1`.
Given that this is being used for testing, it's probably nothing more than a minor nuisance. Thought I'd raise it here just in case.

![Image](https://github.com/user-attachments/assets/5b642568-9865-4605-8118-0f6903295e58)

Contributor guide

Open the contributing guide

Research direction

Start by inspecting the dependency declarations for the ktor-server-test-host-jvm module and determine which transitive dependency resolves Apache commons-codec below 1.13-RC1. Verify the resolved dependency and IntelliJ warning after the change; done means the vulnerable version is no longer selected without breaking the test-host module.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
security, testing
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.