Transitive vulnerability gives a warning in ktor-server-test-host-jvm
- Dominant language
- Kotlin
- Stars
- 14.5k
- Forks
- 1.3k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 49
Description
Hi,
In `ktor-server-test-host-jvm:3.1.0` Intellij raises a warning owing to a transitive vulnerability in Apache commons-codec before `1.13-RC1`.
Given that this is being used for testing, it's probably nothing more than a minor nuisance. Thought I'd raise it here just in case.

Contributor guide
Research direction
Start by inspecting the dependency declarations for the ktor-server-test-host-jvm module and determine which transitive dependency resolves Apache commons-codec below 1.13-RC1. Verify the resolved dependency and IntelliJ warning after the change; done means the vulnerable version is no longer selected without breaking the test-host module.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- security, testing
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100