node-gradle / node-gradle/gradle-node-plugin

Upgrade Jackson Dependency to address security vulnerabilities

Open Beginner friendly
#349 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Groovy
Stars
677
Forks
120
PR merge metrics
No merged PRs in 30d

Description

Hi There,

I understand that it's not possible to upgrade to Jackson 3 due to compatibility issues with older Gradle versions.

However, the current used Version (2.14.2) of Jackson has a few pretty urgent security violations.

I understand, that this does not directly affect the security of applications that use the plugins, however there are two aspects worth considering:

  • Many applications are built on public CI runners such as "Github-hosted runners" for Github Actions. There it's not clear, what else is on these machines and how hardened they are. So security at build time does actually matter.
  • Gradle offers the Dependency Submission Github action that reports all dependencies to github's dependabot. This plugin also reports build time dependencies.
    In an enterprise context, these security findings are often monitored and mitigation is mandatory (such is my case).

Therefore, I would really appreciate to upgrade at least to the latest patched version of Jackson 2.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at build.gradle.kts line 45, where Jackson 2.14.2 is declared, and identify the latest patched Jackson 2 version compatible with the project's older Gradle support. Update the dependency and verify that the build and dependency submission no longer report the listed Jackson vulnerabilities.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.