node-gradle / node-gradle/gradle-node-plugin
Upgrade Jackson Dependency to address security vulnerabilities
Nobody has claimed this yet.
- Dominant language
- Groovy
- Stars
- 677
- Forks
- 120
- PR merge metrics
- No merged PRs in 30d
Description
Hi There,
I understand that it's not possible to upgrade to Jackson 3 due to compatibility issues with older Gradle versions.
However, the current used Version (2.14.2) of Jackson has a few pretty urgent security violations.
I understand, that this does not directly affect the security of applications that use the plugins, however there are two aspects worth considering:
- Many applications are built on public CI runners such as "Github-hosted runners" for Github Actions. There it's not clear, what else is on these machines and how hardened they are. So security at build time does actually matter.
- Gradle offers the Dependency Submission Github action that reports all dependencies to github's dependabot. This plugin also reports build time dependencies.
In an enterprise context, these security findings are often monitored and mitigation is mandatory (such is my case).
Therefore, I would really appreciate to upgrade at least to the latest patched version of Jackson 2.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at build.gradle.kts line 45, where Jackson 2.14.2 is declared, and identify the latest patched Jackson 2 version compatible with the project's older Gradle support. Update the dependency and verify that the build and dependency submission no longer report the listed Jackson vulnerabilities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100