Conversation
altro3
force-pushed
the
updatelibs12
branch
7 times, most recently
from
265bb73 to
66a4e92
Compare
altro3
force-pushed
the
updatelibs12
branch
2 times, most recently
from
4097f42 to
5ea9484
Compare
| api(mnLogging.slf4j.ext) | ||
| api(mn.snakeyaml) | ||
| api(mn.jackson.datatype.jsr310) | ||
| api(libs.rhino) |
There was a problem hiding this comment.
why do we need rhino?
There was a problem hiding this comment.
Unfortunately, otherwise the build won't build, and SonaType complains that the library contains a vulnerability. We don't use this library, but it is included as a transitive dependency via openapi-generator , which references the old swagger-parser, which in turn references rhino.
If you have another solution to this problem, no problem. Let's find a different solution. But the fact remains: if we don't do this, the build will fail.
There was a problem hiding this comment.
we should get a new transitive of the openapi-generator that fixes this vulnerability
There was a problem hiding this comment.
I don't quite understand what you're talking about... That's exactly what I did, replacing the vulnerable version with a non-vulnerable one. All other versions are up to date, but Rhino still connects to the old version, and there's no way to fix it without manual intervention.
There was a problem hiding this comment.
@graemerocher That's the reason, why I did it: https://github.com/micronaut-projects/micronaut-openapi/actions/runs/22398072224/job/64836816791
3 participants
No description provided.