search

Azure / autorest-clientruntime-for-java

The runtime libraries for AutoRest generated Java clients.
MIT License
20 stars 59 forks source link

Upgrade com.squareup.okhttp3:okhttp libraries to >= 4.9.2 due to critical security vulnerability #711

Open anbangz opened 2 years ago

anbangz commented 2 years ago

Description of vulnerability here: https://github.com/square/okhttp/issues/6738

Snyk vulnerability here: https://security.snyk.io/vuln/SNYK-JAVA-COMSQUAREUPOKHTTP3-2958044

I believe the

libraries will also have to be upgraded, as they take transitive dependencies on com.squareup.okhttp3:okhttp:3.12.12

kpytlar commented 1 year ago

Checking in here - any plans to mitigate this vulnerability?

weidongxu-microsoft commented 1 year ago

Almost all client lib that depends on autorest-clientruntime-for-java was deprecated.

If you still use these libs (usually namespace with "com.microsoft.azure.", please consider migrate to new client lib ("com.azure.").