PlaytikaOSS / testcontainers-spring-boot

Container auto-configurations for Spring Boot based integration tests
https://www.playtika.com
MIT License
859 stars 240 forks source link

avoid commons-compress CVEs #1988

Open davidkarlsen opened 3 months ago

davidkarlsen commented 3 months ago

Describe the bug

INFO] +- com.playtika.testcontainers:embedded-azurite:jar:3.1.7:test
[INFO] |  +- com.playtika.testcontainers:testcontainers-common:jar:3.1.7:test
[INFO] |  +- com.playtika.testcontainers:embedded-toxiproxy:jar:3.1.7:test
[INFO] |  |  \- org.testcontainers:toxiproxy:jar:1.19.8:test
[INFO] |  |     \- eu.rekawek.toxiproxy:toxiproxy-java:jar:2.1.7:test
[INFO] |  +- org.testcontainers:testcontainers:jar:1.19.8:test
[INFO] |  |  +- junit:junit:jar:4.13.2:test
[INFO] |  |  |  \- org.hamcrest:hamcrest-core:jar:2.2:test
[INFO] |  |  +- org.apache.commons:commons-compress:jar:1.24.0:test
[INFO] |  |  +- org.rnorth.duct-tape:duct-tape:jar:1.0.8:test
[INFO] |  |  |  \- org.jetbrains:annotations:jar:17.0.0:runtime

this has several vulns which are tied to CVE-2024-26308

Expected behavior A clear and concise description of what you expected to happen.

Enviroment (please complete the following information):

Module (please complete the following information):

Additional context Add any other context about the problem here.

Fameing commented 3 months ago

related to https://github.com/testcontainers/testcontainers-java/issues/8338#issue-2143735136