Bump Snakeyaml from 1.26 to 2.0

UKGovLD / registry-core

Linked data registry - core application and example UI

https://github.com/UKGovLD/registry-core/wiki

Apache License 2.0

23 stars 9 forks source link

Bump Snakeyaml from 1.26 to 2.0 #183

Closed cfollenf closed 1 year ago

cfollenf commented 1 year ago

Current version of SnakeYAML (1.26) holds a critical vulnerability CVE-2022-1471 which was updated yesterday March 21st, could you please bump it up to version 2.00 ?

der commented 1 year ago

Will do, but note that registry-core does not use yaml at all, let alone expose an endpoint for it to untrusted content.

der commented 1 year ago

Patched release done (thanks @simonoakesepimorphics)

cfollenf commented 1 year ago

Thanks again.