algolia / algoliasearch-client-kotlin

⚡️ A fully-featured and blazing-fast Kotlin/Android API client to interact with Algolia.
https://www.algolia.com/doc/api-client/getting-started/install/kotlin/
MIT License
59 stars 23 forks source link

Update Kotlin client of version `2.1.*` to `ktor-*` artifacts of the new versions to avoid CVE-2023-45612 and CVE-2023-45613 #412

Open dmitry-weirdo opened 11 months ago

dmitry-weirdo commented 11 months ago

Is your feature request related to a problem? Please describe 🙏
Currently, the io.ktor:ktor-* artifacts of version 2.2.3 are hurt by the critical CVEs — CVE-2023-45612 and CVE-2023-45613.

Describe the solution you'd like 🤔
No need to wait for the breaking 3.0.0 release. Please add a new release that updates the io.ktor:ktor-* artifacts to the current latest versions (i.e. at least 2.3.5 or better 2.3.6 versions that fix the mentioned CVEs).

Describe alternatives you've considered ✨
Client version 3.0.0 MUST definitely depend on the updated io.ktor:ktor-* artifacts.

Additional context
These are the current dependencies of algoliasearch-client-kotlin-jvm:2.1.8:

+- com.algolia:algoliasearch-client-kotlin-jvm:jar:2.1.8:compile
|  +- io.ktor:ktor-client-core-jvm:jar:2.2.3:compile
|  |  +- io.ktor:ktor-http-jvm:jar:2.2.3:compile
|  |  |  \- io.ktor:ktor-utils-jvm:jar:2.2.3:compile
|  |  |     \- io.ktor:ktor-io-jvm:jar:2.2.3:compile
|  |  +- io.ktor:ktor-events-jvm:jar:2.2.3:compile
|  |  +- io.ktor:ktor-websocket-serialization-jvm:jar:2.2.3:compile
|  |  \- org.jetbrains.kotlinx:kotlinx-coroutines-slf4j:jar:1.7.3:runtime
|  +- org.jetbrains.kotlinx:kotlinx-serialization-json-jvm:jar:1.6.1:compile
|  |  \- org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:jar:1.6.1:compile
|  +- org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.9.20:compile
|  +- io.ktor:ktor-client-logging-jvm:jar:2.2.3:runtime
|  +- io.ktor:ktor-serialization-kotlinx-json-jvm:jar:2.2.3:runtime
|  |  \- io.ktor:ktor-serialization-kotlinx-jvm:jar:2.2.3:runtime
|  \- io.ktor:ktor-client-content-negotiation-jvm:jar:2.2.3:runtime
|     \- io.ktor:ktor-serialization-jvm:jar:2.2.3:compile
|        \- io.ktor:ktor-websockets-jvm:jar:2.2.3:compile
dmitry-weirdo commented 11 months ago

https://github.com/algolia/algoliasearch-client-kotlin/pull/393 — please merge this MR that also includes te ktor-* updates from 2.2.3 to 2.3.7.