search

cloudevents / spec

CloudEvents Specification
https://cloudevents.io
Apache License 2.0
4.9k stars 577 forks source link

Security Audit - Outdated dependencies #1132

Open embano1 opened 1 year ago

embano1 commented 1 year ago

After reviewing the recent security audit I was wondering whether we should enable Github Dependabot for this repo to automatically bump deps.

cc/ @duglin @lionelvillard

duglin commented 1 year ago

yep - just need to find the time :-)

github-actions[bot] commented 1 year ago

This issue is stale because it has been open for 30 days with no activity. Mark as fresh by updating e.g., adding the comment /remove-lifecycle stale.

YohanSciubukgian commented 4 months ago

As CloudEvents provide SDKs with out of the box integration with 3rd party libraries, could we add either dependabot or renovate for managing all dependencies for all CloudEvents repositories?

For example, on the JAVA-SDK repository, the latest SDK update is from May 15, 2023 and the following packages have known vulnerabilities on 3rd party dependencies:

embano1 commented 3 months ago

Yes, we use Dependabot in the sdk-go repo. Want to file a PR? Not sure how much work is involved though to integrate with Maven (security keys to push).

github-actions[bot] commented 2 months ago

This issue is stale because it has been open for 30 days with no activity. Mark as fresh by updating e.g., adding the comment /remove-lifecycle stale.