eclipse-rdf4j / rdf4j

Eclipse RDF4J: scalable RDF for Java
https://rdf4j.org/
BSD 3-Clause "New" or "Revised" License
365 stars 163 forks source link

Upgrade mapdb and dependency manage kerby #5035

Closed hmottestad closed 5 months ago

hmottestad commented 5 months ago

Currently mapdb 3.0.9 has the following dependency vulnerability: https://devhub.checkmarx.com/cve-details/CVE-2022-24329/

We should upgrade to 3.0.10 or 3.1.0. Since 3.1.0 is already harvested and cleared by ClearlyDefined then we should try that version first.

There is also a licensing issue with the transitive dependency kerby which is used by solr. We should try to bump this to the next version without licensing issues.