eclipse-tractusx / managed-identity-wallet

Apache License 2.0
7 stars 20 forks source link

Fix/security finding #277

Open thackerronak opened 3 months ago

thackerronak commented 3 months ago

Description

Spring boot and cloud lib version was updated to mitigate https://github.com/advisories/GHSA-f3jh-qvm4-mg39

Note: Below are two dependencies showing restricted which need to be fixed in ssi-lib. maven/mavencentral/org.jetbrains.kotlin/kotlin-stdlib-jdk7/1.9.23, None, restricted, #14188 maven/mavencentral/org.jetbrains.kotlin/kotlin-stdlib-jdk8/1.9.23, None, restricted, #14185

Pre-review checks

Please ensure to do as many of the following checks as possible, before asking for committer review:

borisrizov-zf commented 2 months ago

@thackerronak Hi, we cannot merge a PR which includes "restricted" dependencies. You also mentioned that this has to do with the SSI lib. Can you elaborate?

sonarcloud[bot] commented 2 months ago

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

thackerronak commented 2 months ago

@thackerronak Hi, we cannot merge a PR which includes "restricted" dependencies. You also mentioned that this has to do with the SSI lib. Can you elaborate?

@borisrizov-zf I have updated the DEPENDENCIES file and found that all dependencies are showing approved.

sonarcloud[bot] commented 1 month ago

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

nitin-vavdiya commented 4 hours ago

@thackerronak Please rebase and re-generate DEPENDENCIES