search

guardian / mobile-notifications-content

Lambda that reads from the content api stream and triggers notifications for followable content
2 stars 0 forks source link

[Snyk] Override apache avro version to fix critical vnlnerability #102

Closed waisingyiu closed 3 weeks ago

waisingyiu commented 3 weeks ago

What does this change?

The Snyk reported a critical vulnerability on apache avro library which is introduced by AWS kinesis client library transitively.

We are already using the latest version of AWS kinesis client library.

This PR overrides the Apache Avro library to use version 1.11.4 which fixes the vulnerability. It is a patch version bump from the version 1.11.3 we are using.