hugegraph / hugegraph-client

Please move to Apache Hugegraph-Toolchain, Thanks
https://hugegraph.apache.org/docs/quickstart/hugegraph-client/
Apache License 2.0
32 stars 45 forks source link

[Bug] Provides transitive vulnerable dependency maven:org.apache.commons:commons-text:1.9 #148

Closed liming1010 closed 11 months ago

liming1010 commented 11 months ago

Bug Type (问题类型)

None

Before submit

Environment (环境信息)

server 1.0 client 1.0

maven:

<dependency>
            <groupId>org.apache.hugegraph</groupId>
            <artifactId>hugegraph-client</artifactId>
            <version>1.0.0</version>
        </dependency>

Expected & Actual behavior (期望与实际表现)

maven提示:

Provides transitive vulnerable dependency maven:org.apache.commons:commons-text:1.9
CVE-2022-42889 9.8 Improper Control of Generation of Code ('Code Injection') vulnerability

这是一个漏洞信息

Vertex/Edge example (问题点 / 边数据举例)

No response

Schema [VertexLabel, EdgeLabel, IndexLabel] (元数据结构)

No response

imbajin commented 11 months ago

duplicate with https://github.com/apache/incubator-hugegraph-toolchain/issues/541