Closed xhdtn8070 closed 8 months ago
Two things:
(from the authors of snakeyaml)
We can't not use that snakeyaml version on legacy MC versions, modern MC versions use the latest one. We only import it as dependency because of one class constructor but use no code from it.
Hello! Matej!
I am writing to bring to your attention a security concern related to the
snakeyaml
dependency used in the[Your Library's Name]
project. Recently, I encountered a warning about vulnerable dependencies when using your library, specifically pointing toorg.yaml:snakeyaml:1.33
. This version ofsnakeyaml
has been identified with critical security vulnerabilities, including CVE-2022-41854 and CVE-2022-1471, which pose significant risks.Fortunately, a new version of
snakeyaml
(version 2.2) has been released that addresses these security issues. Considering the potential impact of these vulnerabilities, I kindly request that you consider updating thesnakeyaml
dependency in your project to this latest version.This update would greatly enhance the security for all users of your library and help maintain the trust and reliability of the project.
Thank you for your attention to this matter and for your continued efforts in maintaining this valuable resource. I appreciate your prompt action in resolving this security concern.
Best regards, Tony https://mvnrepository.com/artifact/org.yaml/snakeyaml![image](https://github.com/kangarko/Foundation/assets/19249550/e83aad0a-871b-469c-a3ad-eddda585e45a)