Open midmarch opened 1 year ago
The CVES come from jsoup. Latest jsoup (1.15.3
) fixes these errors but in a binary incompatible way. Remark (com.kotcrab.remark:remark:1.2.0
) has not been updated.
The mentioned dependency is no more present on maven, and any build using your library fails because of it.
Can it be replaced, and a new library version published?
Dependency
com.overzealous:remark:1.1.0
, declared here:https://github.com/kordamp/markdown-gradle-plugin/blob/5087eec19ec0e653ba4d4de2353f4bf501d550a4/build.gradle#L74
contains multiple vulnerabilities:
Ref: https://mvnrepository.com/artifact/com.overzealous/remark/1.1.0