search

kordamp / markdown-gradle-plugin

Markdown/HTML plugin for gradle
Apache License 2.0
71 stars 51 forks source link

Vulnerabilities in dependency `com.overzealous:remark:1.1.0` #34

Open midmarch opened 1 year ago

midmarch commented 1 year ago

Dependency com.overzealous:remark:1.1.0, declared here:

https://github.com/kordamp/markdown-gradle-plugin/blob/5087eec19ec0e653ba4d4de2353f4bf501d550a4/build.gradle#L74

contains multiple vulnerabilities:

  1. CVE-2022-36033
  2. CVE-2021-37714
  3. CVE-2021-29425
  4. CVE-2020-15250

Ref: https://mvnrepository.com/artifact/com.overzealous/remark/1.1.0

aalmiray commented 1 year ago

The CVES come from jsoup. Latest jsoup (1.15.3) fixes these errors but in a binary incompatible way. Remark (com.kotcrab.remark:remark:1.2.0) has not been updated.

siboxd commented 1 month ago

The mentioned dependency is no more present on maven, and any build using your library fails because of it.

Can it be replaced, and a new library version published?