search

lisawray / groupie

Groupie helps you display and manage complex RecyclerView layouts.
MIT License
3.66k stars 291 forks source link

Vulnerability detected in dependency used for the latest version in Maven Repository: 2.9.0 #433

Open TylerMcCraw opened 1 year ago

TylerMcCraw commented 1 year ago

Describe the bug Builds are failing due to this error

> Could not find com.xwray:groupie:2.9.0.
     Required by:
         *******************
 > Could not find com.xwray:groupie-viewbinding:2.9.0.
     Required by:
         *******************

Which leads me to this vulnerability found: https://mvnrepository.com/artifact/com.xwray/groupie/2.9.0 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15250

We need to upgrade the Junit dependency to 4.13.1 or higher to fix this issue

To Reproduce Steps to reproduce the behavior:

Expected behavior Gradle should be able to pull the dependency without errors due to vulnerabilities

Library version 2.9.0

Additional context Add any other context about the problem here.

TylerMcCraw commented 1 year ago

jk reason isn't because of a vulnerability, although that ought to still be fixed. The real reason is that I've been using an outdated namespace for the library for a really long time

com.xwray was changed to com.github.lisawray.groupie