nidi3 / graphviz-java

Use graphviz with pure java
Apache License 2.0
934 stars 107 forks source link

Batik Dependency Subject to Known Vulnerabilities #251

Open syoon2 opened 11 months ago

syoon2 commented 11 months ago

https://github.com/nidi3/graphviz-java/blob/f0c1fdfa37c8b9876ef1dcccec1a6c19219e727e/graphviz-java/pom.xml#L92-L104

List of known vulnerabilities

Fixed in 1.15:

Fixed in 1.16:

Fixed in 1.17:

Issues Affecting This Repository

A simple dependency version bump works fine for 1.15 / 1.16. For 1.17, however, a simple version bump does not work as it breaks several Batik rasterizer tests, with the presumable cause being the patches for CVE-2022-44729.