search

paypal / butterfly

Application transformation tool
https://paypal.github.io/butterfly/
MIT License
47 stars 50 forks source link

Upgrade to latest versions of spring-boot, spring-framework, javassis… #394

Closed myohn-paypal closed 2 years ago

myohn-paypal commented 2 years ago 
Upgrade to latest versions of spring-boot, spring-framework, javassist reflections

Fix CVE-2022-22950: Spring Expression DoS Vulnerability
https://tanzu.vmware.com/security/cve-2022-22950
fabiocarvalho777 commented 2 years ago

@myohn-paypal Butterfly used to use TravisCI for CI/CD, including to make sure PR changes would not break the build. However, recently PayPal decided to not allow open source projects to use TravisCI anymore. Because of that this PR changes were not automatically verified. We need to find an alternative to TravisCI, but that hasn't happened yet. Because of that, we can't automatically assure these changes don't break the build and tests. Please wait a little until this is figured out, then we can have this PR merged. Thanks.

fabiocarvalho777 commented 2 years ago

@myohn-paypal I have just configured GitHub Action to build test PRs. I am going to close and then reopen this PR to see if that triggers it. This is the first time I try this so I might need to repeat this process again if it doesn't work.

fabiocarvalho777 commented 2 years ago

@myohn-paypal it worked. I am going to merge this PR now but I won't release a new Butterfly version right away necessarily. I now need to replace Travis deploy job (needed for the release process). Hopefully that won't take too much time.