search

ring-clojure / ring

Clojure HTTP server abstraction
MIT License
3.75k stars 519 forks source link

Update Jetty to a newer release without known vulnerabilities #442

Closed Juholei closed 3 years ago

Juholei commented 3 years ago

The current release of ring-jetty-adapter contains a version of Jetty that has two known vulnerabilities, https://nvd.nist.gov/vuln/detail/CVE-2021-28169 and https://nvd.nist.gov/vuln/detail/CVE-2021-34428. These are fixed in the following Jetty releases. This pull request updates Jetty from 9.4.40 to 9.4.42 which fixes those vulnerabilities.

atomist[bot] commented 3 years ago

Commit messages of this repository should follow the seven rules of a great Git commit message, as mentioned in the project's contributing guidelines. It looks like there's a few issues with the commit messages in this pull request:

weavejester commented 3 years ago

Can you change the commit message from "a newer release" to "9.4.42". It helps when looking back through the commit messages.

Juholei commented 3 years ago

@weavejester commit message should now be updated.