search

sbt / sbt-native-packager

sbt Native Packager
https://sbt-native-packager.readthedocs.io/en/stable/
BSD 2-Clause "Simplified" License
1.59k stars 439 forks source link

Upgrade commons-compress version #1515

Closed headiron closed 1 year ago

headiron commented 2 years ago

Hello All.

Recently, our company ran security scanning for our app which use sbt-native-packager and inform us to update commons-compress library from 1.20 to 1.21.

According to them, it has security vulnerability ( CVE-2021-35515 ).

Could you upgrade commons-compress to 1.21 ?

Best Regards

muuki88 commented 2 years ago

Hi @headiron

Thanks for the hint. Could open a pull request for it?. I'll merge and release next well 🥰

headiron commented 2 years ago

Thanks @muuki88

It is a first time for me to create PR on github so I don't know whether it is correct but I create a PR like below.

https://github.com/headiron/sbt-native-packager/pull/1

If I did wrong, could you guide me how to create a PR on github ?

Regards Ducheol

muuki88 commented 2 years ago

Thanks for trying 😊🤘

You came close. You created a PR on your own fork instead of this repository.

If you repeat the same steps and instead choose sbt/sbt-native-packager as the target repository then it should work 👍

headiron commented 2 years ago

Thanks @muuki88 . I see the PR is merged.

Just curios, when the new version will be released ?

muuki88 commented 2 years ago

I try this week 😁