search

square / subzero

Block's Bitcoin Cold Storage solution.
Apache License 2.0
683 stars 95 forks source link

[java] upgrade dropwizard dependencies to 2.1.7 #681

Closed ivmaykov closed 1 year ago

ivmaykov commented 1 year ago

The dropwizard 2.1.1 dependency had some vulnerable transitive dependencies. Most of them are mitigated with the 2.1.7 upgrade, with the exception of snakeyaml 1.31, which we manually exclude and override with non-vulnerable snakeyaml 2.0.

ivmaykov commented 1 year ago

Looks like building on linux has additional dependencies compared to Mac OS. I'll rebuild on my linux box, fix the dependencies, and update the PR, stay tuned.