Open jonathan-neufeld-asurion opened 3 years ago
Hi @jonathan-neufeld-asurion I think these are likely not going to have any serious impact, as AFAICT:
Still, we bump dependencies regularly and I believe both of these should be addressed in the next release in order to prevent false positives being flagged in future.
The first issue is fixed through #4167.
GitHub Dependabot is reporting four High severity vulnerabilities in org.testcontainers/junit-jupiter:1.19.8
related to commons-compress:
Any chance of an upgrade to commons-compress 1.26.0 which would resolve all of these?
As of Test Containers v0.39.5 for Scala 2 (and I believe v0.39.7) our Snyk pipeline has reported the following vulnerabilities with transitive dependencies of Test Containers:
These both have a low priority score. If these are legitimate vulnerabilities is there a planned or available fix version for test containers?