Closed slakwa closed 2 years ago
Duplicate of #98 -- there is no actual vulnerability in gosu
itself that is mitigated by this update. :see_no_evil:
While I agree that this should be updated, I do not plan to make a new release from it, so I do not want to merge this under false expectations. :heart:
Seems like they are saying that it has this vulnerability:
https://nvd.nist.gov/vuln/detail/CVE-2021-39293
@tianon can you please confirm or deny?
Also if https://github.com/tianon/gosu/pull/102 will be merged then I'm fine with closing this one
See #94 and #97 (in short, no, that's a false positive / overzealous report: gosu
does not do anything with .zip
files/formats, thus does not use archive/zip
).
We need this update to mitigate some vulnerabilities that our Security department found