Open albertpastrana opened 3 years ago
I've seen that the versions 0.14.0
and 0.14.1
contain an old version of the tomcat-embed-core
package that also have several CVEs too. Which makes this change a bit useless in terms of making it clear of CVEs.
There is a change to move this dependency into test that has been merged but not published yet: https://github.com/apache/thrift/pull/2340
I guess we'd need to wait for 0.14.2
or 0.15.0
or try to use the exclude
feature in sbt too.
Hey Albert, Thanks for contributing! Since the Finatra library is developed in a monorepo, upgrades like this require moving the entire monorepo. This takes a long time, so we're unfortunately unable to merge this anytime soon.
Also present in latest tag, https://github.com/twitter/finatra/blob/finatra-23.11.0/build.sbt#L97
Problem
Current version of
libThrift
0.10.0
has some CVEs listed below:Solution
I've updated the dependency to 0.14.0, this would fix them.
PS: my first contribution in finatra, let me know if I should have done anything differently.