Skip to content
This repository has been archived by the owner on May 12, 2021. It is now read-only.

Upgrading dependencies to mitigate vulnerabilities #88

Draft
wants to merge 9 commits into
base: master
Choose a base branch
from

Conversation

ridv
Copy link
Contributor

@ridv ridv commented Oct 3, 2019

Description:

A bot recently reported a large number of vulnerabilities that we inherited from our dependencies.

Creating a draft PR while I verify that these dependency upgrades do not have a negative impact.

Components upgraded:

  • Curator
  • Zookeeper
  • Shiro
  • Netty
  • Asynchttpclient
  • Quartz
  • Gradle
  • Gradle plugins
  • Jackson
  • Guice
  • Guava
  • Multiple react components.

Testing Done:

TODO

We should run a few end to end test runs to confirm everything is good.

After we merge this PR we need to create a PR for packaging which upgrades the gradle version there.

@ridv ridv requested review from StephanErb and mauri October 3, 2019 01:51
@ridv ridv self-assigned this Oct 3, 2019
Copy link
Member

@StephanErb StephanErb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for looking into this.

To make a deployment smooth it might make sense though to break this up a bit. Bisecting problems will be difficult if dependency updates are all on one big commit.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants