Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update README to inform those with java version managers #37

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

Obsiye
Copy link

@Obsiye Obsiye commented Oct 11, 2022

  1. Upgrade dependency-check-maven
  2. Update README to describe the effect of maven with a java version manager like jenv. Use jenv enable-plugin maven in order for maven to use the correct java version

Why?

I had initial difficulty during the setup phase. The issue was that the repo uses java 8 and so I had to use a java version manager for switching versions. Maven was unable to update its java_home location until I enabled the maven plugin for jenv.

EDIT:

Reply to Giuseppe: Thank you, i'll try to make the changes on Friday during my L&D

Upgrade owasp depencies check (security testing)

Update README to describe the effect of maven with a java version manager. Use jenv enable-plugin maven

in order for maven to use the correct java version
Copy link

@your your left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Obsiye thank you for raising this PR! 🙌

Unfortunately, It looks like there might be a little bit more work involved before we can get this merged... 😢

  1. The Travis build is not running as travis-ci.org has been discontinued and it probably makes sense to quickly replace it with a Github action to run the maven build
  2. We need to bump a few more dependencies (or add them to the OWASP suppression list in the root folder - if deemed false positives).

If you need my help, happy to contribute to this branch.

One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '8.0':

esapi-2.0.1.jar: CVE-2022-23457(9.8)
logback-core-1.1.11.jar: CVE-2021-42550(6.6), CVE-2017-5929(9.8)
spring-core-4.3.16.RELEASE.jar: CVE-2022-22965(9.8)
spring-security-core-4.2.3.RELEASE.jar: CVE-2022-22978(9.8), CVE-2021-22112(8.8)
spring-web-4.3.16.RELEASE.jar: CVE-2022-22965(9.8), CVE-2016-1000027(9.8)
velocity-1.7.jar: CVE-2020-13936(8.8)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants