Skip to content

Fix versions for dependencies to address vulnerabilities#375

Merged
catarina-correia merged 1 commit into
mainfrom
CHK-fix-vulnerabilities
May 27, 2026
Merged

Fix versions for dependencies to address vulnerabilities#375
catarina-correia merged 1 commit into
mainfrom
CHK-fix-vulnerabilities

Conversation

@catarina-correia
Copy link
Copy Markdown
Contributor

@catarina-correia catarina-correia commented May 27, 2026

Security Vulnerability Fixes

Addresses three known security vulnerabilities by enforcing minimum dependency versions:

  • Jackson Core: Bump to 3.1.1+ to fix maxDocumentLength bypass (GHSA-2m67-wjpj-xhg9)
  • Apache Tomcat Embed: Bump to 11.0.22+ to fix multiple vulnerabilities (GHSA-rv64-5gf8-9qq8 and 3 others)
  • Netty Codec HTTP: Bump to 4.2.13.Final+ to fix HTTP Request Smuggling via malformed Transfer-Encoding headers (GHSA-38f8-5428-x5cv)

Implementation Change

Refactors from global resolutionStrategy.eachDependency block to Gradle constraints DSL within dependencies block, improving dependency resolution clarity and maintainability.


@catarina-correia catarina-correia requested a review from a team as a code owner May 27, 2026 10:34
@catarina-correia catarina-correia requested a review from pboos May 27, 2026 10:34
@catarina-correia catarina-correia requested a review from Copilot May 27, 2026 10:35
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@catarina-correia catarina-correia merged commit 7f906a3 into main May 27, 2026
4 checks passed
@catarina-correia catarina-correia deleted the CHK-fix-vulnerabilities branch May 27, 2026 11:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants