algoliasearch-client-kotlin
algoliasearch-client-kotlin copied to clipboard
Update Kotlin client of version `2.1.*` to `ktor-*` artifacts of the new versions to avoid CVE-2023-45612 and CVE-2023-45613
Is your feature request related to a problem? Please describe 🙏
Currently, the io.ktor:ktor-* artifacts of version 2.2.3 are hurt by the critical CVEs — CVE-2023-45612 and CVE-2023-45613.
Describe the solution you'd like 🤔
No need to wait for the breaking 3.0.0 release. Please add a new release that updates the io.ktor:ktor-* artifacts to the current latest versions (i.e. at least 2.3.5 or better 2.3.6 versions that fix the mentioned CVEs).
Describe alternatives you've considered ✨
Client version 3.0.0 MUST definitely depend on the updated io.ktor:ktor-* artifacts.
Additional context
These are the current dependencies of algoliasearch-client-kotlin-jvm:2.1.8:
+- com.algolia:algoliasearch-client-kotlin-jvm:jar:2.1.8:compile
| +- io.ktor:ktor-client-core-jvm:jar:2.2.3:compile
| | +- io.ktor:ktor-http-jvm:jar:2.2.3:compile
| | | \- io.ktor:ktor-utils-jvm:jar:2.2.3:compile
| | | \- io.ktor:ktor-io-jvm:jar:2.2.3:compile
| | +- io.ktor:ktor-events-jvm:jar:2.2.3:compile
| | +- io.ktor:ktor-websocket-serialization-jvm:jar:2.2.3:compile
| | \- org.jetbrains.kotlinx:kotlinx-coroutines-slf4j:jar:1.7.3:runtime
| +- org.jetbrains.kotlinx:kotlinx-serialization-json-jvm:jar:1.6.1:compile
| | \- org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:jar:1.6.1:compile
| +- org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.9.20:compile
| +- io.ktor:ktor-client-logging-jvm:jar:2.2.3:runtime
| +- io.ktor:ktor-serialization-kotlinx-json-jvm:jar:2.2.3:runtime
| | \- io.ktor:ktor-serialization-kotlinx-jvm:jar:2.2.3:runtime
| \- io.ktor:ktor-client-content-negotiation-jvm:jar:2.2.3:runtime
| \- io.ktor:ktor-serialization-jvm:jar:2.2.3:compile
| \- io.ktor:ktor-websockets-jvm:jar:2.2.3:compile
https://github.com/algolia/algoliasearch-client-kotlin/pull/393 — please merge this MR that also includes te ktor-* updates from 2.2.3 to 2.3.7.