algoliasearch-client-kotlin icon indicating copy to clipboard operation
algoliasearch-client-kotlin copied to clipboard

Update Kotlin client of version `2.1.*` to `ktor-*` artifacts of the new versions to avoid CVE-2023-45612 and CVE-2023-45613

Open dmitry-weirdo opened this issue 2 years ago • 1 comments

Is your feature request related to a problem? Please describe 🙏
Currently, the io.ktor:ktor-* artifacts of version 2.2.3 are hurt by the critical CVEs — CVE-2023-45612 and CVE-2023-45613.

Describe the solution you'd like 🤔
No need to wait for the breaking 3.0.0 release. Please add a new release that updates the io.ktor:ktor-* artifacts to the current latest versions (i.e. at least 2.3.5 or better 2.3.6 versions that fix the mentioned CVEs).

Describe alternatives you've considered ✨
Client version 3.0.0 MUST definitely depend on the updated io.ktor:ktor-* artifacts.

Additional context
These are the current dependencies of algoliasearch-client-kotlin-jvm:2.1.8:

+- com.algolia:algoliasearch-client-kotlin-jvm:jar:2.1.8:compile
|  +- io.ktor:ktor-client-core-jvm:jar:2.2.3:compile
|  |  +- io.ktor:ktor-http-jvm:jar:2.2.3:compile
|  |  |  \- io.ktor:ktor-utils-jvm:jar:2.2.3:compile
|  |  |     \- io.ktor:ktor-io-jvm:jar:2.2.3:compile
|  |  +- io.ktor:ktor-events-jvm:jar:2.2.3:compile
|  |  +- io.ktor:ktor-websocket-serialization-jvm:jar:2.2.3:compile
|  |  \- org.jetbrains.kotlinx:kotlinx-coroutines-slf4j:jar:1.7.3:runtime
|  +- org.jetbrains.kotlinx:kotlinx-serialization-json-jvm:jar:1.6.1:compile
|  |  \- org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:jar:1.6.1:compile
|  +- org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.9.20:compile
|  +- io.ktor:ktor-client-logging-jvm:jar:2.2.3:runtime
|  +- io.ktor:ktor-serialization-kotlinx-json-jvm:jar:2.2.3:runtime
|  |  \- io.ktor:ktor-serialization-kotlinx-jvm:jar:2.2.3:runtime
|  \- io.ktor:ktor-client-content-negotiation-jvm:jar:2.2.3:runtime
|     \- io.ktor:ktor-serialization-jvm:jar:2.2.3:compile
|        \- io.ktor:ktor-websockets-jvm:jar:2.2.3:compile

dmitry-weirdo avatar Dec 08 '23 17:12 dmitry-weirdo

https://github.com/algolia/algoliasearch-client-kotlin/pull/393 — please merge this MR that also includes te ktor-* updates from 2.2.3 to 2.3.7.

dmitry-weirdo avatar Dec 08 '23 17:12 dmitry-weirdo