mustangproject
mustangproject copied to clipboard
Update vulnerable libraries
org.mustangproject:library is reported to contain the following dependencies that have known vulnerabilities:
com.fasterxml.jackson.core:jackson-databind:2.13.0 org.assertj:assertj-core:2.9.0
Please update.
Hi, I upgraded xmlunit-assertj from 2.6.3 to 2.9.0 in validator, where did you find the com.fasterxml.jackson.core:jackson-databind:2.13.0? I only see a 2.13.2.1 in the library pom.
See library-2.5.0.jar/META-INF/maven/com.fasterxml.jackson.core/jackson-databind/
The com.fasterxml.jackson.core:jackson-databind:2.13.0 report is gone now. However, the org.assertj:assertj-core:2.9.0 report remains.
Do you use XMLUnit for testing purposes so the assertj dependency comes in? I wonder why you would require the library in the JAR.
upgraded from 2.6.3 to 2.9.0
@uwemock could you please confirm this is closed in the most recent Release? Thanks
Looks good