Vulnerability Issues with ch.qos.logback:logback-classic:jar:1.5.12 under the com.intuit.karate:karate-junit5:jar:1.4.1

[saxensan]

Team,

We have been using the karate-junit5 -1.4.1 and have been facing the vulnerability issues from the Dependabot alerts (Screenshot attached) related to the ch.qos.logback:logback-classic:jar:1.5.12

Please suggest us on the same.

[ptrthomas]

@saxensan please try 1.5.2.RC1 now available in Maven central: https://central.sonatype.com/artifact/io.karatelabs/karate-core/1.5.2.RC1

do confirm if it solves the issue

[ptrthomas]

@saxensan thanks for confirming, I'll just flip the status to open (fixed) - the process we follow is to close issues only when a final release version (non-RC) is out. in this case our assessment is that the RC is good for production use

[ptrthomas]

karate 1.5.2 final released