apache/incubator-seata

[TODO] Check the dependency libs of all repositories, fix CVEs from them.

Open

Aperta il 21 ott 2023

Vedi su GitHub
 (3 commenti) (3 reazioni) (1 assegnatario)Java (25.960 star) (8878 fork)batch import
good first issuetask: help-wanted

Descrizione

This was mentioned through the ASF incubator voting. I think it would be better if we could track it.

One minor nit - the dependency list in
https://cwiki.apache.org/confluence/display/INCUBATOR/Seata+Proposal
has a great deal out of outdated dependencies - with a large number of
CVEs associated with them.

Let's scan them and fix them soon.

Guida contributor

Tech stack
java
Dominio
security
Tipo issue
security
DifficoltàQuanto dovrebbe essere impegnativa per un nuovo contributor.
3
Tempo stimatoTempo stimato per completare e verificare uno scope piccolo.
3-5 days
Stato attivitàQuanto è probabile che la issue sia ancora attiva e reviewable.
stale
ChiarezzaQuanto chiaramente la issue descrive problema, scope e risultato atteso.
clear
Prerequisiti
JavaMaven/Gradledependency management
Adatta ai principiantiQuanto la issue è adatta a contributor alla prima esperienza.
30
Direzione di ricerca
Investigate the current dependency list in the Seata project, likely in pom.xml files. Use tools like OWASP Dependency Check or Snyk to identify outdated dependencies with known CVEs. Focus on high and critical severity CVEs first. Review comments in the issue for any specific dependencies mentioned. The assignee may have a plan; check linked work or comments for guidance.