Feature Request: Make Jinjava Dependencies Easily Upgradeable
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 5/5
- 預估耗時
- 一週以上
- 新手友好度
- 12/100
- Issue 類型
- 功能
- 描述清晰度
- 基本清楚
- 活躍度
- 活躍
- 技術堆疊
- java
- 領域
- build-system
研究方向
The issue asks for a Java artifact that declares Jsoup and similar libraries as ordinary Maven dependencies instead of bundling them, so consumers can override versions in their own pom.xml. Start by finding where the build packages Jsoup into the Jinjava artifact, then decide how a distribution without it would be published. Done means a consumer can pin a patched Jsoup version through Maven with no Jinjava release, and the maintainers have agreed on the packaging approach.
由索引模型根據 Issue 內容生成。
描述
Context
A security vulnerability has been identified in the version of Jsoup used by Jinjava. Since Jsoup is bundled directly into Jinjava, upgrading it through the consuming project's pom.xml is not straightforward.
This creates a dependency on a new Jinjava release to benefit from security fixes, potentially delaying remediation.
Proposed Improvement
Provide a Java distribution of Jinjava that exposes dependencies such as Jsoup as external Maven dependencies, with versions that can be overridden or upgraded independently through the consuming project's pom.xml.
Ideally, these dependencies should be declared as regular Maven dependencies rather than being shaded or embedded directly into the Jinjava artifact.
Benefits
- Faster security remediation: Upgrade vulnerable dependencies without waiting for a new Jinjava release.
- Improved dependency management: Let consuming projects control dependency versions through Maven.
- Reduced security exposure: Minimize the time applications remain vulnerable to known security issues.
- Greater flexibility: Make it easier to keep Jinjava-based applications aligned with dependency security policies.
Expected Outcome
A Jinjava Java artifact with externally managed, independently upgradeable dependencies, allowing consumers to apply security fixes as soon as patched dependency versions become available.
- 主要語言
- Java
- 星號
- 789
- 分支
- 185
- 平均合併
- 1 小時 33 分鐘
- 30 天內合併 PR
- 10
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
HubSpot/jinjava 的其他 Issue
-
`default` filter requires an explicit argument and fails without one可能已有人在做 @PHJ2000 於 11 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 82/100
維護者通常 1 天內回覆
-
`~` stringifies maps with Java Map.toString() instead of Python dict repr可能已有人在做 @alloutflo 於 10 天前認領。 未關閉
難度 3/5 1-2 天 新手友好度 82/100
維護者通常 1 天內回覆
-
難度 3/5 1-2 天 新手友好度 76/100
維護者通常 1 天內回覆
-
Jinjava 3.0可能重新可做 @jasmith-hs 於 244 天前認領，目前沒有進行中的 PR。 未關閉
HubSpot/jinjava#1288 · 已指派 1 人 ·
維護者通常 1 天內回覆
-
難度 4/5 3-5 天 新手友好度 35/100
維護者通常 1 天內回覆
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 72/100
維護者通常 3 天內回覆
-
A proxy that fails to start logs a RejectedExecutionException stack trace from its shutdown hook未關閉follow-up
難度 2/5 1-3 小時 新手友好度 62/100
Sanne/incus-spawn#1953 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 72/100
atlassian/data-center-helm-charts#1170 ·
維護者通常 1 天內回覆
-
Bug
難度 2/5 1-3 小時 新手友好度 70/100
維護者通常 1 天內回覆
-
Issue: Bug
難度 2/5 1-3 小時 新手友好度 62/100
OpenAPITools/openapi-generator#25524 ·
維護者通常 1 天內回覆