Feature Request: Make Jinjava Dependencies Easily Upgradeable
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 12/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- java
- 领域
- build-system
调研方向
The issue asks for a Java artifact that declares Jsoup and similar libraries as ordinary Maven dependencies instead of bundling them, so consumers can override versions in their own pom.xml. Start by finding where the build packages Jsoup into the Jinjava artifact, then decide how a distribution without it would be published. Done means a consumer can pin a patched Jsoup version through Maven with no Jinjava release, and the maintainers have agreed on the packaging approach.
由索引模型根据 Issue 内容生成。
描述
Context
A security vulnerability has been identified in the version of Jsoup used by Jinjava. Since Jsoup is bundled directly into Jinjava, upgrading it through the consuming project's pom.xml is not straightforward.
This creates a dependency on a new Jinjava release to benefit from security fixes, potentially delaying remediation.
Proposed Improvement
Provide a Java distribution of Jinjava that exposes dependencies such as Jsoup as external Maven dependencies, with versions that can be overridden or upgraded independently through the consuming project's pom.xml.
Ideally, these dependencies should be declared as regular Maven dependencies rather than being shaded or embedded directly into the Jinjava artifact.
Benefits
- Faster security remediation: Upgrade vulnerable dependencies without waiting for a new Jinjava release.
- Improved dependency management: Let consuming projects control dependency versions through Maven.
- Reduced security exposure: Minimize the time applications remain vulnerable to known security issues.
- Greater flexibility: Make it easier to keep Jinjava-based applications aligned with dependency security policies.
Expected Outcome
A Jinjava Java artifact with externally managed, independently upgradeable dependencies, allowing consumers to apply security fixes as soon as patched dependency versions become available.
- 主要语言
- Java
- 星标
- 787
- 派生
- 184
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
HubSpot/jinjava 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 82/100
-
难度 2/5 1-3 小时 新手友好度 64/100
-
Upgrade jsoup未关闭
难度 3/5 1-2 天 新手友好度 45/100
-
难度 3/5 1-2 天 新手友好度 82/100
-
难度 3/5 1-2 天 新手友好度 76/100
相似的 Issue
-
bug follow-up lane:backlog
难度 2/5 1-3 小时 新手友好度 82/100
Sanne/incus-spawn#1576 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 69/100
checkstyle/checkstyle#22069 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 86/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 67/100
it-at-m/eNoVa-Editor#79 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 65/100
维护者通常 1 天内回复