Skip to content

Fix versions for dependencies to address vulnerabilities - #375

Merged
catarina-correia merged 1 commit into
mainfrom
CHK-fix-vulnerabilities
May 27, 2026
Merged

Fix versions for dependencies to address vulnerabilities#375
catarina-correia merged 1 commit into
mainfrom
CHK-fix-vulnerabilities

Conversation

@catarina-correia

@catarina-correiacatarina-correia commented May 27, 2026

Copy link
Copy Markdown
Contributor

Security Vulnerability Fixes

Addresses three known security vulnerabilities by enforcing minimum dependency versions:

  • Jackson Core: Bump to 3.1.1+ to fix maxDocumentLength bypass (GHSA-2m67-wjpj-xhg9)
  • Apache Tomcat Embed: Bump to 11.0.22+ to fix multiple vulnerabilities (GHSA-rv64-5gf8-9qq8 and 3 others)
  • Netty Codec HTTP: Bump to 4.2.13.Final+ to fix HTTP Request Smuggling via malformed Transfer-Encoding headers (GHSA-38f8-5428-x5cv)

Implementation Change

Refactors from global resolutionStrategy.eachDependency block to Gradle constraints DSL within dependencies block, improving dependency resolution clarity and maintainability.


CopilotAI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@catarina-correia
catarina-correia merged commit 7f906a3 into mainMay 27, 2026
4 checks passed
@catarina-correia
catarina-correia deleted the CHK-fix-vulnerabilities branch May 27, 2026 11:41
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@catarina-correia@juliocastrodev