Comments (10)
Come on. It's been six more months. Just release an update so all the Maven dependencies can be updated to bring in the version of SnakeYAML that doesn't flag a CVE. It doesn't matter if you think it's a real or imaginary vulnerability. Tools flag the dependencies as having CVEs.
from uap-java.
I think it is safe to update SnakeYAML to 2.0.
See release notes: https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes
PR for this project: #82
from uap-java.
Is there an ETA on when the next release will be made that contains 82 and/or 83?
from uap-java.
I don’t have a specific eta but I will do it once I have some time to evaluate all the recent PRs and requests
from uap-java.
@bpossolo My suggestion would be to make a release that is only the individual pull request to update the SnakeYAML dependency as it has a security vulnerability.
from uap-java.
from my understanding, the “security vulnerability” is not a real vulnerability as has been pointed out by the maintainers of snakeyml.
It’s only a vulnerability if youre using snakeyml to load untrusted content.
i need to figure out if the best path forward is to use a different lib (doesn’t introduce breaking change) or if it should be done at build time (introduced breaking change)
from uap-java.
Guys can you please release a new version ...
This is causing issue with project with uap-java and springboot 3.2+
from uap-java.
Could you please release a version with snake yaml 2.0 ?
from uap-java.
please.. this is really urgent! Can we release version with snake yaml 2.x?
from uap-java.
I'm pleased to announce version 1.6.1 has been released to Maven Central and the security vulnerability has been addressed.
see here for what's changed
https://github.com/ua-parser/uap-java/releases/tag/v1.6.1
from uap-java.
Related Issues (20)
- Building jar doesn't work HOT 1
- maven release HOT 1
- Hi, Benjamin HOT 1
- Why not deploy to maven central? HOT 1
- Third party library or framework integration plan HOT 5
- Please release to include latest changes to UAP-Core HOT 5
- IOException not imported by CacheParser HOT 5
- Update uap-core to 0.13.0 HOT 1
- SnakeYAML requires the java.desktop module HOT 1
- parse error HOT 2
- UserAgent Parser does not support patchMinor
- CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections HOT 2
- Migrate yaml parsing to compile phase HOT 2
- Make it possible to use RE2J instead of java.util.regexp HOT 5
- Change yaml parser to org.snakeyaml:snakeyaml-engine HOT 8
- User-agent with CriOS mapped wrongly
- User-agent with EdgiOS mapped wrongly
- Bring back Java 8 Support HOT 4
- UserAgent Parser does not support brand and model in device
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from uap-java.