[
https://issues.apache.org/jira/browse/CALCITE-7098?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Niels Pardon updated CALCITE-7098:
----------------------------------
Description:
Calcite currently depends on json-smart 2.3 which has multiple direct and
indirect vulnerabilities. Upgrading to the latest 2.5.2 fixes those
vulnerabilities.
- json-smart is a dependency in the calcite BOM
- json-smart is brought in by the unfixed dependency
com.jayway.jsonpath:json-path:2.9.0
https://github.com/json-path/JsonPath/pull/1030
was:Calcite currently depends on json-smart 2.3 which has multiple direct and
indirect vulnerabilities. Upgrading to the latest 2.5.2 fixes those
vulnerabilities.
> Update json-smart dependency to latest version to address CVEs
> --------------------------------------------------------------
>
> Key: CALCITE-7098
> URL: https://issues.apache.org/jira/browse/CALCITE-7098
> Project: Calcite
> Issue Type: Improvement
> Reporter: Niels Pardon
> Priority: Major
>
> Calcite currently depends on json-smart 2.3 which has multiple direct and
> indirect vulnerabilities. Upgrading to the latest 2.5.2 fixes those
> vulnerabilities.
> - json-smart is a dependency in the calcite BOM
> - json-smart is brought in by the unfixed dependency
> com.jayway.jsonpath:json-path:2.9.0
> https://github.com/json-path/JsonPath/pull/1030
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
