You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@daffodil.apache.org by "hdalsania (via GitHub)" <gi...@apache.org> on 2025/12/16 23:04:11 UTC

[I] Open CVEs found using sbt dependencyCheck and yarn audit [daffodil-vscode]

hdalsania opened a new issue, #1561:
URL: https://github.com/apache/daffodil-vscode/issues/1561

   ## Description
   
   This issue is created from v1.5.0 release feedback provided by Steve Lawrence.
   
   usage [MINOR] no open CVEs found using sbt dependencyCheck and yarn audit
        - MEDIUM finding for java commons-io 2.10.0 (CVE-2024-47554)
        - HIGH finding for java logback-core/classic 1.2.11 (CVE-2023-6378)
        - other jar dependencies seem to be false positives
        - LOW finding for npm cookie
   
   ## Steps to Reproduce
   
   sbt dependencyCheck and yarn audit
   
   ## Expected Behavior
   
   should not have any medium or high vulnerability exists.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@daffodil.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Open CVEs found using sbt dependencyCheck and yarn audit [daffodil-vscode]

Posted by "CoverRyan (via GitHub)" <gi...@apache.org>.

CoverRyan closed issue #1561: Open CVEs found using sbt dependencyCheck and yarn audit
URL: https://github.com/apache/daffodil-vscode/issues/1561


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@daffodil.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org