You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@shenyu.apache.org by "realize096 (via GitHub)" <gi...@apache.org> on 2023/09/10 09:18:02 UTC
[GitHub] [shenyu] realize096 opened a new pull request, #5137: fix(sec): upgrade com.google.guava:guava to 32.0.0-jre
realize096 opened a new pull request, #5137:
URL: https://github.com/apache/shenyu/pull/5137
### What happened？
There are 1 security vulnerabilities found in com.google.guava:guava 31.1-jre
- [CVE-2023-2976](https://www.oscs1024.com/hd/CVE-2023-2976)
### What did I do？
Upgrade com.google.guava:guava from 31.1-jre to 32.0.0-jre for vulnerability fix
### What did you expect to happen？
Ideally, no insecure libs should be used.
### How can we automate the detection of these types of issues?
By using the [GitHub Actions](https://github.com/murphysecurity/actions) configurations provided by murphysec, we can conduct automatic code security checks in our CI pipeline.
### The specification of the pull request
[PR Specification](https://www.oscs1024.com/docs/pr-specification/) from OSCS
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(sec): upgrade com.google.guava:guava to 32.0.0-jre [shenyu]
Posted by "moremind (via GitHub)" <gi...@apache.org>.
moremind commented on PR #5137:
URL: https://github.com/apache/shenyu/pull/5137#issuecomment-1757222074
pls add my wechat: yijia1949
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shenyu] moremind commented on pull request #5137: fix(sec): upgrade com.google.guava:guava to 32.0.0-jre
Posted by "moremind (via GitHub)" <gi...@apache.org>.
moremind commented on PR #5137:
URL: https://github.com/apache/shenyu/pull/5137#issuecomment-1713496418
pls update license files
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [shenyu] codecov-commenter commented on pull request #5137: fix(sec): upgrade com.google.guava:guava to 32.0.0-jre
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #5137:
URL: https://github.com/apache/shenyu/pull/5137#issuecomment-1712781862
## [Codecov](https://app.codecov.io/gh/apache/shenyu/pull/5137?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
> Merging [#5137](https://app.codecov.io/gh/apache/shenyu/pull/5137?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (9867e81) into [master](https://app.codecov.io/gh/apache/shenyu/commit/dad1eb1162c0b6d767ffc041681c72ac0ac961cf?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (dad1eb1) will **decrease** coverage by `0.76%`.
> The diff coverage is `n/a`.
```diff
@@ Coverage Diff @@
## master #5137 +/- ##
============================================
- Coverage 61.13% 60.37% -0.76%
+ Complexity 8469 8392 -77
============================================
Files 1242 1242
Lines 37316 37315 -1
Branches 3532 3528 -4
============================================
- Hits 22812 22530 -282
- Misses 12540 12883 +343
+ Partials 1964 1902 -62
```
[see 26 files with indirect coverage changes](https://app.codecov.io/gh/apache/shenyu/pull/5137/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
:mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(sec): upgrade com.google.guava:guava to 32.0.0-jre [shenyu]
Posted by "moremind (via GitHub)" <gi...@apache.org>.
moremind merged PR #5137:
URL: https://github.com/apache/shenyu/pull/5137
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org