You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@pulsar.apache.org by GitBox <gi...@apache.org> on 2022/01/31 22:36:00 UTC

[GitHub] [pulsar-adapters] dlg99 opened a new pull request #33: Add OWASP dependency checker

dlg99 opened a new pull request #33:
URL: https://github.com/apache/pulsar-adapters/pull/33


   ### Motivation
   
   Add OWASP dependency checker into the build to scan dependencies for CVEs.
   
   ### Modifications
   
   Added OWASP dependency checker into the build
   
   ### Verifying this change
   
   This change is a trivial rework / code cleanup without any test coverage.
   
   Ran `mvn clean install verify -Powasp-dependency-check -DskipTests && open target/dependency-check-report.html`
   
   ### Does this pull request potentially affect one of the following parts:
   
   *If `yes` was chosen, please highlight the changes*
   
   NO
   
     - Dependencies (does it add or upgrade a dependency): (yes / no)
     - The public API: (yes / no)
     - The schema: (yes / no / don't know)
     - The default values of configurations: (yes / no)
     - The wire protocol: (yes / no)
     - The rest endpoints: (yes / no)
     - The admin cli options: (yes / no)
     - Anything that affects deployment: (yes / no / don't know)
   
   ### Documentation
   
     - Does this pull request introduce a new feature? no
     - If yes, how is the feature documented? not applicable)
     - If a feature is not applicable for documentation, explain why? internal build change
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [pulsar-adapters] dlg99 commented on pull request #33: Add OWASP dependency checker

Posted by GitBox <gi...@apache.org>.
dlg99 commented on pull request #33:
URL: https://github.com/apache/pulsar-adapters/pull/33#issuecomment-1057517761


   @dave2wave 2.8.2 was the latest for 2.8.x. Bumping it here was needed to bump some other dependencies and to remove a few CVEs + remove some false alarms for CVEs.
   
   pulsar-adapters were missed in the 2.9.x releases and upping version there is a separate task (with potentially separate set of problems that are out of scope here)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [pulsar-adapters] dave2wave commented on pull request #33: Add OWASP dependency checker

Posted by GitBox <gi...@apache.org>.
dave2wave commented on pull request #33:
URL: https://github.com/apache/pulsar-adapters/pull/33#issuecomment-1057514874


   I'm curious about the choice of pulsar 2.8.2 and versioning here. Is this test for the main branch or other branches?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org