Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix snyk high in ion-java library #39

Merged
merged 1 commit into from
Mar 5, 2024
Merged

Conversation

Divs-B
Copy link
Contributor

@Divs-B Divs-B commented Mar 4, 2024

What does this change?

Pubflow started showing ion-java snyk high vuln under latest firehose client version.
Though firehose-client not showing high vuln in ion-java library (transitive dependency under kinesis-client)which is strange.
Trying to put 1.10.5 version of com.amazon.ion as recommended patch to check whether this will work fix pubflow high vuln or not. https://security.snyk.io/vuln/SNYK-JAVA-COMAMAZONION-6143590

How to test

Make a preview release and test in pubflow to see if this fixes high vuln in it or not.

How can we measure success?

Have we considered potential risks?

Images

Accessibility

This seems patchable and should be tested in its client example-pubflow to confirm,
@Divs-B Divs-B requested a review from a team as a code owner March 4, 2024 17:20
@gu-scala-library-release
Copy link
Contributor

@Divs-B has published a preview version of this PR with release workflow run #9, based on commit ed74964:

1.0.16-PREVIEW.dbfix-snyk-high-in-ion-java.2024-03-04T1724.ed749646

Want to make another preview release?

Click 'Run workflow' in the GitHub UI, specifying the db/fix-snyk-high-in-ion-java branch, or use the GitHub CLI command:

gh workflow run release.yml --ref db/fix-snyk-high-in-ion-java

Want to make a full release after this PR is merged?

Click 'Run workflow' in the GitHub UI, leaving the branch as the default, or use the GitHub CLI command:

gh workflow run release.yml

@Divs-B
Copy link
Contributor Author

Divs-B commented Mar 4, 2024

Snyk high vuln seems fixed, tested on pubflow by using preview released version of firehose-client 1.0.16-PREVIEW.dbfix-snyk-high-in-ion-java.2024-03-04T1724.ed749646.

@Divs-B Divs-B merged commit 954ded0 into main Mar 5, 2024
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants