Skip to content

Conversation

@soleanos
Copy link

Hello, this PR is related to issue 11869 about security dependency.
After passing my professional application to the XRAY scan, it appears that your application has multiple dependencies which open up major flaws:

The version of org.sonatype.plexus:plexus-build-api:jar (0.0.7) which is very old (from 2011) and contains org.codehaus.plexus:plexus-utils:jar:1.5.8:compile reassembled by xray. In addition, your jar also contains a version of maven-core which is obsolete and also contains a major security flaw.

I just upgraded maven core to last version but i cant for plaxus build api because there is no new version since 2007 => why do you use it ? Could you use another lib instead ? If you wants use plexus utils you can take last versions like https://mvnrepository.com/artifact/org.codehaus.plexus/plexus-utils

Thanks you

@soleanos soleanos requested a review from jimschubert as a code owner March 15, 2022 16:37
@wing328
Copy link
Member

wing328 commented Mar 15, 2022

Thanks for the PR but your commit (as shown in the Commits tab) is not linked to your Github account, which means this PR won't count as your contribution in https://github.com/OpenAPITools/openapi-generator/graphs/contributors.

Let me know if you need help fixing it.

Ref: https://github.com/OpenAPITools/openapi-generator/wiki/FAQ#how-can-i-update-commits-that-are-not-linked-to-my-github-account

@wing328
Copy link
Member

wing328 commented Mar 16, 2022

CI failed with the following errors:

Error:  Errors: 
Error:    org.openapitools.codegen.plugin.CodeGenMojoTest#testCommonConfiguration NoSuchMethodError
Error:    org.openapitools.codegen.plugin.CodeGenMojoTest#testHashGenerationFileContainsExecutionId NoSuchMethodError
Error:    org.openapitools.codegen.plugin.CodeGenMojoTest#testSkipRegenerationForClasspathSpecFileNoChange NoSuchMethodError
Error:    org.openapitools.codegen.plugin.CodeGenMojoTest#testSkipRegenerationForClasspathSpecFileWithChange NoSuchMethodError
Error:  Tests run: 4, Failures: 0, Errors: 4, Skipped: 0
Error:  Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:3.0.0-M5:test (default-test) on project openapi-generator-maven-plugin: There are test failures.
Error:  
Error:  Please refer to /home/runner/work/openapi-generator/openapi-generator/modules/openapi-generator-maven-plugin/target/surefire-reports for the individual test results.
Error:  Please refer to dump files (if any exist) [date].dump, [date]-jvmRun[N].dump and [date].dumpstream.

https://github.com/OpenAPITools/openapi-generator/runs/5557523738?check_suite_focus=true

I'll try to fix these locally

@wing328
Copy link
Member

wing328 commented Mar 20, 2022

Closed via #11915

@wing328 wing328 closed this Mar 20, 2022
@soleanos
Copy link
Author

sorry for the reaction time and also for my merge request which was not complete the version I put no longer had a method that you use apparently .. I'm a bit underwater right now - would you know when the next release of your project will be available? Thank you and have a good day

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants