From c6a55a8e4be2bb429909a0e70a4110cfcba9a41a Mon Sep 17 00:00:00 2001 From: Alexander01998 Date: Wed, 17 Apr 2024 18:19:29 +0200 Subject: [PATCH] Update build.gradle to fix vulnerable sub-dependencies Specifically: 1. CVE-2022-42003, CVE-2021-46877, CVE-2022-42004, and CVE-2020-36518, all caused by com.fasterxml.jackson.core:jackson-databind version 2.13.0. 2. CVE-2023-3635, caused by com.squareup.okio:okio version 3.2.0 and com.squareup.okio:okio-jvm version 3.2.0. These vulnerabilities don't affect end users of the mod. Only developers were potentially affected. Then again, the attack vectors for these CVEs aren't super relevant when compiling Minecraft mods. So, do update your forks, but don't worry too much. --- build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index aaa7a60..7aeb75f 100644 --- a/build.gradle +++ b/build.gradle @@ -1,6 +1,6 @@ buildscript { dependencies { - classpath 'org.kohsuke:github-api:1.135' + classpath 'org.kohsuke:github-api:1.321' } } @@ -9,7 +9,7 @@ plugins { id 'maven-publish' id 'com.matthewprenger.cursegradle' version '1.4.0' id "com.modrinth.minotaur" version "2.+" - id 'com.diffplug.spotless' version '6.23.3' + id 'com.diffplug.spotless' version '6.25.0' } def ENV = System.getenv()