-
-
Notifications
You must be signed in to change notification settings - Fork 266
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix CVEs and update dependencies #1205
base: 3.2.x
Are you sure you want to change the base?
Conversation
I currently have this published locally and am using it to build my first Discord4J bot |
Looks like this updates breaks the compile with Java 8 |
Strange. This compiles for me locally. I've been using it all day to transfer my old bot from JS to Kotlin. It should be fixable |
I'm using Coretto 1.8 |
This one should be fixed for all CVEs in logback |
However, lavaplayer still needs to be fixed upstream |
This should target 3.2.X, I'll rebase it |
api "io.projectreactor.netty:reactor-netty-http:1.1.18" | ||
api "io.projectreactor.addons:reactor-extra:3.5.1" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i feel this need to be moved to a var like the rest of version definitions.
Description: Fixes CVE-2021-42550, CVE-2023-34462, CVE-2023-44487, and CVE-2023-34062. Does not fix, however, Cxeb68d52e-5509, CVE-2021-37714, CVE-2020-13956, and CVE-2021-29425. These other ones need to be fixed upstream in lavaplayer.
Justification: I don't feel comfortable nor should anyone, using Discord4J as long as it has CVEs. These CVEs might not affect Discord4J, but it is better to side with caution.
This version builds and tested using
./gradlew test
.Additionally, old dependencies were updated because Discord4J uses 2-3 years old versions.