Some vulnerable dependencies in 1.1.3

[johannwesely]

Hello,
we made a security check on our dependencies some of the milo dependencies are shown as vulnerable in maven central as there are :

1. io.netty:netty-codec:jar:4.1.127.Final
2. in netty-transport-4.1.127.Final there it is :
   AssertJ Core » 3.18.0

https://mvnrepository.com/artifact/io.netty/netty-transport/4.1.127.Final/dependencies
https://mvnrepository.com/artifact/org.eclipse.milo/milo-stack-core/1.1.3/dependencies

is it possible for you to update these dependencies in next release ?

Greetings Johann

[kevinherron]

Sure, I can update Netty to latest.

[dcntrd]

Hi, I've two questions about this

1. When will the netty update be available?

2. Is it possible to run milo 1.1.2 with netty 4.2.15.Final or are there problems to be expected?

Thank you!

[kevinherron]

@dcntrd 1.1.4 was released two weeks ago and includes the Netty update.

[dcntrd]

I just wonder because the release/1.1.4 branch pom.xml still refers to 4.1.133.Final

<netty.version>4.1.133.Final</netty.version>

But I thought it is already on 4.2.15.Final

[kevinherron]

I just wonder because the release/1.1.4 branch pom.xml still refers to 4.1.133.Final

<netty.version>4.1.133.Final</netty.version>

But I thought it is already on 4.2.15.Final

Ah yes sorry should have been clear - 4.1.133 fixes all the same CVEs. Won't be updating to 4.2.x yet. Most people seem to be on 4.1.x right now.

I think you could exclude and bring your own 4.2.x without issue.

[dcntrd]

Thanks, tried it with 4.2.15.Final without any issues.