[lyo-dev] Fwd: [eclipse/lyo.server] [Snyk] Security upgrade org.apache.j

[Andrii Berezovskyi <andriib@xxxxxx>]

See below

–Andrew

Begin forwarded message:

From: Andrew Berezovskyi <andrew@xxxxxxxxxxxxxx>
Date: 2 December 2020 at 12:44:19 CET
To: lyo-dev@xxxxxxxxxxx
Subject: Fwd: [eclipse/lyo.server] [Snyk] Security upgrade org.apache.jena:apache-jena-libs from 3.14.0 to 3.17.0 (#44)

Hello,

We usually always upgrade Jena before release if there is any security notice. This time we will make an exception, Jena 3.16 is expected to add breaking behaviour and we will use Jena 3.14 for the 4.0 release. The problem does not seem to be exploitable and one can force update httpcomponents in their POM.

We are planning to release 4.1.0-alpha1 with Jena 3.16 or 3.17 after 4.0 release so that you can test if Jena 3.16 breaks something for you. The breakage is connected to the newly added support for RDF* (RDF star).

–Andrew

Begin forwarded message:

From: Snyk bot <notifications@xxxxxxxxxx>
Date: 2 December 2020 at 05:53:06 CET
To: "eclipse/lyo.server" <lyo.server@xxxxxxxxxxxxxxxxxx>
Cc: Subscribed <subscribed@xxxxxxxxxxxxxxxxxx>
Subject: [eclipse/lyo.server] [Snyk] Security upgrade org.apache.jena:apache-jena-libs from 3.14.0 to 3.17.0 (#44)
Reply-To: "eclipse/lyo.server" <reply+AAAPZXRVRWBOBBJXRWXOC5N52L7LBEVBNHHCZ73SEA@xxxxxxxxxxxxxxxx>



Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • pom.xml

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Upgrade	Breaking Change	Exploit Maturity
	539/1000 Why? Has a fix available, CVSS 6.5	Improper Input Validation SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-1016906	org.apache.jena:apache-jena-libs: 3.14.0 -> 3.17.0	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

You can view, comment on, or merge this pull request online at:

  https://github.com/eclipse/lyo.server/pull/44

Commit Summary

• fix: pom.xml to reduce vulnerabilities

File Changes

• M pom.xml (2)

Patch Links:

• https://github.com/eclipse/lyo.server/pull/44.patch
• https://github.com/eclipse/lyo.server/pull/44.diff

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or unsubscribe.