azagniotov/stubby4j

[QUESTION] Is snakeyaml 2.0 support in scope for next releases?

Closed this issue · 5 comments

We would like to run stubby version 7.5.2 with snakeyaml 2.0.

On the one hand when running this setup we get an error:

The following method did not exist: void org.yaml.snakeyaml.LoaderOptions.setCodePointLimit(int)'

I guess there is no support for that version so far.

On the other hand we can't relay on snakeyaml 1.x versions due to security restrictions in our project.

CVE-2022-1471

Is there any plan to support snakeyaml 2.0?

Thanks for opening your first issue. Pull requests are always welcome too! :)

@InigoCrespoSoria If you could make a PR, that would help 👍🏼

Let me look at this next week.. I will try to find time and upgrade SnakeYAML

I am having publishing issues (similar to this guy: https://issues.sonatype.org/projects/OSSRH/issues/OSSRH-98405?filter=allopenissues) when trying to stage a release on the new s01.oss.sonatype.org (as opposed to the old oss.sonatype.org)

In the meanwhile, if you are fetching the stubby4j JAR from Maven Central, I can suggest to use version 7.6.1-SNAPSHOT. For reference:
https://oss.sonatype.org/content/repositories/snapshots/io/github/azagniotov/stubby4j/7.6.1-SNAPSHOT/

I have released v7.6.0 to Maven Central. Please allow a few hours.