sendinblue/APIv3-java-library

Fix your dependencies, please!

uhausbrand opened this issue · 3 comments

uhausbrand commented

Hi,
I tried to update your library from 6.0.0 to 7.0.0 recently and was surprised to see that you ship now maven-gpg-plugin and all its transitive dependencies. Why on earth do you do that?

Could you please check your dependencies and only ship those which are really needed for compiling and using your library.

edwardmp commented

Some dependencies also have known vulnerabilities.. @Kool-Hussain @shubhamUpadhyayInBlue

Warning: Provides transitive vulnerable dependency maven:org.codehaus.plexus:plexus-utils:3.0.15 CVE-2017-1000487 9.8 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability

  • 👍4
amitsendinblue commented

The new version of Brevo Java SDK has been released, and this plugin has been updated, please use the new version.
https://central.sonatype.com/artifact/com.brevo/brevo
Thanks

micvm commented

The new version of Brevo Java SDK has been released, and this plugin has been updated, please use the new version. https://central.sonatype.com/artifact/com.brevo/brevo Thanks

Thanks for letting us know. Will the dependencies be fixed there?