Skip to content

Vulnerability detected in dependency used for the latest version in Maven Repository: 2.9.0 #433

Description

@TylerMcCraw

Describe the bug
Builds are failing due to this error

> Could not find com.xwray:groupie:2.9.0.
     Required by:
         *******************
 > Could not find com.xwray:groupie-viewbinding:2.9.0.
     Required by:
         *******************

Which leads me to this vulnerability found:
https://mvnrepository.com/artifact/com.xwray/groupie/2.9.0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15250

We need to upgrade the Junit dependency to 4.13.1 or higher to fix this issue

To Reproduce
Steps to reproduce the behavior:

  • Use version 2.9.0 of Groupie from MavenCentral
  • Build and notice the error above

Expected behavior
Gradle should be able to pull the dependency without errors due to vulnerabilities

Library version
2.9.0

Additional context
Add any other context about the problem here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions