Skip to content

Conversation

@candrews
Copy link
Contributor

@candrews candrews commented Jun 5, 2025

The version of jgit currently used has known vulnerabilities, https://nvd.nist.gov/vuln/detail/cve-2023-4759 and https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4949 - this PR updates the version of jgit eliminating those concerns.

@candrews
Copy link
Contributor Author

@rpalcolea and others - can you please look at this security issue?

@candrews
Copy link
Contributor Author

eclipse-jgit/jgit@acde6c8 changed ApplyCommand to require the repository to support the getObjectDatabase method which NotNecessarilyGitRepository doesn't implement (see eclipse-jgit/jgit@acde6c8#diff-257677dac52357ed18fecaac57b4a18fbf5f6e4b93f20c42e77e650355af2c5eR114), resulting in test failures.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant