fix: pin jsoup to 1.23.1 to resolve XSS vulnerability - #312
Conversation
jsoup 1.22.x is pulled in transitively via com.contentstack.sdk:utils and is flagged by Snyk for a Cross-site Scripting (XSS) issue, fixed in 1.23.1. Pin the version in dependencyManagement following the existing pattern used for other contentstack-utils transitive deps.
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
Summary
org.jsoup:jsoup@1.22.x(pulled transitively viacom.contentstack.sdk:utils) for a Cross-site Scripting (XSS) issuejsoupto1.23.1independencyManagement, following the existing pattern used for other transitive deps fromcontentstack-utils(spring-*, commons-lang3)Test plan
mvn dependency:tree -Dincludes=org.jsoup:jsoupconfirms resolved version is1.23.1mvn compile test-compilesucceedssnyk test— no vulnerable paths found