-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
"Adal4j" library is not optional in 21.0.0.-legacy release #3596
Comments
Babak-abd
changed the title
"Adal" library is not optional in 21.0.0.-legacy release
"Adal4j" library is not optional in 21.0.0.-legacy release
Jul 25, 2024
not sure if its related but should https://github.com/kubernetes-client/java/blob/release-legacy-21/util/pom.xml#L62 be also optional? |
I think we need to backport #3560 into the legacy branch. The basic bug is that mvn appears to not respect inheritance of optional in child poms. |
k8s-ci-robot
added a commit
that referenced
this issue
Aug 13, 2024
optional 3rd party ignored (issue #3596)
thank you for backporting this. is there any date scheduled for the 21.0.1 legacy version to be built with those changes? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
On #3175 PR, Adal was marked as Optional but when i am looking at 21.0.0-legacy on mvn repository, it does not show it as optional.
I am sure that at one point, I saw it optional and our security scans did not report this.
now with this version, our scans are showing CVE-2021-31684 and CVE-2023-1370 which is related to nimbus-jose-jwt-9.8.1.jar and json-smart-2.4.2.jar libraries.
Client Version
21.0.0.-legacy
The text was updated successfully, but these errors were encountered: