David Handermann created NIFI-16244:
---------------------------------------
Summary: Set Apache HttpClient 5 version to 5.6.4 and Ignore
Jackson Issues for Hazelcast 5.7.0
Key: NIFI-16244
URL: https://issues.apache.org/jira/browse/NIFI-16244
Project: Apache NiFi
Issue Type: Improvement
Components: Extensions
Reporter: David Handermann
Assignee: David Handermann
The Apache HttpClient 5 version should be set to 5.6.4 at the project root
configuration to avoid transitive references to earlier vulnerable versions in
extension modules.
Hazelcast 5.7.0 depends on shaded versions of Jackson 2 and Jackson 3, and the
current minor shaded versions have associated security vulnerability findings.
These findings and versions should be added to the Grype ignore configuration
for now.
Addressing these issues resolves current failures with the Scan job of the Code
Compliance workflow.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
