Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[che-server] Get rid of the jackson-dataformat-yaml dependency #22106

Closed
vinokurig opened this issue Mar 29, 2023 · 5 comments
Closed

[che-server] Get rid of the jackson-dataformat-yaml dependency #22106

vinokurig opened this issue Mar 29, 2023 · 5 comments
Assignees
@vinokurig
Labels
area/che-server kind/task Internal things, technical debt, and to-do tasks to be performed. lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. severity/P1 Has a major impact to usage or development of the system. team/A This team is responsible for the Che Operator and all its operands as well as chectl and Hosted Che

Comments

@vinokurig
Copy link
Contributor

Is your task related to a problem? Please describe

The jackson-dataformat-yaml dependency contains org.yaml:snakeyaml dependency:

[INFO] +- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.14.1:compile
[INFO] |  \- org.yaml:snakeyaml:jar:1.33:compile

According to the trivy report, It brings a CRITICAL vulnerability. Updating the snakeyaml dependency to 2.0, as proposed in the report, is not a solution, because the dataformat-yaml dependency is not compatible with the snakeyaml 2.0.

Describe the solution you'd like

Rework the che codebase to avoid using the jackson-dataformat-yaml dependency.

Describe alternatives you've considered

No response

Additional context

No response
@vinokurig vinokurig added the kind/task Internal things, technical debt, and to-do tasks to be performed. label Mar 29, 2023
@che-bot che-bot added the status/need-triage An issue that needs to be prioritized by the curator responsible for the triage. See https://github. label Mar 29, 2023
@vinokurig vinokurig mentioned this issue Mar 29, 2023
Merged
9 tasks
@vinokurig vinokurig changed the title Get rid of jackson-dataformat-yaml dependency [che-server] Get rid of jackson-dataformat-yaml dependency Mar 29, 2023
@vinokurig vinokurig changed the title [che-server] Get rid of jackson-dataformat-yaml dependency [che-server] Get rid of the jackson-dataformat-yaml dependency Mar 29, 2023
@ibuziuk ibuziuk added severity/P1 Has a major impact to usage or development of the system. sprint/next team/A This team is responsible for the Che Operator and all its operands as well as chectl and Hosted Che and removed status/need-triage An issue that needs to be prioritized by the curator responsible for the triage. See https://github. sprint/next labels Mar 30, 2023
@vinokurig vinokurig self-assigned this Mar 30, 2023
@vinokurig
Copy link
Contributor Author

The https://github.com/FasterXML/jackson-dataformat-yaml repository has been archived 4 years ago, so I can not create an issue in their repository to ask about the vulnerable child dependency.

@che-bot
Copy link
Contributor

che-bot commented Sep 26, 2023

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.

@che-bot che-bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 26, 2023
@vinokurig
Copy link
Contributor Author

lifecycle/frozen

@vinokurig
Copy link
Contributor Author

/remove-lifecycle stale

@che-bot che-bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 26, 2023
@che-bot
Copy link
Contributor

che-bot commented Mar 24, 2024

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.

@che-bot che-bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 24, 2024
@che-bot che-bot closed this as completed Mar 31, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@vinokurig vinokurig

Labels
area/che-server kind/task Internal things, technical debt, and to-do tasks to be performed. lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. severity/P1 Has a major impact to usage or development of the system. team/A This team is responsible for the Che Operator and all its operands as well as chectl and Hosted Che
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@ibuziuk @vinokurig @che-bot