build: update org.json:json to patched version #850
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Close: #849
Soy brings
org.json:json
as a transtivite dependency. Unfortunately, it brings https://ossindex.sonatype.org/component/pkg:maven/org.json/json@20230618 which is affected by a HIGH CVE.There is no version of soy patched.
I reported an issue: google/closure-templates#2128
This PR forces
org.json:json
to first patched version.I have verified with the sonatype scan gradle plugin this PR fixes the issue.