remove commons-io dependency #95
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lbalmaceda
added
the
needs investigation
|
Hi @lbalmaceda, just checking in to see if you've had a chance to take a look at this yet or not. |
|
👋 Hi @Jaxsun. I won't be able to take a look at it until the next week. It does look like a valid removal, as the CI is not complaining about anything. But I'd like to double-check locally before merging this. For our own reference, we're tracking this internally under |
|
Thanks for the update! |
lbalmaceda
added
CH: Removed
and removed
needs investigation
lbalmaceda
approved these changes
Aug 26, 2020
|
I can cut a release by the end of the week. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
Removes the dependency on Apache commons-io.
IQ Server reports a vulnerability in commons-io relating to https://issues.apache.org/jira/browse/IO-559
Initially I was going to send a PR with a version bump similar to #26
However in checking whether the jwks-rsa library used the affected class from commons-io I noticed that the library doesn't appear to use commons-io at all. The build and test passes when removing the dependency so I figured it would be worth contributing that removal to avoid unnecessary dependencies and churn based on vulns or other issues with the dependency.
If I am wrong and this dependency is needed I can happily contribute a version bump instead.
References
https://issues.apache.org/jira/browse/IO-559
#26
Testing
I am unsure what testing other than the existing build and test is needed by maintainers to validate this change.
Checklist